Question 1

One of the difficulties in examining UNIX systems is that the file system is extremely complex, making it difficult for the examiner to recover data.

Accepted Answer

A) True 
 B)False  False

Question 2

Most data-carving tools operate on the assumption that the operating system generally tries to save data in contiguous sectors.

Accepted Answer

A) True 
 B)False  True

Question 3

As UNIX was never designed to work on networks, there are very few native utilities designed to access the Internet.

Accepted Answer

A) True 
 B)False  False

Question 4

What is the most efficient method for a forensic examiner to confirm whether a particular tool or methodology works in a forensically acceptable manner?

Accepted Answer

A)  Search the Internet for accounts of other examiners using the tool or methodology 
B)  Contact the author of the tool or methodology and have them provide confirmation 
C)  Test the tool under controlled conditions 
D)  Contact other forensic examiners to determine if they have any experience with the tool or methodology 
A)  Search the Internet for accounts of other examiners using the tool or methodology 
B)  Contact the author of the tool or methodology and have them provide confirmation 
C)  Test the tool under controlled conditions 
D)  Contact other forensic examiners to determine if they have any experience with the tool or methodology

Question 5

In UNIX, when a file is moved within a volume, the inode change date-time (ctime) is:

Accepted Answer

A)  Unchanged 
B)  Updated 
C)  Set to epoch time 
D)  Set to last modified date-time 
A)  Unchanged 
B)  Updated 
C)  Set to epoch time 
D)  Set to last modified date-time

Question 6

In a block group, file data is located in___________ .

Accepted Answer

A)  The block bitmap 
B)  Data blocks 
C)  Inode bitmap 
D)  Directory entry 
A)  The block bitmap 
B)  Data blocks 
C)  Inode bitmap 
D)  Directory entry

Question 7

Given a sufficiently powerful computer, even "strong" encryption can be broken in a short time.

Accepted Answer

A) True 
 B)False

Question 8

When requesting a search warrant, remotely connected systems cannot be considered part of the target system, so it may be necessary to obtain proper authorization before examining them.

Accepted Answer

A) True 
 B)False

Question 9

One of the most common web browsers on UNIX systems is:

Accepted Answer

A)  Internet Explorer 
B)  Safari 
C)  Opera 
D)  FireFox 
A)  Internet Explorer 
B)  Safari 
C)  Opera 
D)  FireFox

Question 10

One of the most useful areas to search for notable data on a Linux system is in file slack.

Accepted Answer

A) True 
 B)False

Question 11

The inode table can be found in the ___________.

Accepted Answer

A)  Block group 
B)  Superblock table 
C)  MBR 
D)  Partition table 
A)  Block group 
B)  Superblock table 
C)  MBR 
D)  Partition table

Question 12

On UNIX systems that receive e-mail, incoming messages are held in , in separate files for each user account until a user accesses them.

Accepted Answer

A) /home//desktop/mail B) /var/spool/mqueue/mail C) /etc/mailbox/mail D) None of the above A) /home//desktop/mail B) /var/spool/mqueue/mail C) /etc/mailbox/mail D) None of the above

Question 13

The UNIX convention of "piping" the results of one command into another is a serious limitation and is detrimental to using the UNIX platform for forensic examinations.

Accepted Answer

A) True 
 B)False

Question 14

___________, which is part of the standard Linux distribution, can be used to make a bitstream copy of evidentiary media to either image files or sterile media.

Accepted Answer

A)  grep 
B)  icat 
C)  dd 
D)  sha1sum 
A)  grep 
B)  icat 
C)  dd 
D)  sha1sum

Question 15

The Coroner's Toolkit and The Sleuth Kit are examples of open source___________ .

Accepted Answer

A)  Hard drive repair tools 
B)  System administrator tools 
C)  Forensic examination tools 
D)  Network management tools 
A)  Hard drive repair tools 
B)  System administrator tools 
C)  Forensic examination tools 
D)  Network management tools

Question 16

grep is a standard Linux tool that searches a specified file or region for a specified string.

Accepted Answer

A) True 
 B)False

Question 17

When a file is deleted on a UNIX System, the ctime of its parent directory is:

Accepted Answer

A)  Unchanged 
B)  Updated 
C)  Set to epoch time 
D)  Set to last modified date-time 
A)  Unchanged 
B)  Updated 
C)  Set to epoch time 
D)  Set to last modified date-time

Question 18

A list of currently mounted drives, including those not listed in the file system mount table, is kept in "/etc/mtab."

Accepted Answer

A) True 
 B)False

Question 19

Unlike the standard DOS/Windows environments, the UNIX environment has the capability of_________ , thereby preventing the contents of evidentiary media from being changed.

Accepted Answer

A)  Encrypting all data on the media 
B)  Copying the contents of the media 
C)  Warning the examiner of an impending write 
D)  Mounting storage media as Read-Only 
A)  Encrypting all data on the media 
B)  Copying the contents of the media 
C)  Warning the examiner of an impending write 
D)  Mounting storage media as Read-Only

Question 20

MAC times, which are found in the___________ , are an example of file system traces.

Accepted Answer

A)  Inode table 
B)  MBR's partition table 
C)  Inode bitmap 
D)  Data blocks 
A)  Inode table 
B)  MBR's partition table 
C)  Inode bitmap 
D)  Data blocks

Exam 18: Digital Evidence on Unix Systems

One of the difficulties in examining UNIX systems is that the file system is extremely complex, making it difficult for the examiner to recover data.

Most data-carving tools operate on the assumption that the operating system generally tries to save data in contiguous sectors.

As UNIX was never designed to work on networks, there are very few native utilities designed to access the Internet.

What is the most efficient method for a forensic examiner to confirm whether a particular tool or methodology works in a forensically acceptable manner?

In UNIX, when a file is moved within a volume, the inode change date-time (ctime) is:

In a block group, file data is located in___________ .

Given a sufficiently powerful computer, even "strong" encryption can be broken in a short time.

When requesting a search warrant, remotely connected systems cannot be considered part of the target system, so it may be necessary to obtain proper authorization before examining them.

One of the most common web browsers on UNIX systems is:

One of the most useful areas to search for notable data on a Linux system is in file slack.

The inode table can be found in the ___________.

On UNIX systems that receive e-mail, incoming messages are held in , in separate files for each user account until a user accesses them.

The UNIX convention of "piping" the results of one command into another is a serious limitation and is detrimental to using the UNIX platform for forensic examinations.

___________, which is part of the standard Linux distribution, can be used to make a bitstream copy of evidentiary media to either image files or sterile media.

The Coroner's Toolkit and The Sleuth Kit are examples of open source___________ .

grep is a standard Linux tool that searches a specified file or region for a specified string.

When a file is deleted on a UNIX System, the ctime of its parent directory is:

A list of currently mounted drives, including those not listed in the file system mount table, is kept in "/etc/mtab."

Unlike the standard DOS/Windows environments, the UNIX environment has the capability of_________ , thereby preventing the contents of evidentiary media from being changed.

MAC times, which are found in the___________ , are an example of file system traces.

Foundations of Digital Forensics

Language of Computer Crime Investigation

Digital Evidence in the Courtroom

Cybercrime Law: a United States Perspective

Cybercrime Law: a European Perspective

Conducting Digital Investigations

Handling a Digital Crime Scene

Investigative Reconstruction With Digital Evidence

Modus Operandi, Motive, and Technology

Violent Crime and Digital Evidence

Digital Evidence As Alibi

Sex Offenders on the Internet

Computer Intrusions

Cyberstalking

Computer Basics for Digital Investigators

Applying Forensic Science to Computers

Digital Evidence on Windows Systems

Digital Evidence on Macintosh Systems

Digital Evidence on Mobile Devices

Network Basics for Digital Investigators

Applying Forensic Science to Networks

Digital Evidence on the Internet

Digital Evidence at the Physical and Data-Link Layers

Digital Evidence at the Network and Transport Layers

Filters