Es Computer Forensic Exam 1

Front 1

Back 1

Front 2

What kind of authorization document(s) is required to conduct a criminal or civil investigation?

Back 2

search warrant or subpoena.

Front 3

What U.S. Constitution amendment protects against unreasonable search and seizure?

Back 3

The Fourth Amendment

Front 4

What two conditions be must be met for authorized search to satisfy the Fourth Amendment requires seizure?

Back 4

1.Probable cause
2.describing the place to be searched and the persons or things to be seized

Front 5

What must be done in order to obtain a search warrant and affidavit ?

Back 5

An application must be filed.

Front 6

A _________should be established before drafting the application and warrant .

Back 6

search strategy

Front 7

What are the following roles search strategies generally consider of the computer in a crime investigation?

Back 7

1.Contraband,
2.repository of evidence of a crime,
3.an instrument of a crime

Front 8

What are the six levels of abstraction from a storage device’s file system?

Back 8

1. DISK 2. VOLUME 3. FILE SYSTEM
4. DATA UNIT 5. META DATA 6. FILE NAME

Front 9

A data unit in Windows is called_____?

Back 9

clusters

Front 10

A data unit in UNIX/Linux is called_______?

Back 10

Blocks

Front 11

Clusters and blocks are multiples of ________?

Back 11

512 byte sectors.

Front 12

What are common artifacts of the file name layer ?

Back 12

Files, folders, and directories

Front 13

To be protected under the Fourth Amendment, an individual must have_____?

Back 13

the reasonable expectation of privacy, meaning they must demonstrate an expectation of privacy through their behavior society must be prepared to accept that expectation of privacy as reasonable

Front 14

Give 3 examples of when privacy has been found to be NOT established by the courts.

Back 14

1) Activities conducted in plain view
2) Garbage disposed of outside a person’s property
3) Passwords displayed openly

Front 15

When may No-Knock Warrants be requested?

Back 15

when there is reason to believe a suspect may destroy evidence, and can be requested for searches involving digital evidence. Or be threatening.

Front 16

What are Three exceptions allow warrantless searches?

Back 16

1. Plain View
2.Searching a individual when being arrested
3.When Voluntary consent is given

Front 17

What factors of voluntary consent does the Supreme Court recognizes?

Back 17

1. Age 2.intelligence 3. physical 4.mental condition

Front 18

What should be done concerning a voluntary search when possible?

Back 18

Consent should be written to explicitly state the scope of the search.

Front 19

Do Subpoenas give the authorization to search or seize property?

Back 19

subpoenas order a person to
appear in court
surrender evidence

Front 20

What are the three categories Privacy legislation can be grouped into?

Back 20

1.General Privacy
2.Financial Legislation
3.Healthcare And Education Legislation

Front 21

For evidence or testimony to be considered in a court of law, it must be _______.

Back 21

Admissible

Front 22

What three conditions must be met for evidence to be admissible established as Federal Rules of Evidence as legal requirements of?

Back 22

1.relevance
2.authenticity or credibility
3.competence.

Front 23

What two conditions must be evaluated so that the evidence is relevant?

Back 23

evidence must be material, relating directly to the case

evidence must be probative, meaning it proves something significant in determining the case

Front 24

What two conditions must be met for evidence to be authentic?

Back 24

1.factual
2.credible

Front 25

__________must demonstrate the source and integrity of evidence to demonstrate it is credible .

Back 25

Investigators

Front 26

What are the most critical steps digital investigators can take to ensure evidence is not ruled inadmissible due to statutory or constitutional violations?

Back 26

Understanding and complying with the authority to search and seize evidence

Front 27

In order for evidence to be competent it must _________?

Back 27

Not be prejudicial, have any statutory constraints , and not be in violation of the suspects Constitutional rights

Front 28

What rules are particularly important to digital investigations?

Back 28

Hearsay rules

Front 29

The 3 categories Digital evidence falls into are?

Back 29

1.hearsay
2.Non-hearsay
3.Mix of hearsay and non-hearsay

Front 30

Any statement made outside of the court by an individual who is not under oath at the time the statement is made is called?

Back 30

Hearsay

Front 31

How many exceptions are there to the Hearsay Rule________, and how many of them of those rules are applicable to digital investigations____?

Back 31

24 and 6

Front 32

What are the exceptions that are applicable to digital investigations?

Back 32

Business records
Certain public records and reports
Evidence of the absence of a business record or entry
Learned treatises used to question an expert witness
Statements of the absence of a public record or entry A catch all rule

Front 33

How is the reliability of digital evidence often established?

Back 33

hash values

Front 34

What is the two step process pertaining to Rule 901(b)(4) allowing digital evidence from storage media to be introduced.

Back 34

1. Introduce the storage media, with unique identifiers. Ex. Serial numbers.

2. Media introduced with hash values or other accepted forensic identifiers

Front 35

The courts have established that investigators need not have a detailed understanding about the hashing algorithms or the software used to implement those algorithms, but must have knowledge on the operation of the tools they use TRUE or FALSE?

Back 35

TRUE

Front 36

Hashing is a _________function that computes a ________that uniquely identifies any arbitrary length input

Back 36

lossy compression, fixed-length value

Front 37

Hash values are generally presented as a____?

Back 37

hexadecimal string

Front 38

A hexadecimal string is a______ not a_____, which is a more readable representation of a_____.

Back 38

value (number), text string binary value

Front 39

MD5 hashing algorithm produces a _____hash value.

Back 39

128-bit

Front 40

_____are required to represent a single hexadecimal digit.

Back 40

Four binary bits

Front 41

A 128-bit MD5 hash value is represented with a ____hexadecimal value.

Back 41

32-digit

Front 42

Hash functions are____, meaning the original content _____be recovered from the hash value.

Back 42

Lossy cannot

Front 43

Any change of the_______, even a_______, must result in a change to _____the bits in the hash value (digest). This quality is known as the_______.

Back 43

input message, single, bit at least half, avalanche effect

Front 44

It must be computationally infeasible to find ______input messages which produce the same digest.

Back 44

two different

Front 45

A ________is when two different messages produce the same digest.

Back 45

collision

Front 46

It must be ____________to determine the input from a given hash value. This quality is referred to as________.

Back 46

computationally infeasible, preimage resistance

Front 47

It must be computationally infeasible to determine _____message from a given digest. This is
referred to as

Back 47

any input, secondary preimage resistance.

Front 48

Commonly used hash functions for forensics include?

Back 48

MD5 and SHA-1

Front 49

Fuzzy hashing techniques can be used to search_____, but not _____.

Back 49

Similar, identical files

Front 50

MD5 produces a _____hash value, while SHA-1 produces a ____hash value.

Back 50

128-bit, 160-bit

Front 51

Stronger hash functions are available, including RIPEMD and SHA-2. Both of these hash functions produce hash values from _______in length.

Back 51

160 to 512 bits

Front 52

Digital forensics uses hashing for multiple purposes, to include _____and _____large bodies of data to find evidence of interest, ______integrity, and ensuring ____.

Back 52

Sorting, filtering, verifying, confidentiality

Front 53

Name a Tool that uses fuzzy hashing to compare multiple, smaller portions of content within files to match similar files.

Back 53

ssdeep

Front 54

What are the three principles for digital evidence that the DOJ holds as standards?

Back 54

The process of collecting, securing, and transporting digital evidence should not change the evidence.

Digital evidence should be examined only by those trained specifically for that purpose.

Everything done during the seizure, transportation, and storage of digital evidence should be fully documented, preserved, and available for review

Front 55

What does Locard’s Exchange Principle state?

Back 55

Everything that enters a crime scene leaves part of itself at the crime scene and takes part of the crime scene with it

Front 56

Locard’s Exchange Principle is not limited to interactions between_____ and the, but rather ____and the______.

Back 56

Suspects, crime scene, all subjects crime scene

Front 57

The cardinal rule for first responders is ____.

Back 57

safety first

Front 58

What is a first responders second priority?

Back 58

safety and integrity of the evidence

Front 59

When Documenting the scene – Documentation should include?

Back 59

a) photographic
b) video
c) descriptive documentation including
documentation of all personnel present at the scene

Front 60

what should evidence details include?

Back 60

Make, model, and serial number of every device present
Note whether devices are on, off, or in sleep mode
Determine if devices are connected to a network, whether wireless or wired
Record status of lights and indicators
Listen to devices for indications of processing or disk activity
Identify and document installed peripherals
Look for documentation to other devices that are not present. This may indicate those devices exist elsewhere.
Photograph front and back of all devices.

Front 61

What two questions must be asked when identifying data sources?

Back 61

What are the obvious data sources?
Ask what data sources may exist that are not obvious?

Front 62

What are examples of other data sources that may not be obvious?

Back 62

remote storage, which might be indicated by software or links to cloud- or network-based storage

Front 63

What are potential consequences from compromises in the chain of custody?

Back 63

1. Misidentification of evidence
2. Contamination or loss of evidence
3. Tampering with evidence

Front 64

Evidence should be stored in a designated storage facility that?

Back 64

1. limits access to only the evidence custodian,
2. documents all access to evidence,
3. maintains a thorough chain of custody,
4. provides independent auditing

Front 65

The chain of custody ends with the_____.

Back 65

disposal of evidence

Front 66

_____is destroyed under court order.

Back 66

Contraband

Front 67

What tools should Investigators be familiar for destroying digital content?

Back 67

1. data dump (dd)
2. shred
3. Disk Scrub
4. WIPE.EXE utilities.

Front 68

What is beginning of computer forensic investigation.

Back 68

Acquisition

Front 69

What are three categories: Data acquisition tools generally fall into

Back 69

1. live acquisition,
2. static acquisition
3. mobile device acquisition

Front 70

What are the five data analysis and recovery functions all digital forensic tools serve.

Back 70

Acquisition
1. Validation and discrimination
2. Extraction
3. Reconstruction
4. Reporting

Front 71

Name a tool that can create images from both static and live sources.

Back 71

FTK Imager

Front 72

________tools can also be contrasted by their capability to copy either physical drives or logical partitions.

Back 72

Acquisition

Front 73

When are Logical acquisitions are useful ?

Back 73

1. the evidence drive is encrypted
2. when only a portion of a physical drive is required

Front 74

When are Logical acquisitions are more suitable?

Back 74

When it is not be practical or permissible to complete a physical acquisition of large or critical storage systems such as network storage, server storage, or RAID

Front 75

Simple bit-by-bit copies are known as a______, and are usually created with the ____command .

Back 75

raw data formats, Linux dd

Front 76

Raw formatted copies do not use _______and do not include______, so they can be viewed in _____and are compatible with most forensic tools.

Back 76

Compression, image metadata,
hexadecimal editors

Front 77

__________provide compression and store metadata with the image file, and the metadata includes______, ________, and other results from data discrimination

Back 77

Proprietary formats, file hashes, data carving results

Front 78

The Linux dd command does not perform verification concurrently when creating a raw image file True or False.

Back 78

True

Front 79

What are two Linux commands are digital forensic specific versions of the dd command, and perform verification concurrently during copying.

Back 79

dcfldd and dc3dd

Front 80

________ensures integrity while a forensic copy is being made, where _______ensures the integrity of complete image copies and individual files.

Back 80

Verification, validation

Front 81

_________ is the process of sorting and searching investigation data to locate items of interest.

Back 81

Discrimination

Front 82

In________, hashes are calculated not only for the entire image file, but also for individual files within the image, these hashes can be used during discrimination

Back 82

Validation

Front 83

The goal of ______is to quickly filter data that is of no investigative interest from the full body of data.

Back 83

Discrimination

Front 84

The ___________maintains a comprehensive list of file profiles in the _______.

Back 84

National Software Reference Library (NSRL), Reference Data Set (RDS)

Front 85

An _____can be filtered using a pre-compiled list of hashes for OS files, thereby efficiently tagging those files as known good files.

Back 85

image file

Front 86

The____ has signatures for both known good (applications, operating systems, and graphic files) and known bad software (i.e., steganography applications and hacking scripts), but does not include signatures for contraband (i.e., graphic files of child pornography).

Back 86

RDS

Front 87

_____compares hashes from the investigation data to the known hashes from sources such as the NSRL, and quickly filters known good and known bad files.

Back 87

Discrimination

Front 88

_______provides a server and query tool to look up_____ information, while the _____provides an online search capability to look up individual MD5 hash values.

Back 88

NSRLquery, NSRL RDS, NSRL Hash Search Engine

Front 89

______can also be performed on header values.

Back 89

Data discrimination

Front 90

_____ is the process of recovering data in a digital investigation.

Back 90

Extraction

Front 91

What are the sub functions of Extraction ?

Back 91

1. Data viewing
2. Keyword searching
3. Decompressing
4. Data carving
5. Decrypting
6. Bookmarking

Front 92

_____ allows an investigator to view data in multiple ways. Examples of the ways are hexadecimal or ASCII format, or by sector.

Back 92

Data viewing

Front 93

______could be deliberately hidden storage space, and could contain evidence. Likewise, _____that contains data flagged as deleted could also contain evidence.

Back 93

Un-partitioned space, unallocated space

Front 94

______includes RAM and file slack.

Back 94

Slack space

Front 95

RAM slack is the portion of RAM memory allocated to a file, but not ____.

Back 95

used by that file

Front 96

______ refers to the space on a physical disk allocated to a file, but not written to by that file.

Back 96

File slack

Front 97

A ___ may have both RAM slack and file slack.

Back 97

Sector

Front 98

____,and ____searches is an important sub functions of extraction.

Back 98

Text, hexadecimal string

Front 99

String searches can help to efficiently locate specific data of interest, but can also generate significant numbers of ____.

Back 99

false positives

Front 100

_____is another important sub function of extraction.

Back 100

Decompression

Front 101

______ the process of reconstructing files from file fragments in unallocated space.

Back 101

Data carving, or carving

Front 102

Carving often attempts to recover file fragments based on ____and _____.

Back 102

Header end-of-file markers

Front 103

______ is another sub function of extraction.

Back 103

File and file system decryption

Front 104

________ iteratively attempt words, and common variations of those words, to crack passwords.

Back 104

Dictionary attacks

Front 105

____attacks attempt every possible combination of potential passwords.

Back 105

Brute force

Front 106

_____are pre-computed hash values.

Back 106

Rainbow tables

Front 107

Techniques, such as_____, are used to counter rainbow table attacks.

Back 107

Salting

Front 108

True or False Most UNIX and Linux distributions do not salt passwords, but Windows operating systems do.

Back 108

FALSE it is the opposite linux does and windows does not.

Front 109

______features reduce investigator workload.

Back 109

Bookmarking

Front 110

How can recreating evidence be accomplished?

Back 110

1. Disk-to-disk copy
2. Image-to-disk copy
3. Partition-to-partition copy
4. Image-to-partition copy

Front 111

____ allow investigators to operate applications on the original evidence without altering that evidence.

Back 111

Shadow drives

Front 112

Because shadow drives expose the original evidence to risk when should they be used.

Back 112

only when necessary for court proceedings.

Front 113

The____ provides support through the Computer Forensics Tool Testing (CFTT) project, and forensic tool testing products (images and data), procedures, and results.

Back 113

National Institute of Standards and Technology (NIST)

Front 114

Analysis of digital evidence can be very resource intensive, what components should be sufficient to meet immediate and future requirements?

Back 114

1. RAM
2. storage
3. ports
4. networking capacities

Front 115

The major steps in the digital forensics process are

Back 115

 Preparation
 Survey/Identification
 Preservation
 Examination & Analysis
 Presentation

Front 116

Preparation served two primary objectives:

Back 116

to maximize the collection of evidence and to
minimize the cost of response and investigation.

Front 117

Operational readiness is established by-

Back 117

developing and implementing the policies and procedures to direct and support the digital investigators

Front 118

infrastructure readiness ensures

Back 118

the systems and tools to process various types of digital evidence are in place.

Front 119

Survey/Identification begins when

Back 119

an incident is detected and verified, and culminates with the seizure of evidence

Front 120

An information system security incident is an event...

Back 120

that compromises the confidentiality, integrity, or availability of an information system

Front 121

TRUE OR FALSE: Digital investigations are limited to criminal and cybercrime incidents.

Back 121

FALSE- are not limited to criminal and cybercrime incidents.

Front 122

Preservation is the...

Back 122

acquisition of the current state of potentially volatile digital and physical items.

Front 123

Examination and analysis does what?

Back 123

recovers, harvests, organizes, searches, and reduces data collected during preservation.
Collectively, these steps reduce the potentially large volume of data acquired during preservation into the evidence that will be reported during presentation.

Front 124

The smallest elements managed by file systems is a _________.

Back 124

Sector

Front 125

Physical devices are divided into millions of sectors. The beginning of the physical device contains the ___________.

Back 125

master boot record (MBR).
The MBR identifies the primary partitions on the drive and allocates specific sectors to each partition

Front 126

Partitions manage storage by ___________.

Back 126

file allocation units (FAU), more commonly referred to as clusters.

Front 127

Clusters are a collection of ____________.

Back 127

adjacent sectors.

Front 128

__________ was deployed in early Windows operating systems, while __________ has been the standard file system since Windows 2000.

Back 128

(1) File Allocation Table (FAT)

(2) New Technology File System (NTFS)

Front 129

Three versions of FAT are?

Back 129

FAT12, FAT16, and FAT32. The versions differ by the file table entry size (12-, 16-, and 32-bit entries).

Front 130

__________ is also widely used on removable media, such as USB flash and hard disk drives.

Back 130

FAT

Front 131

Multiple versions of NTFS also exist, but NTFS 3.1 was used in ______________.

Back 131

Windows XP and later versions.

Front 132

UNIX uses the _______, while Linux uses _____,_____,_____,______. and ____________is
the latest release of the Linux file systems.

Back 132

1) UNIX File System
2) Ext2, Ext3, Ext4 or Reiser file systems
3) Ext4

Front 133

Ext file systems are composed of the __________________.

Back 133

superblock, inode, dentry, and file.

Front 134

FUN FACT:
The superblock serves as the “master node” and contains data about the file system, to include inodes and dentries. Inodes represent the directories and files that the user recognizes. Metadata about these objects is also maintained in the inode. Dentries index the inodes to specific files. Users view file system content as files.

Back 134

-

Front 135

Deleted files are first marked simply as ________.

Back 135

unallocated space.

Front 136

Open source tools designed or useful for data carving include:

Back 136

 hachoir-subfile
 Foremost
 Scalpel
 Photorec
 Autopsy

Front 137

_________involves gather data and metadata about recovered objects and attempts to
build a timeline.

Back 137

Harvesting

Front 138

________________ examine the Modified, Accessed, Creation (MAC) times from a file’s metadata and display them as events. It help investigators relate individual actions as a sequence of events.

Back 138

Timelines

Front 139

Tools available to automate the creation of timelines:

Back 139

including Log2Timeline, Computer Forensic TimeLab (CFTL), and Tapestry for Timelines

Front 140

Acquisition of live memory must be done
while the computer is running, but can yield
valuable information. This includes:

Back 140

a) Passwords in plaintext
b) Encryption keys in plaintext
c) Unencrypted data
d) Running processes
e) Current user information
f) Open ports and running services
g) Data on attached drives and devices

Front 141

Data volatility spans a continuum. _________are the most volatile data. Next is ________. Next is _______.

Back 141

Data volatility spans a continuum. Registers and cache are the most volatile data. Next is memory, routing tables, process tables, address resolution (ARP) tables, and kernel statistics. Next is temporary files. The first three categories are considered volatile data sources, the last four are considered nonvolatile sources. However, even nonvolatile data sources are subject to some degree of volatility. Of the nonvolatile data sources, hard drives and removable media are the least stable. If available, remote logging and monitoring data for a system is next, followed by physical configuration, and finally archival data.

Front 142

Digital Forensics is:

Back 142

The process of identifying, preserving, [analyzing] and presenting digital evidence in a manner that is legally acceptable

Front 143

Forensic Soundness

Back 143

acquisition process preserves a complete and accurate representation of the original data, and its authenticity and integrity can be validated

Front 144

Objectivity

Back 144

Interpreting evidence free from bias whether inculpatory (directs blame) or exculpatory (reflects blame

Front 145

Repeatability

Back 145

experiments and observations must be repeatable so that they can be independently verified. Documentation is critical to ensure repeatability.

Front 146

Search Warrant

Back 146

order by a judge authorizing government officials to search and seize specific evidence for a specific crime at a specified location exceptions plain view, during arrest, voluntary consent

Front 147

Subpoena

Back 147

order to appear before a court or to produce evidence to the court.

Front 148

Actual Authority

Back 148

derived when the property to be searched belongs to person granting consent or when person granting consent has been authorized to do so.

Front 149

Apparent Authority

Back 149

a person who has the genuine appearance of authority to give consent.

Front 150

Relevance material

Back 150

relates to the case being investigated it probative meaning it proves something significant to the case

Front 151

Authenticity evidence

Back 151

is factual not an opinion(except for expert witness) computer evidence is generally a fact, but interpretation of evidence may be opinion…must demonstrate the source is valid and honest

Front 152

Competence evidence

Back 152

cannot be prejudicial, not subject to statutory constraints, not in violation of the Constitution

Front 153

Privacy Act 1974

Back 153

limits government on collecting personal information for approved purposes, notifying individuals about the information collected and the purpose of those records. Only protects US citizens and legal residents

Front 154

Electronic and Communication Privacy Act (ECPA) 1986

Back 154

restricts government use of wire taps. May not intercept wired or wireless communications without due process

Front 155

Chain of Custody

Back 155

documentation of the route evidence takes from the time seized until it is disposed of

Front 156

Hashes

Back 156

mathematical representation of a specific data repository that verifies that data has not been altered verifies integrity…MD5 and SHA-1 are accepted hashing standards…

Front 157

Preparation – What is it and its two steps?

Back 157

most critical step….serves two objectives 1. Maximizes collection of evidence 2. Minimizes cost of response and investigation

Front 158

Two types of readiness

Back 158

Operational – policies and procedures that operationalize laws, rules, of evidence, and training. Infrastructure – preparing systems to process various types of evidence(RAID, mobile, ect)

Front 159

ADVANTAGES TO IMAGE COPIES OVER LIVE MEMORY

Back 159

1. The ability to verify image authenticity through hash functions and hash values. Using multiple acquisition tools and hash functions improves the robustness of an investigator’s claim of authenticity.
2. The ability to recover from processing errors or mistakes with a fresh copy.
3. The ability to use fresh copies when completing analysis processes that may not be
compatible.
4. The ability to convert image copies from one format to another, and verify it’s integrity, to process evidence with multiple tools or utilities that use different input formats.
5. The ability to recover from loss, theft, or corruption of an image copy without compromising the investigation.
6. Courts generally insist investigators work from image copies

Front 160

Reporting –

Back 160

recording what was done many tools have features that maintain the logs, metadata, evidences files needed to demonstrate reliability and repeatability

Front 161

Reconstruction –

Back 161

attempts to explain what happened during a crime or incident in an attempt to explain who did what, when, where, and how….recreating evidence image to disk copy, image to partition copy or disk to disk copy, partition to partition copy

Front 162

Discrimination –

Back 162

is the process of sorting and searching investigation data to locate items of interest…can also be performed on file types

Front 163

Verification -

Back 163

ensures integrity by comparing image file to the original drive

Front 164

Validation –

Back 164

similar to verification validates the integrity of complete image copies and individual files

Front 165

What kind of authorization document(s) is required to conduct a criminal or civil investigation?

Back 165

search warrant or subpoena.