Week 4 - Write-Blocking & Hashing

Question 1

What is write blocking?

Answer 1

It is a method that prevents write processes on a disk. It is used to ensure that the data on a disk is not corrupted or changed during investigation.

Question 2

When is write blocking used?

Answer 2

Whenever a disk (Original copy or perhaps an image) is plugged into investigative machine. It prevents the machines OS from contamenating the disk’s data by only allowing read operations.

Question 3

Give the 3 types of write blockers.

Answer 3

Hardware write blockers
Forensically sound OS systems
Software write blockers

Question 4

What is a Hardware write blocker?

Answer 4

A piece of physical hardware that goes in between the machine and the disk, and physically disconnects the write line on the interface to prevent write operations. It basically cannot carry write operations through its connections.

Question 5

How do forensically sound OSs stop write operations?

Answer 5

They give you extra settings to allow you to disable write operations.

Question 6

What is the prefered type of write blocker? Why?

Answer 6

Hardware write blockers.

Because they are always forensically certified and reliable.

Question 7

How are images verified to be exact copies of the original?

Answer 7

A checksum program is used to compare the hash of the image drive to the hash of the original drive. This is done throughout the investigation during multiple stages, not just at the start and end.

Question 8

What are 2 common checksums?

Answer 8

Md5

Sha1

Question 9

In MD5 hashing, how long is the checksum?

Answer 9

128-bit

Question 10

In Sha1 hashing, how long is the checksum?

Answer 10

160-bit

Question 11

Why is hashing used to compare the image and original?

Answer 11

Because hashing gives a unique value for each file. If two files are the same, they will give the same hash value. If there is even the slightest change, it will be reflected by a big change in the hash value.

Question 12

What is an advantage that Sha1 has one MD5? Why is it used more than MD5?

Answer 12

Sha1 has a longer hash value, therefore ther is reduced likelyhood of hash collisions (When two different values give the same hash value).

Question 13

How would you use the MD5 hash on windows?

Answer 13

You would use the MD5 hash program called WinMD5.

Question 14

How would you run the sha1 command on Linux?

Answer 14

sha1sum -c

Question 15

How would you run the md5 command on Linux?

Answer 15

md5sum -c