Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

IDT-293 IT & Data Assurance I > Set 1 > Flashcards

Set 1 Flashcards

1
Q

What is a forensics Lab?

A

Workspace to perform data extraction, analysis, and reporting, must be accredited such as with ISO/IEC 17025:2005

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is a Forensics Lab Manager responsible for?

A

for the overall operation of the lab, ensures analysts have what they need, handles staffing, ensures staff receive appropriate training.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What does a Forensics Analyst do?

A

Performs scientific analysis of collected digital evidence collected from a variety of sources.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Define a Forensics investigator.

A

Focuses on collection and retrieval of digital evidence. Similiar to Forensics Analyst.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What does ASCLD stand for?

A

American Society Crimes Laboratory Directors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What does ASCLD/Labs group do?

A

They conduct forensics lab certification.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What do the security mechanisms Preventive, Detective, & Corrective mean?

A

Preventive - Prevents a security incident from happening
Detective - Discovers if a security event is in progress or has already occurred
Corrective - Aimed at fixing the root cause of the vulnerability that gave rise to the incident

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What do the security mechanisms Recovery, Deterrent, and Compensating mean?

A

Recovery - Restores the computing environment back to a “good known state”
Deterrent - Keeps an event from happening by creating an obstacle for the attacker
Compensating - A control inserted to compensate for lack of a permanent control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What are two principles of physical security?

A

Ensure the physical security of the lab.

Ensure the physical security of the evidence within the lab.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Why would you want two separate tables in a forensics lab?

A

One with two forensics workstations
One with one or two plain workstations for results validation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is 5WH?

A

Questions used for problem solving.

They consist of who, what, when, where, why, how.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Define computer forensics

A

The collection and preservation of evidence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is used to manipulate mace attributes and how?

A

Time stomp, modifies the timestamp of a file

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Who was a Nobel Prize winner and discovered blood types?

A

Karl Landsteiner

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is Locard’s exchange principle?

A

A criminal will bring something and leave something that can be used as forensic evidence.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

How many set of criminal laws exist in the united states?

A

51

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Unreasonable search and seizure is what bill?

A

The 4th

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Security control that happens in the event of a crime?

A

Detection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

what is considered investigation for business use?

A

Corporate

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Data forensic analysis is responsible for what?

A

Collecting and preserving criminal evidence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Which are considered two great laws of forensics?

A

Never work with the original, preserve the state it was found in.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What determined the murderer of Robert eidman?

A

touch DNA from the lining of Eidman’s pocket

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

People vs holcolm is a criminal case? true or false

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What two departments should you get authorization from before any search and seizure?

A

Legal and HR

25
Q

What is an example of not digital evidence?

A

Document from a printer

26
Q

Chain-of-custody?

A

Chain of custody is a documented record of who had possession and control over a particular piece of evidence at every moment until that object is entered into evidence in the courtroom.

27
Q

chain-of-evidence?

A

Includes the search and seizure of that evidence and the cataloging of that evidence, as well as the chain of custody of that evidence once it has been obtained.

28
Q

Digital evidence is not considered fragile true or false?

A

False

29
Q

What is a magic byte?

A

Indicators at the beginning of a hash that tell you what type of file it is.

30
Q

Which of the following would not be considered anti forensics techniques?
Encryption
Disk Wiping
Compression
preventing mace values from changing

A

preventing mace values from changing

31
Q

What is anti-forensics?

A

Anti-forensics is the art of destroying data

32
Q

What are the two main types of evidence?

A

Relevant (what is relevant to the case) and admissible (what is used in court)

33
Q

What are Invisible attributes called?

A

Meta data

34
Q

Difference between live collection and dead collection?

A

Live is when system is running, dead is when system is off

35
Q

An incident responder is not concerned with what?

A

Determining motive

36
Q

What attempting to solve a crime what would you use to create a hypothesis?

A

the Scientific method

37
Q

According to first responders what should not be done during a crime scene?

A

Turning something on if its off

38
Q

Which of the following peripherals is most likely to contain digital evidence?
Laptop
Computer
Printer
Hard Drive

A

Printer

The only peripheral listed.

39
Q

What is the Magic byte of 5a4d?

A

An executable

40
Q

Federal rules of evidence should be used by state level? yes or no

A

Yes

41
Q

What is best evidence?

A

The best evidence rule applies when a party wants to admit as evidence the contents of a document at trial but the original document is not available.

42
Q

What is a warrant?

A

probable cause or signed allowance for search and seizure or whatever is listed on the warrant

43
Q

What is the HIPO (Hierarchical Input-Process-Output) diagram?

A

Guidelines for digital forensics investigators.

  1. Pre-Investigation
  2. Preparing the Investigation
  3. Search and Seizure
  4. Analyzing the Evidence
  5. Reporting and Testifying
  6. Post-Investigation
44
Q

What do Pre-investigation, preparing the investigation, and search and seizure involve?

A

Pre-investigation-Learn requirements for case, build forensic capabilities, forensic hardware and methods

Preparing the investigation-Info about the case, develop hypothesis and plans, plan to obtain digital evidence

Search and seizure- Forensically sound seizure of evidence

45
Q

What do
Analyzing the Evidence
Reporting and Testifying
Post-Investigation
involve?

A

Analyzing the Evidence- Using captured evidence and creating an analysis based on your hypotheses, getting results of an analysis that has value

Reporting and Testifying- Final report is written and testimony is given

Post-Investigation- Analyze notes taken and the process used to update investigative methods and risks

46
Q

Which is used for having a smartphone not remotely wiped?

A

Faraday bag

47
Q

When a system is powered on but screen is blank what should you do?

A

Move the mouse

48
Q

If a warrant isn’t quick enough and it’s a dangerous circumstance can you go without a warrant?

A

Yes

49
Q

A forensic image of a hard drive image is created how?

A

bit by bit

50
Q

Which is not included in an investigation toolkit?

A

Magnets

51
Q

Drunk driver can be sued with tort law? True or False

A

True

52
Q

As a member of corporate what do you need before acting?

A

Authorization

53
Q

What helps in keeping records of an investigation and writing a findings report?

A

photographs and sketches

54
Q

When evidence changes hands?

A

Change of custody

55
Q

What is not in the Analyzing the evidence phase?

A

Testifying in court

56
Q

Who can assess what the evidence proves to the court?

A

expert witness

57
Q

Before touching a laptop what should you do?

A

Photograph it

58
Q

Which type of form would be completed as they collect things identified as evidence?

A

Chain-of-evidence

IDT-293 IT & Data Assurance I (4 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions