Exam 24: Forensic Techniques

Each RP folder contains a set of files that were changed since the last Restore Point.

List the skills that you need to become proficient at analyzing malware.

What is the pre-incident preparation that must take place for a CSIRT?

A ____ of a hard disk is a bit by bit duplicate,including the boot sector,the partition table,all partitions,hidden files,bad sectors,and even the unallocated space on the hard drive.

The ____ file is used when Windows goes into hibernation.

Match each item with a statement below. -A symbolic representation of a family of strings that can be generated from the expression

A network of honeypots is called a(n)____________________.

The first thing you want to do before analyzing network traffic is make sure you have permission to look at it.

List UNIX/Linux systems files that are of particular interest to the forensic examiner.

A forensic examiner must be familiar with the structure and operation of different file systems and operating systems.