Question 1

Match the following GREP tokens with their related functions.
-*

Accepted Answer

A) Used to match the ASCII hexadecimal representation of a single character 
B) Implements an OR situation 
C) When placed after a character, matches any number of occurrences of that character 
D) Matches a single character 
A) Used to match the ASCII hexadecimal representation of a single character 
B) Implements an OR situation 
C) When placed after a character, matches any number of occurrences of that character 
D) Matches a single character C

Question 2

Match the type of directory to its definition.
-/lost+found

Accepted Answer

A) Where files with no names are placed 
B) Contains information on printers, log files, and transient data 
C) Could be a rich source of evidence if not recently cleaned 
D) Library files 
E) Contains shadow password files 
A) Where files with no names are placed 
B) Contains information on printers, log files, and transient data 
C) Could be a rich source of evidence if not recently cleaned 
D) Library files 
E) Contains shadow password files A

Question 3

Clues that may indicate stego use include all of the following EXCEPT

Accepted Answer

A) The sophistication of the computer's owner 
B) Software clues on the computer 
C) Type of crime being investigated 
D) Large number of files in the Recycle Bin 
A) The sophistication of the computer's owner 
B) Software clues on the computer 
C) Type of crime being investigated 
D) Large number of files in the Recycle Bin D

Question 4

The ________ subfolder lists the files that the user has accessed over several time periods.

Accepted Answer

The answer of The ________ subfolder lists the files that...

Question 5

Match the hex signature with its file extension.
-89 50 4E 47 OD 0A 1A 0A

Accepted Answer

A) BMP 
B) ICO 
C) PNG 
D) JPEG 
A) BMP 
B) ICO 
C) PNG 
D) JPEG

Question 6

In steganography,the original file that contains the hidden information is the

Accepted Answer

A) Steganographic carrier 
B) Carrier medium 
C) Hiding medium 
D) Concealing medium 
A) Steganographic carrier 
B) Carrier medium 
C) Hiding medium 
D) Concealing medium

Question 7

Match the hex signature with its file extension.
-42 4D

Accepted Answer

A) BMP 
B) ICO 
C) PNG 
D) JPEG 
A) BMP 
B) ICO 
C) PNG 
D) JPEG

Question 8

Examples of user data include all of the following EXCEPT

Accepted Answer

A) User passwords 
B) User profiles 
C) Program files 
D) Temp files 
A) User passwords 
B) User profiles 
C) Program files 
D) Temp files

Question 9

Match the following to their definitions.
-Temp files

Accepted Answer

A) Internet history files 
B) Installed applications 
C) Though used only briefly, they are not deleted 
D) Data created by a user 
A) Internet history files 
B) Installed applications 
C) Though used only briefly, they are not deleted 
D) Data created by a user

Question 10

Match between columns
                        Premises: User profiles

Accepted Answer

The Answer of Though used only briefly, they are not is...

Question 11

Which of the following is considered an excellent source to obtain information on when passwords were last changed within a Linux system?

Accepted Answer

A) /etc/sysconfig 
B) /etc/shadow/passwd 
C) /etc/shadow 
D) /etc 
A) /etc/sysconfig 
B) /etc/shadow/passwd 
C) /etc/shadow 
D) /etc

Question 12

The ________ folder generally contains information concerning the programs the user typically works with.

Accepted Answer

The answer of The ________ folder generally contains information concerning...

Question 13

One application of metadata used by Windows is an uncommon storage concept called ________.

Accepted Answer

alternate

Question 14

Match the following to their data structures.
-Data block

Accepted Answer

A) Contain metadata for each file 
B) Unit of allocation for storage 
C) Created for every file system mounted 
D) Contains information about the directory structure 
A) Contain metadata for each file 
B) Unit of allocation for storage 
C) Created for every file system mounted 
D) Contains information about the directory structure

Question 15

System data and artifacts are files generated by the ________.

Accepted Answer

The answer of System data and artifacts are files generated...

Question 16

All of the following are key differences in identifying an operating system EXCEPT

Accepted Answer

A) The Recycle Bin folder 
B) Operating system folder names 
C) User root folder construction 
D) Folders containing group userids 
A) The Recycle Bin folder 
B) Operating system folder names 
C) User root folder construction 
D) Folders containing group userids

Question 17

Match the hex signature with its file extension.
-00 00 01 00

Accepted Answer

A) BMP 
B) ICO 
C) PNG 
D) JPEG 
A) BMP 
B) ICO 
C) PNG 
D) JPEG

Question 18

The ________ folder is used by Internet sites to store information about the user.

Accepted Answer

The answer of The ________ folder is used by Internet...

Question 19

In a forensics context,hidden information about files and folders is called

Accepted Answer

A) Artifact data 
B) Metadata 
C) Archive data 
D) Read-only data 
A) Artifact data 
B) Metadata 
C) Archive data 
D) Read-only data

Question 20

If you change a file extension by renaming the file,

Accepted Answer

A) You also change the data in the file 
B) You will not be able to open the file 
C) Windows will change the icon that represents the file 
D) You also change the data header 
A) You also change the data in the file 
B) You will not be able to open the file 
C) Windows will change the icon that represents the file 
D) You also change the data header

Match the following GREP tokens with their related functions. -*

Match the type of directory to its definition. -/lost+found

Clues that may indicate stego use include all of the following EXCEPT

The ________ subfolder lists the files that the user has accessed over several time periods.

Match the hex signature with its file extension. -89 50 4E 47 OD 0A 1A 0A

In steganography,the original file that contains the hidden information is the

Match the hex signature with its file extension. -42 4D

Examples of user data include all of the following EXCEPT

Match the following to their definitions. -Temp files

Which of the following is considered an excellent source to obtain information on when passwords were last changed within a Linux system?

The ________ folder generally contains information concerning the programs the user typically works with.

One application of metadata used by Windows is an uncommon storage concept called ________.

Match the following to their data structures. -Data block

System data and artifacts are files generated by the ________.

All of the following are key differences in identifying an operating system EXCEPT

Match the hex signature with its file extension. -00 00 01 00

The ________ folder is used by Internet sites to store information about the user.

In a forensics context,hidden information about files and folders is called

If you change a file extension by renaming the file,

Forensic Evidence and Crime Investigation

Computer Forensics Anddigital Detective Work

Tools, Environments, Equipment, and Certifications

Policies and Procedures

Data, PDA, and Cell Phone Forensics

Operating Systems and Data Transmission Basics for Digital Investigations

E-Mail and Webmail Forensics

Internet and Network Forensics and Intrusion Detection

Tracking Down Those Who Intend to Do Harm on a Large Scale

Fraud and Forensic Accounting Investigation

Federal Rules and Criminal Codes

Ethical and Professional Responsibility in Testimony

Filters

Exam 7: Investigating Windows, linux, and Graphic Files

Match the following GREP tokens with their related functions. -*

Match the type of directory to its definition. -/lost+found

Clues that may indicate stego use include all of the following EXCEPT

The ________ subfolder lists the files that the user has accessed over several time periods.

Match the hex signature with its file extension. -89 50 4E 47 OD 0A 1A 0A

In steganography,the original file that contains the hidden information is the

Match the hex signature with its file extension. -42 4D

Examples of user data include all of the following EXCEPT

Match the following to their definitions. -Temp files

Which of the following is considered an excellent source to obtain information on when passwords were last changed within a Linux system?

The ________ folder generally contains information concerning the programs the user typically works with.

One application of metadata used by Windows is an uncommon storage concept called ________.

Match the following to their data structures. -Data block

System data and artifacts are files generated by the ________.

All of the following are key differences in identifying an operating system EXCEPT

Match the hex signature with its file extension. -00 00 01 00

The ________ folder is used by Internet sites to store information about the user.

In a forensics context,hidden information about files and folders is called

If you change a file extension by renaming the file,

Forensic Evidence and Crime Investigation

Computer Forensics Anddigital Detective Work

Tools, Environments, Equipment, and Certifications

Policies and Procedures

Data, PDA, and Cell Phone Forensics

Operating Systems and Data Transmission Basics for Digital Investigations

E-Mail and Webmail Forensics

Internet and Network Forensics and Intrusion Detection

Tracking Down Those Who Intend to Do Harm on a Large Scale

Fraud and Forensic Accounting Investigation

Federal Rules and Criminal Codes

Ethical and Professional Responsibility in Testimony

Filters