Week 1

Question 1

Objectives of Computer Forensics (R.A.P)

Answer 1

To Recover , Analyze and present computer-based material in such a way that it can be presented as evidence in the court of law.

Question 2

Who Performs Computer Forensics (L.C.C.P)

Answer 2

Law Enforcement for Criminal Cases
Corporate IT security personal for criminal / civil cases
Corporate HR investigators for workplace investigations
Private investigators for various investigations

Question 3

What does Computer Forensics Involve (P.I.E.I.D , L.I.F.P)

Answer 3

Preservation
Identification
Extraction
Interpretation
Documentation

Legal Processes
Integrity of Evidence
Factual Reporting of the information found
Providing expert opinion in the court of law

Question 4

Preservation (P.O.M.C)

Answer 4

Preserve the integrity of the original evidence
Original evidence should not be modified or damaged
Make an image/copy of the original evidence and then perform analysis
Compare the copy to the original evidence to identify any modifications or damages.

Question 5

Hashing (P)

Answer 5

prove that all the evidences are exactly the same as the original data, down to the very last bit !

Question 6

What are the values returned by the hash called ?

Answer 6

Hash values , Hash codes , Hash sum , Hashes

Question 7

Identification (S.L)

Answer 7

Start by identifying the evidence and its location.
Locating and identifying the evidence is a challenge for the Forensic Investigator.

Question 8

Extraction (O.V.E)

Answer 8

Once the evidence is identified and located , the evidence should be extracted immediately.

Volatile data can be lost at any point of time. FI should extract these data from the copy he made from the original evidence.

Extracted data must be compared with original evidence and analyzed.

Question 9

Interpretation (M.A)

Answer 9

Most important role of Fi during investigation is to is to interpret what he has found .

Analysis and inspection of the data must be interpreted in a lucid manner.

Question 10

Documentation (M)

Answer 10

Maintained from the Beginning to End

Question 11

Forensics in a nutshell

Answer 11

Evidence Acquisition
Investigation and Analysis
Report Finding

Question 12

What is digital evidence (F.P.P.P)

Answer 12

Fragile , Protect , Preserve and Probative

Question 13

Categories of Forensic Data (A.L.A)

Answer 13

Active Data - Data that can be seen
Latent Data - Data that exists despite being deleted
Archival Data - Data in backup

Question 14

Persistent vs Volatile Data

Answer 14

Persistent Data - preserved when the computer is turned off
Volatile Data - Will be lost when the computer loses power or it is turned off.

Question 15

What is a Forensic Image ?

Answer 15

Forensic image is a copy of original evidence generally collected by a tool that performs bit-level copying from one location to another.

Question 16

Three Common Disk Image Formats (E,R,V)

Answer 16

Expert Witness/Encase (E01)
Raw (dd)
Virtual machine disk file (VMDK,OVF)

Question 17

Forensic Disk Image Format (C.P.L)

Answer 17

Complete Disk - Most preferred method as it is the most comprehensive

Partition - Contains all allocation units from an individual partition on a drive / Includes Unallocated space and file slacks within that drive / Does not capture all data on a drive (As other partitions are not captured)/Taken only under certain circumstances (e.g , excessively large disk )

Logical - Only certain files are acquired

Question 18

Traditional Imaging Process (T.T.S)

Answer 18

Traditional imaging is performed on static drives

The computer is turned off and booted into a forensic imaging environment or the disk drive is plugged in a imager or examination workstation for duplication.

Special hardware is used to prevent source media from being modified.

Question 19

Hardware Write Blockers (S.M.M)

Answer 19

Sits in the connection between a computer and a storage unit.

Monitors the commands that are issued and prevents the computer from writing to the storage device.

Many Interface such as ATA , SCSI,Firewire,USB,SATA,etc.

Question 20

Image Creation Tools (G.A)

Answer 20

Guidance Software - Encase
AccessData FTK imager

Question 21

Encase Evidence File (C.C.H)

Answer 21

Called image file.

Contains suspects drive , CRC Verification , Case Identification Info (Header), MD5 Hash.

Header information is entered by the examiner and becomes part of the evidence file , and cannot be changed.

Question 22

Physical Layout of Encase Evidence File (H.D.C)

Answer 22

Header

Data Blocks - A bit by bit copy of the data blocks on the suspect media

Checksum and hash- 32 bits verification (CRC - cyclical redundancy Check)

MD5 hash for checking of integrity

Question 23

For every _ blocks Encase computes a CRC ?

Answer 23

Encase computes a CRC for every block of 64 sectors of data (34 kbytes) (1 sector = 512 bytes)

Question 24

_ bits MD5 hash is computed for the entire data block section (exclude the CRCs)

Answer 24

128 bit

Question 25

Hashing Objectives (E.E)

Answer 25

Enforces Integrity

Ensure data not modified

Question 26

When can the verification process of Encase evidence file be successful ?

Answer 26

The verification process can only be successfully completed after both the MD5 acquisition and verification hash values match and no CRC errors are reported

Question 27

Two examples of hash functions and more about them ?

Answer 27

MD5 and SHA1

MD5 - takes in a input message of arbitrary length and produces a 128-bit(16 bytes) hash

Source Hash Algorithm (SHA1) - It takes a message shorter than or equal to (2^64 -1) bits in length and produces a 160 bit (20 bytes) hash value.

Question 28

Properties of Hashing (F.P)

Answer 28

-Fast and efficient one-way function that generates a bit sequence of fixed length from the original message . i.e. creating the hash value is fast . The size of the hash value is small.

• Process is proven to be irreversible (nearly impossible within a useful amount of time ).Original message cannot be recovered from the hash value.