Exam 9: Computer Forensics Analysis and Validation

Describe with examples why the approach you take for a forensics case depends largely on the specific type of case you're investigating.

Many commercial encryption programs use a technology called ____, which is designed to recover encrypted data if users forget their passphrases or if the user key is corrupted after a system data failure.

In FTK ____ search mode, you can also look for files that were accessed or changed during a certain time period.

The term ____ comes from the Greek word for"hidden writing."

To generate reports with the FTK ReportWizard, first you need to ____________________ files during an examination.

Briefly describe how to use steganography for creating digital watermarks.

How should you approach a case in which an employee is suspected of industrial espionage?

The ____ search feature allows you to look for words with extensions such as "ing,""ed," and so forth.

Match each item with a statement below: -program used to clean all data from the target drive you plan to use

There are ____ searching options for keywords which FTK offers.

Match each item with a statement below: -a disk-partitioning utility

In civil and criminal cases, the scope is often defined by search warrants or ____, which specify what data you can recover.

The data-hiding technique ____________________ changes data from readable code to data that looks like binary executable code.

What are the file systems supported by FTK for forensic analysis?

What are the basic guidelines to identify steganography files?

FTK cannot perform forensics analysis on FAT12 file systems.

____ attacks use every possible letter, number, and character found on a keyboard when cracking a password.

Match each item with a statement below: -an FTK searching option

____ is a remote access program for communication between two computers. The connection is established by using the DiskExplorer program (FAT or NTFS) corresponding to the suspect (remote) computer's file system.

AccessData ____ compares known file hash values to files on your evidence drive or image files to see whether they contain suspicious data.