Week 5

Question 1

Data of evidentiary value is commonly referred to as what?

Answer 1

Artifacts

Question 2

What is the opposite of dead box analysis?

Answer 2

Live forensics

Question 3

What is the name of the device which prohibits the computer from writing data during live forensics?

Answer 3

A write blocker

Question 4

What is the difference between a physical disk image and a logical disk image?

Answer 4

Physical: bit-by-bit copy
Logical: copy of partitions as seen by OS

Question 5

What are examples of volatile data that can be collected during live analysis?

Answer 5

Current network connections, current user, analyse possible encryption software

Question 6

Why do we need to account for all data on a hard drive?

Answer 6

To establish if there are hidden partitions

Question 7

Why is it important to examine time zone settings on a device?

Answer 7

To establish accurate timelines in criminal investigations