Security Plus Chapter 17

Front 1

What is the Chain of Custody?

Back 1

Documentation that shows where evidence has been.

Front 2

Collecting digital steps are?

Back 2

1. Seize the Evidence
2. Acquire Evidence
3. Verify the Evidence
4. Analyze the Evidence
5. File filtering
6. RAID array
7. Network traffic logs
8. Witness
9. Big data analysis
10. Report on Findings
    

Front 3

Creating a bit-level copy of drive ensures?

Back 3

That the entire disk is captured.

Front 4

The investigation is performed on the ___________ and not the _____________?

Back 4

The Image, Original.

Front 5

Performing a live acquisition allows for?

Back 5

1. Capturing the contents of memory
2. Capture the contents of an encrypted drive.
   

Front 6

It is a best practice to when acquiring evidence is to?

Back 6

Create multiple copies of the forensic image using different imaging tools..

Front 7

Where can evidence be found on a computer?

Back 7

1. Memory
2. Swap file
3. Hard drive
4. DVD
5. Mobile device
   

Front 8

Where should you collect evidence from first?

Back 8

From volatile memory areas then nonvolatile areas.

1. RAM
2. Swap file
3. Hard disk
4. CD/DVD-rom
   

Front 9

The first step of the first responder is?

Back 9

Assess the situation and contain the incident and determine what systems are affected.

Front 10

What are the steps when responding to a Common Incident.

Back 10

1. Prepare for security incident
2. Incident Identification
3. Escalation and notification
4. Mitigate
   

Front 11

What are the steps when reviewing a Common Incident.

Back 11

1. Look at lessons learned
2. Create a report
3. Recovery/restoration procedures
4. Incident isolation
5. Quarantine
6. Data breach
7. Damage and loss control
   

Front 12

What is a Hex editor?

Back 12

Allows you to view the low-level content of a file or disk.

Front 13

On mobile devices where you search for evidence?

Back 13

1. ROM
2. EEPROM
3. SIM card
4. Memory
   

Front 14

The three things to consider when performing mobile forensics?

Back 14

1. Maintaining power
2. Prevent synchronization
   
3. Prevent remote wipe
   

Front 15

What is a Faraday bag used for?

Back 15

To block any signal to a mobile device.

Front 16

What is CIRT stand for?

Back 16

Computer Incident Response Team

Front 17

Who are the members of the CIRT

Back 17

1. Team Leader: organizes the team
   
2. Technical Specialist: assess damage and fix
   
3. Documentation Specialist: controls documentation
   
4. Legal advisor: Knows the law and regulations
   

Front 18

Name two password cracking tools?

Back 18

1. Cain and Abel
2. Snadboy's Revelation
   

Front 19

Name a Live Analysis tools?

Back 19

Helix has tools that can monitor processes locate graphic files, view PST files, mail passwords and internet files.

Front 20

What is ProDiscover?

Back 20

A computer forensic analysis tool that includes methods of securely wiping a disk acquiring a bit-level copy of the disk and analyzing the evidence form the image file or disk directly.

Front 21

A KFF is a what?

Back 21

a Known File Filter that will block out operating system and other files using their hash values.