Deck 9: Computer Forensics Analysis and Validation

Question 1

____ is defined as the art and science of hiding messages in such a way that only the intended recipient knows the message is there.

A) Bit shifting
B) Encryption
C) Marking bad clusters
D) Steganography

Answer 1

D

Question 2

Marking bad clusters data-hiding technique is more common with ____ file systems.

A) NTFS
B) FAT
C) HFS
D) Ext2fs

Answer 2

B

Question 3

In civil and criminal cases, the scope is often defined by search warrants or ____, which specify what data you can recover.

A) risk assessment reports
B) investigation plans
C) scope creeps
D) subpoenas

Answer 3

D

Question 4

FTK cannot analyze data from image files from other vendors.

Question 5

FTK cannot perform forensics analysis on FAT12 file systems.

Question 6

The defense request for full discovery of digital evidence applies only to criminal cases in the United States.

Question 7

AccessData ____ compares known file hash values to files on your evidence drive or image files to see whether they contain suspicious data.

A) KFF
B) PKFT
C) NTI
D) NSRL

Question 8

____ search can locate items such as text hidden in unallocated space that might not turn up in an indexed search.

A) Online
B) Inline
C) Active
D) Live

Question 9

The ____ search feature allows you to look for words with extensions such as "ing,""ed," and so forth.

A) fuzzy
B) stemming
C) permutation
D) similar-sounding

Question 10

____ increases the time and resources needed to extract,analyze,and present evidence.

A) Investigation plan
B) Scope creep
C) Litigation path
D) Court order for discovery

Question 11

In FTK ____ search mode, you can also look for files that were accessed or changed during a certain time period.

A) live
B) indexed
C) active
D) inline

Question 12

There are ____ searching options for keywords which FTK offers.

A) 2
B) 3
C) 4
D) 5

Question 13

You begin any computer forensics case by creating a(n) ____.

A) investigation plan
B) risk assessment report
C) evidence custody form
D) investigation report

Question 14

Data ____ involves changing or manipulating a file to conceal information.

A) recovery
B) creep
C) integrity
D) hiding

Question 15

FTK and other computer forensics programs use ____ to tag and document digital evidence.

A) tracers
B) hyperlinks
C) bookmarks
D) indents

Question 16

For target drives, use only recently wiped media that have been reformatted and inspected for computer viruses.

Question 17

A nonsteganographic graphics file has a different size than an identical steganographic graphics file.

Question 18

Getting a hash value with a ____ is much faster and easier than with a(n) ____.

A) high-level language, assembler
B) HTML editor, hexadecimal editor
C) computer forensics tool, hexadecimal editor
D) hexadecimal editor, computer forensics tool

Question 19

One way to hide partitions is to create a partition on a disk, and then use a disk editor such as ____ to manually delete any reference to it.

A) Norton DiskEdit
B) PartitionMagic
C) System Commander
D) LILO

Question 20

The term ____ comes from the Greek word for"hidden writing."

A) creep
B) steganography
C) escrow
D) hashing

Question 21

Match each item with a statement below
a.Court orders for discovery
f.PRTK
b.Investigation plan
g.Validating digital evidence
c.Digital Intelligence PDWipe
h.MD5
d.Live search
i.System Commander
e.Cabinet
a password recovery program available from AccessData

Question 22

To generate reports with the FTK ReportWizard, first you need to ____________________ files during an examination.

Question 23

Match each item with a statement below
a.Court orders for discovery
f.PRTK
b.Investigation plan
g.Validating digital evidence
c.Digital Intelligence PDWipe
h.MD5
d.Live search
i.System Commander
e.Cabinet
an FTK searching option

Question 24

____________________ search catalogs all words on the evidence disk so that FTK can find them quickly.

Question 25

FTK provides two options for searching for keywords: indexed search and ____________________ search.

Question 26

Match each item with a statement below
a.Court orders for discovery
f.PRTK
b.Investigation plan
g.Validating digital evidence
c.Digital Intelligence PDWipe
h.MD5
d.Live search
i.System Commander
e.Cabinet
a disk-partitioning utility

Question 27

Match each item with a statement below
a.Court orders for discovery
f.PRTK
b.Investigation plan
g.Validating digital evidence
c.Digital Intelligence PDWipe
h.MD5
d.Live search
i.System Commander
e.Cabinet
defines the investigation's goal and scope, the materials needed, and the tasks to perform

Question 28

Match each item with a statement below
a.Court orders for discovery
f.PRTK
b.Investigation plan
g.Validating digital evidence
c.Digital Intelligence PDWipe
h.MD5
d.Live search
i.System Commander
e.Cabinet
a type of compressed file

Question 29

Match each item with a statement below
a.Court orders for discovery
f.PRTK
b.Investigation plan
g.Validating digital evidence
c.Digital Intelligence PDWipe
h.MD5
d.Live search
i.System Commander
e.Cabinet
limit a civil investigation

Question 30

____ are handy when you need to image the drive of a computer far away from your location or when you don't want a suspect to be aware of an ongoing investigation.

A) Scope creeps
B) Remote acquisitions
C) Password recovery tools
D) Key escrow utilities

Question 31

____ is a remote access program for communication between two computers. The connection is established by using the DiskExplorer program (FAT or NTFS) corresponding to the suspect (remote) computer's file system.

A) HDHOST
B) DiskHost
C) DiskEdit
D) HostEditor

Question 32

Many commercial encryption programs use a technology called ____, which is designed to recover encrypted data if users forget their passphrases or if the user key is corrupted after a system data failure.

A) steganography
B) key escrow
C) password backup
D) key splitting

Question 33

Match each item with a statement below
a.Court orders for discovery
f.PRTK
b.Investigation plan
g.Validating digital evidence
c.Digital Intelligence PDWipe
h.MD5
d.Live search
i.System Commander
e.Cabinet
a hashing algorithm

Question 34

Match each item with a statement below
a.Court orders for discovery
f.PRTK
b.Investigation plan
g.Validating digital evidence
c.Digital Intelligence PDWipe
h.MD5
d.Live search
i.System Commander
e.Cabinet
one of the most critical aspects of computer forensics

Question 35

People who want to hide data can also use advanced encryption programs, such as PGP or ____.

A) NTI
B) BestCrypt
C) FTK
D) PRTK

Question 36

The data-hiding technique ____________________ changes data from readable code to data that looks like binary executable code.

Question 37

____ attacks use every possible letter, number, and character found on a keyboard when cracking a password.

A) Brute-force
B) Dictionary
C) Profile
D) Statistics

Question 38

____ recovery is a fairly easy task in computer forensic analysis.

A) Data
B) Partition
C) Password
D) Image

Question 39

Match each item with a statement below
a.Court orders for discovery
f.PRTK
b.Investigation plan
g.Validating digital evidence
c.Digital Intelligence PDWipe
h.MD5
d.Live search
i.System Commander
e.Cabinet
program used to clean all data from the target drive you plan to use

Question 40

For most law-enforcement-related computing investigations, the investigator is limited to working with data defined in the search ____________________.

Question 41

How should you approach a case in which an employee is suspected of industrial espionage?

Question 42

Briefly describe how to use steganography for creating digital watermarks.

Question 43

What are the file systems supported by FTK for forensic analysis?

Question 44

Briefly describe the differences between brute-force attacks and dictionary attacks to crack passwords.

Question 45

Describe the effects of scope creep on an investigation in the corporate environment.

Question 46

How does the Known File Filter program work?

Question 47

Describe with examples why the approach you take for a forensics case depends largely on the specific type of case you're investigating.

Question 48

How can you validate the integrity of raw format image files with ProDiscover?

Question 49

How can you hide data by marking bad clusters?

Question 50

What are the basic guidelines to identify steganography files?