Digital Forensic Psychology Exam 2

Front 1

FAT File Creation

Back 1

1. Directory Entry is created

2. File Allocation Table Clusters are allocated

3. File is stored in the data area of the hard drive

Front 2

FAT File Deletion

Back 2

1. File Name in directory is changed so that the first character is HEX E5 (~)

2. File Allocation table is zeroed out and marked as available

3. Data area is untouched

Front 3

NTFS File Creation

Back 3

1. Master File Table entry created

2. Data is stored on the hard drive

Front 4

NTFS File Deletion

Back 4

1. Information in the MFT is no longer marked as used

2. The data is untouched

Front 5

$MFT

Back 5

Arelational database table containing information about all files. Similar to a Table of Contents

Every file and directory has an entry that is 1024 bytes

If the file is <600 bytes it is stored in the MFT

Volume Boot Sector (NTFS) not stored here

Front 6

$MFTMirr

Back 6

Duplicate of the first four records in $MFT

A partial backup for recoverability

Front 7

$LogFile

Back 7

Recoverability feature of NTFS

Done when rebooted after a crash

Logof all file system metadata changes.

Preventsincomplete actions from taking place. Checks for and undo's the actions.

Front 8

$Volume

Back 8

Volumename, NTFS version, creation date.

Filesize is shown as 0 bytes because the actual file containing the data is in theMFT. (4threcord)

Just information about the volume

Front 9

$Bitmap

Back 9

Keeps track of used and free clusters

Front 10

Free Cluster Marking

Back 10

00

Front 11

Used Cluster Marking

Back 11

FF

Front 12

What does SID do?

Back 12

maintains security on files for NTFS

gives the owner of files read, write, execute permissions

Front 13

What is SID?

Back 13

A security identifier tied to a specific user or group

Front 14

How is SID tied to a user?

Back 14

It is tied to the user name in a registry

Front 15

$MFT Entry

Back 15

File status located at offset 22 (distance from beginning of object) in the $MFT

Front 16

Deleted File Status

Back 16

00 00

Front 17

Allocated File Status

Back 17

01 00

Front 18

Deleted Directory

Back 18

02 00

Front 19

Allocated Directory

Back 19

03 00

Front 20

Three Attributes every $MFT record has

Back 20

1. Standard Information Attribute

2. File Name Attribute

3. Data Attribute

Front 21

SIA

Back 21

Standard Information Attribute which contains the date/time stamp for the file or folder

Begins at 10 00 00 00

Front 22

FNA

Back 22

File name attribute includes the file name, physical and logical size, in the parent folder

Dates and times are set only when file is originally created

Begins at 30 00 00 00

Front 23

DATA

Back 23

contains actual file data or points to where data resides

Begins at 80 00 00 00

Ends at FF FF FF FF

Front 24

Resident data

Back 24

Data is stored in $MFT file size is less that 600 bytes

Front 25

Non Resident Data

Back 25

Data is stored on hard drive

Front 26

Data Runs

Back 26

listing in the $MFT of clusters allocated to a file

Front 27

NTFS Date/Time Stamps

Back 27

Stored in the $MFT

Coordinated Universal Time (UTC)

Front 28

FAT Date/Time Stamps

Back 28

Stored within folder entries

Local computer settings

Front 29

What actions change the "Created" date in NTFS?

Back 29

If you move a file from a new volume to another, most of the time “created” will be updated to the new time, but not if you cut and paste

this new file will have a created time after it was modified and accessed….

emailing changes to new date

Front 30

What actions change the "Modified" date in NTFS?

Back 30

Updated only if you open it AND make changes

Front 31

What actions change the "Last Accessed" date in NTFS?

Back 31

NTFS delays updating accessed timestamp by an hour

does not need to be opened to updated (antivirus may change this)

Front 32

File System Metadata

Back 32

On anNTFS partition, the majority of this information resides in the NTFS InternalFiles (aka metadata files).

Filename•Filestatus•Filesize•Parentfolder•Allocatedclusters•Date/Timestamps

Front 33

Application Metadata

Back 33

found within file itself

different information recorded based on type of file

can be changed or deleted by user

Front 34

Data Compression

Back 34

Replacing redundant data with a placeholder

compressed files/folders shown in blue text

saves disk space, whenever file is moved or viewed it is decompressed first and then recompressed

Front 35

Windows Registry

Back 35

Ahierarchical database that stores configuration settings and options.

Contains Keys (folder), Hives (folder in a key) and Values (file)

Front 36

Six Primary Hives

Back 36

1.NTUSER.DAT– One for each user. Containsconfiguration information related to the user.

2.SAM– Security Account Manager. Accountpasswords and access information.

3.SECURITY– Security policies.

4.SOFTWARE– Information related to all software on the computer.

5.SYSTEM– Information related to the computer system. Settings, devices, drivers, etc.

6.HARDWARE– Information related to all hardware in the computer.

Front 37

How to determine when a user logged on

Back 37

SAM contains info on when last logon was

begins at offset 5

Front 38

How to determine when a user logged off

Back 38

NTUSER.DAT

DateCreated indicates when the user account was created.

DateModified indicates the last time the user logged off of the system.

Front 39

Where can you see if External Devices have been used?

Back 39

1.Registry. \SYSTEM\ControlSet***\Enum\USBSTOR

2. Logfile: setupapi.log or setupapi.dev.log

Front 40

Information Internet Explorer keeps:

Back 40

Stored in Index.dat

Authentication•Identificationof a user•Userpreferences•Shoppingcart

Front 41

Three main Windows event Logs:

Back 41

1. AppEvent.evt – Application events. Events related to software

2. SecEvent.evt – Security events. Related to security and access toresources. Logging on and off of thecomputer. Default setting is that it is NOT enabled.

3. SysEvent.evt – System events. Events related to the operating system.

Front 42

How can you view event logs?

Back 42

using Event viewer

can be salvaged from unallocated space using file header

Front 43

Link Files

Back 43

Shortcutsthat point to another file or folder.

Fileextension .LNK.

Storedin multiple locations.

Last Accessed time indicates when a filewas last run.

Front 44

Prefetch Files

Back 44

Files that speed up OS by preloading frequently accessed files (moved from hard drive to memory)

Can be used to determine when a program was run

C:\Windows\PreFetch

extension .pf

Front 45

Thumbnail Cache Files

Back 45

Databasefile that contains thumbnail images of pictures on a computer. Thumbs.db or Thumbcache_xxx.db.

Ifthe original picture is deleted, the thumbnail image still remains.

Front 46

Printer Files

Back 46

1. Shadow Files (.SDH) - Containsadministration information about the print job. File name, user account, printer name.

2. Spool Files (.SPL) - Contains actual data that was printed

Once successfully printed, both files are deleted unless configured to be kept

Front 47

Recycle Bin Windows XP

Back 47

TheSID subfolder contains the deleted file along with a file named INFO2

When file is deleted:

1. File renamed

2. INFO2 updated chronologically

3. 1.Thefile data remains in the same location on the drive.

Front 48

How to bypass recycle bin?

Back 48

Shift Delete

Front 49

File rename when deleted in XP

Back 49

Filerenamed in the following manner:

Beginswith “D” (deleted)

Followedby drive letter of where the file was. Followedby a sequential number.

Followed by the original fileextension

Front 50

Recycle Bin Windows 7-10

Back 50

\$Recycle.Bin Subfoldernamed with the User SID.

1.Filerenamed ($R…ext.)

2.Newfile created. ($I…ext.)

3.Filedata remains in the same location on the drive.

Front 51

Pagefile

Back 51

virtual memory like RAM, holds temporary info swapped in and out of physical memory

anything seen on monitor can be in page file

good place for IM conversations

Front 52

Restore Points

Back 52

Restorepoints created when a major event occurs (XP) or every 24 hours (Win 7 - 10).

C:\SystemVolume Information.

Restorepoints can contain data that is not on the current version of the operatingsystem.

Front 53

Cookies

Back 53

textiles from websites saved on computer

Can Beused by spyware to track your browsing activities or Bestolen and used to impersonate you

cannot contain viruses, malware, or be programmed

Front 54

History Files for IE, FireFox and Chrome

Back 54

IE - Content.IE5

FireFox - places.sqlite

Chrome - sqlite

Front 55

Tie a picture to a Facebook account

Back 55

2nd of 3 number blocks or 3 of 5 number blocks

Front 56

Bitlocker

Back 56

Encryption key is stored on Trusted Platform Module and must be booted from original computer

encrypts entire volumes

Front 57

Encrypting File System

Back 57

Encryptsa user’s folders and files.

Encryptionkey tied to user name and password. Encryptedfiles/folders displayed in green text.

Front 58

Raid Arrays

Back 58

RedundantArray of Inexpensive Disks.

Agroup of hard drives that function as one hard drive.

Front 59

3 main raid arrays:

Back 59

Raid 0: Two or more drives, data striped to all drives so efficient but can lose all data

Raid 1: Two or more drives, mirrored on both, slow but don't risk losing data

Raid 5: Threeor more drives. Data is striped acrossall drives with redundancy. Good speedand recoverability if one of the drives fails. A Raid 5 can rebuild itself.

Front 60

IP

Back 60

Internet Protocol - An IPaddress is a numerical labelassigned to every device on a network.

ipconfig -all in command line

Front 61

DHCP

Back 61

Dynamic Host Configuration Protocol

ADHCP server holds a pool of addresses and distributes them to computers as they get on the network.

Process: Broadcast, Offer, Request, Acknowledge

Front 62

Trace route of IP address

Back 62

tracert www.google.com

Front 63

Reading an email header:

Back 63

Textin the email message that keeps track of the route that the email took fromSender to Recipient.

Eachemail server that the email passes through adds information to the header.

Thisinformation includes to/from, email address, content type, time stamps, and IPaddress.

Emailheaders are read beginning at the bottom and reading up.

Front 64

Options for imaging a mac:

Back 64

remove the hard drive and image with FTK Imager or any other imaging tool

boot the suspect computer in Target Disk Mode

Boot the suspect computer to a Linux based forensic boot disk such as Raptor