Computer Forensic Exam 1

Front 1

What kind of authorization document(s) is required to conduct a criminal or civil investigation?

Back 1

search warrant or subpoena.

Front 2

2. What kind of authorization document(s) is required to conduct a criminal or civil investigation?

Back 2

search warrant or subpoena.

Front 3

3. What U.S. Constitution amendment protects against unreasonable search and seizure?

Back 3

: The Fourth Amendment

Front 4

4. What two conditions be must be met for authorized search to satisfy the Fourth Amendment requires seizure?

Back 4

1.Probable cause
2.describing the place to be searched and the persons or things to be seized

Front 5

5. What must be done in order to obtain a search warrant and affidavit ?

Back 5

An application must be filed.

Front 6

A _________should be established before drafting the application and warrant .

Back 6

search strategy

Front 7

What are the following roles search strategies generally consider of the computer in a crime investigation?

Back 7

1.Contraband,
2.repository of evidence of a crime,
3.an instrument of a crime

Front 8

What are the six levels of abstraction from a storage device’s file system?

Back 8

1. DISK 2. VOLUME 3. FILE SYSTEM
4. DATA UNIT 5. META DATA 6. FILE NAME

Front 9

A data unit in Windows is called_____?

Back 9

clusters

Front 10

A data unit in UNIX/Linux is called_______?

Back 10

Blocks

Front 11

Clusters and blocks are multiples of ________?

Back 11

512 byte sectors.

Front 12

What are common artifacts of the file name layer ?

Back 12

Files, folders, and directories

Front 13

To be protected under the Fourth Amendment, an individual must have_____?

Back 13

the reasonable expectation of privacy, meaning they must demonstrate an expectation of privacy through their behavior society must be prepared to accept that expectation of privacy as reasonable

Front 14

Give 3 examples of when privacy has been found to be NOT established by the courts.

Back 14

1) Activities conducted in plain view
2) Garbage disposed of outside a person’s property
3) Passwords displayed openly

Front 15

When may No-Knock Warrants be requested?

Back 15

when there is reason to believe a suspect may destroy evidence, and can be requested for searches involving digital evidence.

Front 16

What are Three exceptions allow warrantless searches?

Back 16

1. Plain View
2.Searching a individual when being arrested
3.When Voluntary consent is given

Front 17

What factors of voluntary consent does the Supreme Court recognizes?

Back 17

1. Age 2.intelligence 3. physical 4.mental condition

Front 18

What should be done concerning a search warrant when possible?

Back 18

: consent should be written to explicitly state the scope of the search.

Front 19

Do Subpoenas give the authorization to search or seize property?

Back 19

subpoenas order a person to
appear in court
surrender evidence

Front 20

What are the three categories Privacy legislation can be grouped into?

Back 20

1.General Privacy
2.Financial Legislation
3.Healthcare And Education Legislation

Front 21

For evidence or testimony to be considered in a court of law, it must be _______.

Back 21

Admissible

Front 22

What three conditions must be met for evidence to be admissible established as Federal Rules of Evidence as legal requirements of?

Back 22

1.relevance
2.authenticity or credibility
3.competence.

Front 23

What two conditions must be evaluated so that the evidence is relevant?

Back 23

evidence must be material, relating directly to the case

evidence must be probative, meaning it proves something significant in determining the case

Front 24

What two conditions must be met for evidence to be authentic?

Back 24

1.factual
2.credible

Front 25

__________must demonstrate the source and integrity of evidence to demonstrate it is credible .

Back 25

Investigators

Front 26

What are the most critical steps digital investigators can take to ensure evidence is not ruled inadmissible due to statutory or constitutional violations?

Back 26

Understanding and complying with the authority to search and seize evidence

Front 27

In order for evidence to be competent it must _________?

Back 27

Not be prejudicial, have any statutory constraints , and not be in violation of the suspects Constitutional rights

Front 28

What rules are particularly important to digital investigations?

Back 28

Hearsay rules

Front 29

The 3 categories Digital evidence falls into are?

Back 29

1.hearsay
2.Non-hearsay
3.Mix of hearsay and non-hearsay

Front 30

Any statement made outside of the court by an individual who is not under oath at the time the statement is made is called?

Back 30

Hearsay

Front 31

How many exceptions are there to the Hearsay Rule________, and how many of them of those rules are applicable to digital investigations____?

Back 31

24 and 6

Front 32

What are the exceptions that are applicable to digital investigations?

Back 32

Business records
Certain public records and reports
Evidence of the absence of a business record or entry
Learned treatises used to question an expert witness
Statements of the absence of a public record or entry A catch all rule

Front 33

How is the reliability of digital evidence often established?

Back 33

hash values

Front 34

What is the two step process pertaining to Rule 901(b)(4) allowing digital evidence from storage media to be introduced.

Back 34

1. Introduce the storage media, with unique identifiers. Ex. Serial numbers.

2. Media introduced with hash values or other accepted forensic identifiers

Front 35

The courts have established that investigators need not have a detailed understanding about the hashing algorithms or the software used to implement those algorithms, but must have knowledge on the operation of the tools they use TRUE or FALSE?

Back 35

TRUE

Front 36

Hashing is a _________function that computes a ________that uniquely identifies any arbitrary length input

Back 36

lossy compression, fixed-length value

Front 37

Hash values are generally presented as a____?

Back 37

hexadecimal string

Front 38

A hexadecimal string is a______ not a_____, which is a more readable representation of a_____.

Back 38

value (number), text string binary value

Front 39

MD5 hashing algorithm produces a _____hash value.

Back 39

128-bit

Front 40

_____are required to represent a single hexadecimal digit.

Back 40

Four binary bits

Front 41

A 128-bit MD5 hash value is represented with a ____hexadecimal value.

Back 41

32-digit

Front 42

Hash functions are____, meaning the original content _____be recovered from the hash value.

Back 42

Lossy cannot

Front 43

Any change of the_______, even a_______, must result in a change to _____the bits in the hash value (digest). This quality is known as the_______.

Back 43

input message, single, bit at least half, avalanche effect

Front 44

It must be computationally infeasible to find ______input messages which produce the same digest.

Back 44

two different

Front 45

A ________is when two different messages produce the same digest.

Back 45

collision

Front 46

It must be ____________to determine the input from a given hash value. This quality is referred to as________.

Back 46

computationally infeasible, preimage resistance

Front 47

It must be computationally infeasible to determine _____message from a given digest. This is
referred to as

Back 47

any input, secondary preimage resistance.

Front 48

Commonly used hash functions for forensics include?

Back 48

MD5 and SHA-1

Front 49

Fuzzy hashing techniques can be used to search_____, but not _____.

Back 49

Similar, identical files

Front 50

MD5 produces a _____hash value, while SHA-1 produces a ____hash value.

Back 50

128-bit, 160-bit

Front 51

Stronger hash functions are available, including RIPEMD and SHA-2. Both of these hash functions produce hash values from _______in length.

Back 51

160 to 512 bits

Front 52

Digital forensics uses hashing for multiple purposes, to include _____and _____large bodies of data to find evidence of interest, ______integrity, and ensuring ____.

Back 52

Sorting, filtering, verifying, confidentiality

Front 53

Name a Tool that uses fuzzy hashing to compare multiple, smaller portions of content within files to match similar files.

Back 53

ssdeep

Front 54

What are the three principles for digital evidence that the DOJ holds as standards?

Back 54

The process of collecting, securing, and transporting digital evidence should not change the evidence.

Digital evidence should be examined only by those trained specifically for that purpose.

Everything done during the seizure, transportation, and storage of digital evidence should be fully documented, preserved, and available for review

Front 55

What does Locard’s Exchange Principle state?

Back 55

Everything that enters a crime scene leaves part of itself at the crime scene and takes part of the crime scene with it

Front 56

Locard’s Exchange Principle is not limited to interactions between_____ and the, but rather ____and the______.

Back 56

Suspects, crime scene, all subjects crime scene

Front 57

The cardinal rule for first responders is ____.

Back 57

safety first

Front 58

What is a first responders second priority?

Back 58

safety and integrity of the evidence

Front 59

When Documenting the scene – Documentation should include?

Back 59

a) photographic
b) video
c) descriptive documentation including
documentation of all personnel present at the scene

Front 60

what should evidence details include?

Back 60

Make, model, and serial number of every device present
Note whether devices are on, off, or in sleep mode
Determine if devices are connected to a network, whether wireless or wired
Record status of lights and indicators
Listen to devices for indications of processing or disk activity
Identify and document installed peripherals
Look for documentation to other devices that are not present. This may indicate those devices exist elsewhere.
Photograph front and back of all devices.

Front 61

What two questions must be asked when identifying data sources?

Back 61

What are the obvious data sources?
Ask what data sources may exist that are not obvious?

Front 62

What are examples of other data sources that may not be obvious?

Back 62

remote storage, which might be indicated by software or links to cloud- or network-based storage

Front 63

What are potential consequences from compromises in the chain of custody?

Back 63

1. Misidentification of evidence
2. Contamination or loss of evidence
3. Tampering with evidence

Front 64

Evidence should be stored in a designated storage facility that?

Back 64

1. limits access to only the evidence custodian,
2. documents all access to evidence,
3. maintains a thorough chain of custody,
4. provides independent auditing

Front 65

The chain of custody ends with the_____.

Back 65

disposal of evidence

Front 66

_____is destroyed under court order.

Back 66

Contraband

Front 67

What tools should Investigators be familiar for destroying digital content?

Back 67

1. data dump (dd)
2. shred
3. Disk Scrub
4. WIPE.EXE utilities.

Front 68

What is beginning of computer forensic investigation.

Back 68

Acquisition

Front 69

What are three categories: Data acquisition tools generally fall into

Back 69

1. live acquisition,
2. static acquisition
3. mobile device acquisition

Front 70

What are the five data analysis and recovery functions all digital forensic tools serve.

Back 70

Acquisition
1. Validation and discrimination
2. Extraction
3. Reconstruction
4. Reporting

Front 71

Name a tool that can create images from both static and live sources.

Back 71

FTK Imager

Front 72

________tools can also be contrasted by their capability to copy either physical drives or logical partitions.

Back 72

Acquisition

Front 73

When are Logical acquisitions are useful ?

Back 73

1. the evidence drive is encrypted
2. when only a portion of a physical drive is required

Front 74

When are Logical acquisitions are more suitable?

Back 74

When it is not be practical or permissible to complete a physical acquisition of large or critical storage systems such as network storage, server storage, or RAID

Front 75

Simple bit-by-bit copies are known as a______, and are usually created with the ____command .

Back 75

raw data formats, Linux dd

Front 76

Raw formatted copies do not use _______and do not include______, so they can be viewed in _____and are compatible with most forensic tools.

Back 76

Compression, image metadata,
hexadecimal editors

Front 77

__________provide compression and store metadata with the image file, and the metadata includes______, ________, and other results from data discrimination

Back 77

Proprietary formats, file hashes, data carving results

Front 78

The Linux dd command does not perform verification concurrently when creating a raw image file True or False.

Back 78

True

Front 79

What are two Linux commands are digital forensic specific versions of the dd command, and perform verification concurrently during copying.

Back 79

dcfldd and dc3dd

Front 80

________ensures integrity while a forensic copy is being made, where _______ensures the integrity of complete image copies and individual files.

Back 80

Verification, validation

Front 81

_________ is the process of sorting and searching investigation data to locate items of interest.

Back 81

Discrimination

Front 82

In________, hashes are calculated not only for the entire image file, but also for individual files within the image, these hashes can be used during discrimination

Back 82

Validation

Front 83

The goal of ______is to quickly filter data that is of no investigative interest from the full body of data.

Back 83

Discrimination

Front 84

The ___________maintains a comprehensive list of file profiles in the _______.

Back 84

National Software Reference Library (NSRL), Reference Data Set (RDS)

Front 85

An _____can be filtered using a pre-compiled list of hashes for OS files, thereby efficiently tagging those files as known good files.

Back 85

image file

Front 86

The____ has signatures for both known good (applications, operating systems, and graphic files) and known bad software (i.e., steganography applications and hacking scripts), but does not include signatures for contraband (i.e., graphic files of child pornography).

Back 86

RDS

Front 87

_____compares hashes from the investigation data to the known hashes from sources such as the NSRL, and quickly filters known good and known bad files.

Back 87

Discrimination

Front 88

_______provides a server and query tool to look up_____ information, while the _____provides an online search capability to look up individual MD5 hash values.

Back 88

NSRLquery, NSRL RDS, NSRL Hash Search Engine

Front 89

______can also be performed on header values.

Back 89

Data discrimination

Front 90

_____ is the process of recovering data in a digital investigation.

Back 90

Extraction

Front 91

What are the sub functions of Extraction ?

Back 91

1. Data viewing
2. Keyword searching
3. Decompressing
4. Data carving
5. Decrypting
6. Bookmarking

Front 92

_____ allows an investigator to view data in multiple ways. Examples of the ways are hexadecimal or ASCII format, or by sector.

Back 92

Data viewing

Front 93

______could be deliberately hidden storage space, and could contain evidence. Likewise, _____that contains data flagged as deleted could also contain evidence.

Back 93

Un-partitioned space, unallocated space

Front 94

______includes RAM and file slack.

Back 94

Slack space

Front 95

RAM slack is the portion of RAM memory allocated to a file, but not ____.

Back 95

used by that file

Front 96

______ refers to the space on a physical disk allocated to a file, but not written to by that file.

Back 96

File slack

Front 97

A ___ may have both RAM slack and file slack.

Back 97

Sector

Front 98

____,and ____searches is an important sub functions of extraction.

Back 98

Text, hexadecimal string

Front 99

String searches can help to efficiently locate specific data of interest, but can also generate significant numbers of ____.

Back 99

false positives

Front 100

_____is another important sub function of extraction.

Back 100

Decompression

Front 101

______ the process of reconstructing files from file fragments in unallocated space.

Back 101

Data carving, or carving

Front 102

Carving often attempts to recover file fragments based on ____and _____.

Back 102

Header end-of-file markers

Front 103

______ is another sub function of extraction.

Back 103

File and file system decryption

Front 104

________ iteratively attempt words, and common variations of those words, to crack passwords.

Back 104

Dictionary attacks

Front 105

____attacks attempt every possible combination of potential passwords.

Back 105

Brute force

Front 106

_____are pre-computed hash values.

Back 106

Rainbow tables

Front 107

Techniques, such as_____, are used to counter rainbow table attacks.

Back 107

Salting

Front 108

True or False Most UNIX and Linux distributions do not salt passwords, but Windows operating systems do.

Back 108

FALSE it is the opposite linux does and windows does not.

Front 109

______features reduce investigator workload.

Back 109

Bookmarking

Front 110

How can recreating evidence be accomplished?

Back 110

1. Disk-to-disk copy
2. Image-to-disk copy
3. Partition-to-partition copy
4. Image-to-partition copy

Front 111

____ allow investigators to operate applications on the original evidence without altering that evidence.

Back 111

Shadow drives

Front 112

Because shadow drives expose the original evidence to risk when should they be used.

Back 112

only when necessary for court proceedings.

Front 113

The____ provides support through the Computer Forensics Tool Testing (CFTT) project, and forensic tool testing products (images and data), procedures, and results.

Back 113

National Institute of Standards and Technology (NIST)

Front 114

Analysis of digital evidence can be very resource intensive, what components should be sufficient to meet immediate and future requirements?

Back 114

1. RAM
2. storage
3. ports
4. networking capacities

Front 115

the major steps in the digital forensics process are

Back 115

1. Preparation
2. Survey/Identification
3. Preservation
4. Examination & Analysis
5. Presentation

Front 116

Preparation served two primary objectives: to ______the collection of evidence and to ____the cost of response and investigation

Back 116

Maximize, minimize

Front 117

An organization is prepared to perform digital investigations when they have _____and _____

Back 117

operational readiness, infrastructure readiness

Front 118

Is established by developing and implementing the policies and procedures to direct and support the digital investigators.

Back 118

Operational readiness

Front 119

____________ensures the systems and tools to process various types of digital evidence are in place

Back 119

infrastructure readiness

Front 120

_____begins when an incident is detected and verified, and culminates with the seizure of evidence

Back 120

Survey/Identification

Front 121

________incident is an event that compromises the confidentiality, integrity, or availability of an information system

Back 121

information system security

Front 122

_______incident detection is limited to detection of events where the computer is an instrument of a crime or possibly contains contraband

Back 122

computer security

Front 123

True or False__ Detection of other events that do not directly impact the CIA of an information system may also lead to identification of digital evidence

Back 123

True
example, a computer may serve as a repository of evidence of a crime, such as fraud

Front 124

digital investigations is limited to criminal and cybercrime incidents. Digital evidence may also be discovered and presented in property, contract, and tort litigation

Back 124

False
digital investigations are not limited criminal and cybercrime incidents

Front 125

Investigators begin the ___when digital evidence is seized

Back 125

chain of custody

Front 126

____is the acquisition of the current state of potentially volatile digital and physical items.

Back 126

Preservation

Front 127

_______is the process of collecting digital evidence for examination, and produces one or more forensically sound ___of the evidence item

Back 127

Data acquisition, bit-by-bit copies

Front 128

_______recovers, harvests, organizes, searches, and reduces data collected during preservation.

Back 128

Examination and analysis

Front 129

____extracts data from the data sources

Back 129

Recovery

Front 130

A ___is the smallest element, and consists of a single piece of data.

Back 130

bit

Front 131

A ___is an aggregate of eight bits, and is commonly referred to as a word.

Back 131

Byte

Front 132

The smallest elements managed by file systems is a____.

Back 132

sector

Front 133

What are the most common sector sizes for Windows_____

Back 133

512-byte sectors

Front 134

What does Linux refer to as Blocks___, and what is the block size that Linux uses___?

s

Back 134

FAUs, 1024 byte

Front 135

Physical devices are divided into ___?

Back 135

millions of sectors.

Front 136

The beginning of the physical device contains the _____?

Back 136

master boot record (MBR).

Front 137

The MBR identifies the _____on the drive and allocates specific sectors to each partition

Back 137

primary partitions

Front 138

Partitions manage storage by______, more commonly referred to as clusters.

Back 138

file allocation units FAUs

Front 139

Clusters are a collection of ___?

Back 139

adjacent sectors

Front 140

____is also widely used on removable media, such as USB flash and hard disk drives.

Back 140

FAT

Front 141

What are Three versions of FAT?

Back 141

FAT12, FAT16, and FAT32.

Front 142

Both the FAT and Master File Table MFT contain the records for each file stored in the partition, include____ and ____.

Back 142

a flag for active , deleted files.

Front 143

UNIX uses the_____, and Linux uses ___,___,___,or___ file systems. ____is the latest release of the Linux file systems

Back 143

UNIX File System Ext2, Ext3, Ext4 or Reiser Ext4

Front 144

The superblock serves as the “______” and contains data about the file system, to include___ and____.

Back 144

master node, inodes, dentries

Front 145

_____represent the directories and files that the user recognizes.

Back 145

Inodes

Front 146

_____about these objects is also maintained in the inode.

Back 146

Metadata

Front 147

____index the inodes to specific files.

Back 147

Dentries

Front 148

_____are first marked simply as unallocated space

Back 148

Deleted files

Front 149

Open source tools designed or useful for data carving include:

Back 149

1. hachoir-subfile
2. Foremost
3. Scalpel
4. Photorec
5. Autopsy

Front 150

True or False__ When working with live memory, attempting to perform forensic analysis on the original evidence is not even practical

Back 150

True

Front 151

Data that would be lost by the disruption of power is ____.

Back 151

Volatile data

Front 152

Data that is permanently preserved if power is disrupted is ___.

Back 152

Nonvolatile

Front 153

Examples of volatile data include the contents of____.

Back 153

RAM and cache

Front 154

True or False__Router or switch configurations may have temporary files stored in flash memory that are deleted during an orderly shutdown.

Back 154

True

Front 155

Regardless of where or how volatile data is stored, investigators have ___opportunity to acquire that data

Back 155

one

Front 156

Registers and cache are the___?

Back 156

most volatile data

Front 157

Digital Forensics The process of____,____,____,and____ in a manner that is legally acceptable

Back 157

identifying, preserving, [analyzing] and presenting digital evidence

Front 158

___acquisition process preserves a complete and accurate representation of the original data, and its authenticity and integrity can be validated

Back 158

Forensic Soundness

Front 159

______ Interpreting evidence free from bias whether inculpatory (directs blame) or exculpatory (reflects blame

Back 159

Objectivity

Front 160

______ experiments and observations must be repeatable so that they can be independently verified. Documentation is critical to ensure repeatability.

Back 160

Repeatability

Front 161

is the examination of a person’s body or property or any area considered private True or False

Back 161

TRUE

Front 162

______derived when the property to be searched belongs to person granting consent or when person granting consent has been authorized to do so

Back 162

Actual Authority

Front 163

_____ a person who has the genuine appearance of authority to give consent.

Back 163

Apparent Authority

Front 164

______ material relates to the case being investigated it probative meaning it proves something significant to the case

Back 164

Relevance

Front 165

_____ evidence is factual not an opinion(except for expert witness) computer evidence is generally a fact, but interpretation of evidence may be opinion…must demonstrate the source is valid and honest

Back 165

Authenticity

Front 166

evidence cannot be prejudicial, not subject to statutory constraints, not in violation of the Constitution

Back 166

Competence

Front 167

_____limits government on collecting personal information for approved purposes, notifying individuals about the information collected and the purpose of those records. Only protects US citizens and legal residents

Back 167

Privacy Act 1974

Front 168

_______restricts government use of wire taps. May not intercept wired or wireless communications without due process

Back 168

Electronic and Communication Privacy Act (ECPA) 1986

Front 169

_____mathematical representation of a specific data repository that verifies that data has not been altered verifies integrity

Back 169

Hashes

Front 170

____,_____, – levels of forensic examination are survey/triage( preliminary examination and in-depth examination.

Back 170

Examination & Analysis

Front 171

_______– when the hypothesis and results are presented to people other that investigators. ..details the entire investigation process, chain of evidence/custody, findings, alternative theories that were eliminated.

Back 171

Presentation

Front 172

_______—may contain illegal content or computer may be stolen

Back 172

Contraband

Front 173

______ – contain records of a crime

Back 173

Repository

Front 174

_______– Malware distribution

Back 174

Instrument

Front 175

____ –At the lowest level, a disk’s content is the physical alignment of magnetic particles.

Back 175

Disk

Front 176

____ could be done at this level, but requires expertise and tools beyond the means of most investigators.

Back 176

Analysis

Front 177

______–A single physical disk could contain multiple volumes, or a single volume may span multiple disks. A volume is a logical organization of disk sectors used to create a single file system.

Back 177

Volume

Front 178

_______– describe the layout of files and associated metadata for the file system’s operation.

Back 178

File System

Front 179

_____is the smallest available freestanding unit for data storage in a given file system.

Back 179

Data Unit–

Front 180

_____–Humans operate at this layer

Back 180

File Name

Front 181

_______ is data about data. It is used by the file system to manage content from the data unit layer, and typically contains time stamps, file ownership information, and permissions.

Back 181

Metadata

Front 182

______Control the crime scene by determining who is in charge, secure the scene, document the scene, identify data sources

Back 182

FIRST RESPONDERS

Front 183

____ attempts to explain what happened during a crime or incident in an attempt to explain who did what, when, where, and how.

Back 183

Reconstruction

Front 184

_____– recording what was done many tools have features that maintain the logs, metadata, evidences files needed to demonstrate reliability and repeatability

Back 184

Reporting

Front 185

ADVANTAGES TO IMAGE COPIES OVER LIVE MEMORY

Back 185

1. The ability to verify image authenticity through hash functions and hash values. Using multiple acquisition tools and hash functions improves the robustness of an investigator’s claim of authenticity.

2. The ability to recover from processing errors or mistakes with a fresh copy.

3. The ability to use fresh copies when completing analysis processes that may not be
compatible.

4. The ability to convert image copies from one format to another, and verify it’s integrity, to process evidence with multiple tools or utilities that use different input formats.

5. The ability to recover from loss, theft, or corruption of an image copy without compromising the investigation.

6. Courts generally insist investigators work from image copies