Topic 4

Question 1

Name 3 different types of storage formats for digital evidence

Answer 1

Raw Format
Propietary Formats
Advanced Forensic Format

Question 2

Define the Raw Format

Answer 2

Raw format is a bit by bit copy of the suspect drive. It uses a bit stream to write a series of of sequential flat files.

Question 3

Name 2 advantages and 2 disadvantages of the Raw format

Answer 3

Advantages:
Readable by most tools
Fast data transfers
Ability to ignore minor data read errors on source drive
Disadvantages:
Takes up same storage as the original disk or data set
My not collect marginal sectors on source drive

Question 4

Name 2 advantages and disadvantages of Proprietary Formats

Answer 4

Advantages
option to compress
option to split an image into smaller segments
option to integrate metadata into the image file
Disadvantages
cannot share between different tools
some have maximum file sizes per segment

Question 5

Name 4 types of acquisitions

Answer 5

Static acquisitions, live acquisitions
logical acquisitions
sparse acquisitions

Question 6

Name 4 acquisition methods

Answer 6

disk-to-image file
disk-to-disk copy
logical disk-to-disk or disk-to-data file
sparse copy of a folder or file

Question 7

Why would you use a disk-to-disk copy?

Answer 7

If you can’t make a disk to image file because of hardware or software errors or incompatibilities. More common in older drives

Question 8

Why would you use a logical acquisition or sparse acquisition?

Answer 8

When you
are only interested in specific files
do not have time/space to copy the whole drive

Question 9

Why would you use a hardware write blocker and not a software write blocker?

Answer 9

Software write blockers will change data on the target drive. They use an automatic mounting process that updates boot files by changing metadata such as the most recent access time

Question 10

What do you do if you cannot access the target drive (physically)?

Answer 10

Use a boot CD - such as
Mini-WinFE
Linux Live

Question 11

What does RAID stand for?

Answer 11

Redundant Array of Independent Disks

Question 12

Name 4 issues in acquiring a RAID?

Answer 12

How much storage is necessary?
What type of RAID is used? 0-5, 10, 15
Appropriate acquisition tool
Can acquisition tool combine images for 1 virtual RAID?

Question 13

What 4 steps do you take in performing an acquisition?

Answer 13

Use a target drive that has been recently wiped and reformatted and inspected for virus
Inventory the hardware
For static acquisitions remove the hard-drive. Check date and time values in the system’s CMOS
Record how you aquired data from the suspect drive

Question 14

What steps do you take in performing an analysis?

Answer 14

If possible examine the contents of all data files in all folders, starting at the root folder, unless only certain files are of interest
Make best effort to recover password protected files
identify the function of every executable file that doesn’t match known hash values. Make a note of any files or folders that are out of place
Maintain control of all evidence and findings and document everything as you progress through your examination

Question 15

How can you use hash values of known files to speed up analysis?

Answer 15

1 By eliminating known innocuous files like system files and
2 By searching for known nefarious files such as child exploitation images

Question 16

Name 5 data hiding techniques

Answer 16

• Hiding files by using the OS, eg changing file extensions, marking folders as “hidden”
• Hiding Partitions - can unassign a partition drive letter
• Marking bad clusters - using diskEdit, you can mark a good cluster as bad, and the OS will skip it
• Bit-shifting - use a macro to change the order of bits
• steganography

Question 17

How do you deal with hiding files by using the OS?

Answer 17

Some DF tools will highlight discrepancies between file headers and the file ectension
- select the option to view hidden files and folders -may be automatic in DF tools though.

Question 18

How do you deal with hiding partitions?

Answer 18

Account for all of the storage of the hard drive. Partition gaps are usually 128 bytes

Question 19

How do you deal with marking bad clusters?

Answer 19

DF tools, file carving from slack or free space

Question 20

How do you deal with steganography? (5 attacks)

Answer 20

• Stego-only attack - only the file is known. difficult
• known cover attack - cover media is known
• known message attack - used to determine the method of hiding for future attacks
• chosen stego attack - knows what tool was used, uses a passphrase to decrypt
• Chosen message attack

Question 21

how do you deal with encrypted passwords?

Answer 21

• Can use key escrow
• various brute force tools
• determine personal information + brute force = hybrid attack
• rainbow tables