Exam 11: Virtual Machines, Network Forensics, and Live Acquisitions

____ hide the most valuable data at the innermost part of the network.

Match each item with a statement below: -a bootable Linux CD intended for computer and network forensics

____ is a Sysinternals command that shows all Registry data in real time on a Windows computer.

____ can be used to create a bootable forensic CD and perform a live acquisition.

Explain The Auditor tool.

How should you proceed if your network forensic investigation involves other companies?

____________________ is a layered network defense strategy developed by the National Security Agency (NSA).

____ is a good tool for extracting information from large Libpcap files.

____________________ logs record traffic in and out of a network.

PsList from PsTools allows you to list detailed information about processes.

The U.K. Honeynet Project has created the ____________________. It contains the honeywall and honeypot on a bootable memory stick.

Match each item with a statement below: -type of malware

Match each item with a statement below: -an audit control program that detects anomalies in traffic and sends an alert automatically

Most packet sniffer tools can read anything captured in ____ format.

____ can help you determine whether a network is truly under attack or a user has inadvertently installed an untested patch or custom program.

When intruders break into a network, they rarely leave a trail behind.

____ is a suite of tools created by Sysinternals.

____ is the text version of Ethereal, a packet sniffer tool.

The Knoppix STD tool ____ enables you to reset passwords on a Windows computer, including the administrator password

Detail a standard procedure for network forensics investigations.