Exam 19: Computer Forensics

________ is a slang term for an unauthorized computer or network intrusion.

List four places where a forensic computer examiner might look to determine what websites a computer user has visited recently. What kind of leads could this information provide to the investigator?

The term "bit" is short for:

Match the word in Column 1 to its definition in Column 2. Each answer can only be used once. A)A set of instructions compiled into a program that performs a particular task B)A group of sectors in multiples of two; typically the minimum space allocated to a file C)A standard method by which Internet sites are addressed D)All data that the operating system is presently aware of, and thus is readily accessible to the user E)Files placed on a computer from a visited website that are used to track visits and usage of that site F)Hardware or software designed to protect against intrusions into a computer network G)Typically the main storage location within the computer, consisting of magnetic platters contained in a case H)The smallest unit of data addressable by a hard disk drive, generally consisting of 512 bytes I)The main chip within the computer, also referred to as the brain of the computer. This microprocessor chip handles most of the operations (code and instructions)of the computer. J)Portions of visited Web pages placed on the local hard disk drive to facilitate quicker retrieval once revisited K)The main system board of a computer (and many other electronic devices)that delivers power, data, and instructions to the computer's components L)Areas of files and disks that are typically not apparent to the computer user (and often not to the operating system), but contain data nonetheless -Uniform resource locater (URL)

Swap space is empty space on a hard disk drive (HDD)created because of the way the HDD stores files.

Match the word in Column 1 to its definition in Column 2. Each answer can only be used once. A)A set of instructions compiled into a program that performs a particular task B)A group of sectors in multiples of two; typically the minimum space allocated to a file C)A standard method by which Internet sites are addressed D)All data that the operating system is presently aware of, and thus is readily accessible to the user E)Files placed on a computer from a visited website that are used to track visits and usage of that site F)Hardware or software designed to protect against intrusions into a computer network G)Typically the main storage location within the computer, consisting of magnetic platters contained in a case H)The smallest unit of data addressable by a hard disk drive, generally consisting of 512 bytes I)The main chip within the computer, also referred to as the brain of the computer. This microprocessor chip handles most of the operations (code and instructions)of the computer. J)Portions of visited Web pages placed on the local hard disk drive to facilitate quicker retrieval once revisited K)The main system board of a computer (and many other electronic devices)that delivers power, data, and instructions to the computer's components L)Areas of files and disks that are typically not apparent to the computer user (and often not to the operating system), but contain data nonetheless -Internet cache

What is fragmentation? What effect does fragmentation have on a hard disk drive (HDD)?

Match the word in Column 1 to its definition in Column 2. Each answer can only be used once. A)A set of instructions compiled into a program that performs a particular task B)A group of sectors in multiples of two; typically the minimum space allocated to a file C)A standard method by which Internet sites are addressed D)All data that the operating system is presently aware of, and thus is readily accessible to the user E)Files placed on a computer from a visited website that are used to track visits and usage of that site F)Hardware or software designed to protect against intrusions into a computer network G)Typically the main storage location within the computer, consisting of magnetic platters contained in a case H)The smallest unit of data addressable by a hard disk drive, generally consisting of 512 bytes I)The main chip within the computer, also referred to as the brain of the computer. This microprocessor chip handles most of the operations (code and instructions)of the computer. J)Portions of visited Web pages placed on the local hard disk drive to facilitate quicker retrieval once revisited K)The main system board of a computer (and many other electronic devices)that delivers power, data, and instructions to the computer's components L)Areas of files and disks that are typically not apparent to the computer user (and often not to the operating system), but contain data nonetheless -Software

The ________ is a complex network of wires that carry data from one hardware device to another.

The definition of software is:

________ data includes all information that the operating system is presently aware of, and thus is readily accessible to the user.

Match the word in Column 1 to its definition in Column 2. Each answer can only be used once. A)A set of instructions compiled into a program that performs a particular task B)A group of sectors in multiples of two; typically the minimum space allocated to a file C)A standard method by which Internet sites are addressed D)All data that the operating system is presently aware of, and thus is readily accessible to the user E)Files placed on a computer from a visited website that are used to track visits and usage of that site F)Hardware or software designed to protect against intrusions into a computer network G)Typically the main storage location within the computer, consisting of magnetic platters contained in a case H)The smallest unit of data addressable by a hard disk drive, generally consisting of 512 bytes I)The main chip within the computer, also referred to as the brain of the computer. This microprocessor chip handles most of the operations (code and instructions)of the computer. J)Portions of visited Web pages placed on the local hard disk drive to facilitate quicker retrieval once revisited K)The main system board of a computer (and many other electronic devices)that delivers power, data, and instructions to the computer's components L)Areas of files and disks that are typically not apparent to the computer user (and often not to the operating system), but contain data nonetheless -Latent data

A software algorithm used to create a "fingerprint" of a file or an entire HDD is called:

Match the word in Column 1 to its definition in Column 2. Each answer can only be used once. A)A set of instructions compiled into a program that performs a particular task B)A group of sectors in multiples of two; typically the minimum space allocated to a file C)A standard method by which Internet sites are addressed D)All data that the operating system is presently aware of, and thus is readily accessible to the user E)Files placed on a computer from a visited website that are used to track visits and usage of that site F)Hardware or software designed to protect against intrusions into a computer network G)Typically the main storage location within the computer, consisting of magnetic platters contained in a case H)The smallest unit of data addressable by a hard disk drive, generally consisting of 512 bytes I)The main chip within the computer, also referred to as the brain of the computer. This microprocessor chip handles most of the operations (code and instructions)of the computer. J)Portions of visited Web pages placed on the local hard disk drive to facilitate quicker retrieval once revisited K)The main system board of a computer (and many other electronic devices)that delivers power, data, and instructions to the computer's components L)Areas of files and disks that are typically not apparent to the computer user (and often not to the operating system), but contain data nonetheless -Motherboard

________ comprises the physical components of the computer.

Match the word in Column 1 to its definition in Column 2. Each answer can only be used once. A)A set of instructions compiled into a program that performs a particular task B)A group of sectors in multiples of two; typically the minimum space allocated to a file C)A standard method by which Internet sites are addressed D)All data that the operating system is presently aware of, and thus is readily accessible to the user E)Files placed on a computer from a visited website that are used to track visits and usage of that site F)Hardware or software designed to protect against intrusions into a computer network G)Typically the main storage location within the computer, consisting of magnetic platters contained in a case H)The smallest unit of data addressable by a hard disk drive, generally consisting of 512 bytes I)The main chip within the computer, also referred to as the brain of the computer. This microprocessor chip handles most of the operations (code and instructions)of the computer. J)Portions of visited Web pages placed on the local hard disk drive to facilitate quicker retrieval once revisited K)The main system board of a computer (and many other electronic devices)that delivers power, data, and instructions to the computer's components L)Areas of files and disks that are typically not apparent to the computer user (and often not to the operating system), but contain data nonetheless -Visible data

RAM is not permanent; its contents are lost forever once power is taken away from the computer.

Mobile devices are often shut off to avoid the loss of data.

A Message Digest 5 (MD5)/Secure Hash Algorithm (SHA)takes a ________ of a hard disk drive (HDD)before and after forensic imaging.

Files containing chat and instant messaging are most likely stored in: