Question 1

Describe some of the forensic processes involved in investigating an employee suspected of industrial espionage.

Accepted Answer

Before initiating this type of investigation, make sure the company, whether it's a private organization or a public agency, has set up rules of use and limitations of privacy rights. For these investigations, you might need to set up a surveillance camera to monitor the employee's activities in the office. You might also need to plant a software or hardware keylogger (for capturing keystrokes remotely), and you need to engage the network administrator's services to monitor Internet and network activities. In this situation, you might want to do a remote acquisition of the employee's drive, and then use another tool to determine what peripheral devices have been accessed.

Question 2

Advanced hexadecimal editors offer many features not available in digital forensics tools, such as hashing speciﬁc ﬁles or sectors. ​

Accepted Answer

A) True 
 B)False  True

Question 3

Describe what happens if a FAT partition containing bad cluster​ is converted to an NTFS partition, and how you miss evidence that's being hidden.

Accepted Answer

​If a FAT partition containing clusters marked as bad is converted to an NTFS partition, the bad clusters remain marked as bad, so the conversion to NTFS doesn't affect the content of these clusters. Most GUI tools skip clusters marked as bad in FAT and NTFS, and these clusters might contain valuable evidence for an investigation.

Question 4

What technique is designed to reduce or eliminate the possibility of a rainbow table being used to discover passwords?​

Accepted Answer

A) salted passwords 
B) ​scrambled passwords 
C) indexed passwords 
D)  master passwords 
A) salted passwords 
B) ​scrambled passwords 
C) indexed passwords 
D)  master passwords

Question 5

Match the following terms with the correct definitions below:?
-?The result of an investigation expanding beyond its original description because the discovery of unexpected evidence increases the amount of work required.

Accepted Answer

A) ?bit-shifting 
B) block-wise hashing? 
C) ?cover-media 
D) key-escrow? 
E) ?Known File Filter (KFF)
F)rainbow table?
G)?salting passwords
H)scope creep?
I)?steganography
J)stego-media 
A) ?bit-shifting 
B) block-wise hashing? 
C) ?cover-media 
D) key-escrow? 
E) ?Known File Filter (KFF)
F)rainbow table?
G)?salting passwords
H)scope creep?
I)?steganography
J)stego-media

Question 6

The goal of recovering as much information as possible can result in ________________, in which an investigation expands beyond the original description because of unexpected evidence found.​

Accepted Answer

A) ​litigation 
B) ​scope creep 
C) criminal charges 
D) violations 
A) ​litigation 
B) ​scope creep 
C) criminal charges 
D) violations

Question 7

A ____________ image file containing software is intended to be bit-stream copied to floppy disks or other external media.​

Accepted Answer

A) ​fdisk 
B) ​format 
C) dd 
D) DiskEdit 
A) ​fdisk 
B) ​format 
C) dd 
D) DiskEdit

Question 8

In ProDiscover and other digital forensics tools, raw format image files (.dd extension) don't contain ________, so you must validate them manually to ensure the integrity of data.​

Accepted Answer

The answer of In ProDiscover and other digital forensics tools,...

Question 9

What letter should be typed into DiskEdit in order to mark a good sector as bad?​

Accepted Answer

A) ​M 
B) ​B 
C) T 
D) D 
A) ​M 
B) ​B 
C) T 
D) D

Question 10

​
Explain what data hiding is and list techniques used to hide data.

Accepted Answer

Data hiding involves changing or manipul

Question 11

Match the following terms with the correct definitions below:?
-?The process of hashing all sectors of a file and then comparing them with sectors on a suspect's disk drive to determine whether there are any remnants of the original file that couldn't be recovered.

Accepted Answer

A) ?bit-shifting 
B) block-wise hashing? 
C) ?cover-media 
D) key-escrow? 
E) ?Known File Filter (KFF)
F)rainbow table?
G)?salting passwords
H)scope creep?
I)?steganography
J)stego-media 
A) ?bit-shifting 
B) block-wise hashing? 
C) ?cover-media 
D) key-escrow? 
E) ?Known File Filter (KFF)
F)rainbow table?
G)?salting passwords
H)scope creep?
I)?steganography
J)stego-media

Question 12

The term ​_____________ comes from the Greek word for "hidden writing".

Accepted Answer

The answer of The term ​_____________ comes from the Greek...

Question 13

Match the following terms with the correct definitions below:?
-?A file containing the hash value for every possible password that can be generated from a computer's keyboard.

Accepted Answer

A) ?bit-shifting 
B) block-wise hashing? 
C) ?cover-media 
D) key-escrow? 
E) ?Known File Filter (KFF)
F)rainbow table?
G)?salting passwords
H)scope creep?
I)?steganography
J)stego-media 
A) ?bit-shifting 
B) block-wise hashing? 
C) ?cover-media 
D) key-escrow? 
E) ?Known File Filter (KFF)
F)rainbow table?
G)?salting passwords
H)scope creep?
I)?steganography
J)stego-media

Question 14

When performing a static acquisition, what should be done after the hardware on a suspect's computer has been inventoried and documented?​

Accepted Answer

A) ​Inventory and documentation information should be stored on a drive and then the drive should be reformatted. 
B) ​Start the suspect's computer and begin collecting evidence. 
C)  The hard drive should be removed, if practical, and the system's date and time values should be recorded from the system's CMOS.​ 
D) Connect the suspect's computer to the local network so that up to date forensics utilities can be utilized. 
A) ​Inventory and documentation information should be stored on a drive and then the drive should be reformatted. 
B) ​Start the suspect's computer and begin collecting evidence. 
C)  The hard drive should be removed, if practical, and the system's date and time values should be recorded from the system's CMOS.​ 
D) Connect the suspect's computer to the local network so that up to date forensics utilities can be utilized.

Question 15

​Examining and analyzing digital evidence depend on the nature of the investigation and the amount of data to process. Criminal investigations are limited to ﬁnding data deﬁned in the search warrant, and _____ investigations are often limited by court orders for discovery.

Accepted Answer

The answer of ​Examining and analyzing digital evidence depend on...

Question 16

Illustrate how an investigator would detect whether a suspect's drive contains hidden partitions.

Accepted Answer

Hiding partitions is a technique for con

Question 17

Typically, anti-virus tools run hashes on potential malware files, but some advanced malware uses ________________ as a way to hide its malicious code from antivirus tools.​

Accepted Answer

A) ​hashing 
B) ​bit-shifting 
C) registry edits 
D) slack space 
A) ​hashing 
B) ​bit-shifting 
C) registry edits 
D) slack space

Question 18

What format below is used for VMware images?

Accepted Answer

A) ?.vhd 
B) ?.vmdk 
C) .s01 
D) .aff 
A) ?.vhd 
B) ?.vmdk 
C) .s01 
D) .aff

Question 19

Match the following terms with the correct definitions below:?
-?A technology designed to recover encrypted data if users forget their passphrases or if the user key is corrupted after a system failure.

Accepted Answer

A) ?bit-shifting 
B) block-wise hashing? 
C) ?cover-media 
D) key-escrow? 
E) ?Known File Filter (KFF)
F)rainbow table?
G)?salting passwords
H)scope creep?
I)?steganography
J)stego-media 
A) ?bit-shifting 
B) block-wise hashing? 
C) ?cover-media 
D) key-escrow? 
E) ?Known File Filter (KFF)
F)rainbow table?
G)?salting passwords
H)scope creep?
I)?steganography
J)stego-media

Question 20

Which option below is not a disk management tool?​

Accepted Answer

A) Partition Magic​ 
B) ​Partition Master 
C) GRUB 
D) HexEdit 
A) Partition Magic​ 
B) ​Partition Master 
C) GRUB 
D) HexEdit

Describe some of the forensic processes involved in investigating an employee suspected of industrial espionage.

Advanced hexadecimal editors offer many features not available in digital forensics tools, such as hashing speciﬁc ﬁles or sectors.

Describe what happens if a FAT partition containing bad cluster is converted to an NTFS partition, and how you miss evidence that's being hidden.

What technique is designed to reduce or eliminate the possibility of a rainbow table being used to discover passwords?

Match the following terms with the correct definitions below:? -?The result of an investigation expanding beyond its original description because the discovery of unexpected evidence increases the amount of work required.

The goal of recovering as much information as possible can result in ________________, in which an investigation expands beyond the original description because of unexpected evidence found.

A ____________ image file containing software is intended to be bit-stream copied to floppy disks or other external media.

In ProDiscover and other digital forensics tools, raw format image files (.dd extension) don't contain ________, so you must validate them manually to ensure the integrity of data.

What letter should be typed into DiskEdit in order to mark a good sector as bad?

Explain what data hiding is and list techniques used to hide data.

Match the following terms with the correct definitions below:? -?The process of hashing all sectors of a file and then comparing them with sectors on a suspect's disk drive to determine whether there are any remnants of the original file that couldn't be recovered.

The term _____________ comes from the Greek word for "hidden writing".

Match the following terms with the correct definitions below:? -?A file containing the hash value for every possible password that can be generated from a computer's keyboard.

When performing a static acquisition, what should be done after the hardware on a suspect's computer has been inventoried and documented?

Examining and analyzing digital evidence depend on the nature of the investigation and the amount of data to process. Criminal investigations are limited to ﬁnding data deﬁned in the search warrant, and _____ investigations are often limited by court orders for discovery.

Illustrate how an investigator would detect whether a suspect's drive contains hidden partitions.

Typically, anti-virus tools run hashes on potential malware files, but some advanced malware uses ________________ as a way to hide its malicious code from antivirus tools.

What format below is used for VMware images?

Match the following terms with the correct definitions below:? -?A technology designed to recover encrypted data if users forget their passphrases or if the user key is corrupted after a system failure.

Which option below is not a disk management tool?

Understanding the Digital Forensics Profession and Investigations

The Investigators Office and Laboratory

Data Acquisition

Processing Crime and Incident Scenes

Working With Windows and Cli Systems

Current Computer Forensics Tools

Macintosh and Linux Boot Processes and File Systems

Recovering Graphics Files

Virtual Machine and Cloud Forensics

Live Acquisitions and Network Forensics

Email Investigations

Cell Phone and Mobile Device Forensics

Report Writing for High Tech Investigations

Expert Testimony in High Tech Investigations

Ethics for the Investigator and Expert Witness

Filters

Exam 9: Computer Forensics Analysis and Validation

Describe some of the forensic processes involved in investigating an employee suspected of industrial espionage.

Advanced hexadecimal editors offer many features not available in digital forensics tools, such as hashing speciﬁc ﬁles or sectors. ​

Describe what happens if a FAT partition containing bad cluster​ is converted to an NTFS partition, and how you miss evidence that's being hidden.

What technique is designed to reduce or eliminate the possibility of a rainbow table being used to discover passwords?​

Match the following terms with the correct definitions below:? -?The result of an investigation expanding beyond its original description because the discovery of unexpected evidence increases the amount of work required.

The goal of recovering as much information as possible can result in ________________, in which an investigation expands beyond the original description because of unexpected evidence found.​

A ____________ image file containing software is intended to be bit-stream copied to floppy disks or other external media.​

In ProDiscover and other digital forensics tools, raw format image files (.dd extension) don't contain ________, so you must validate them manually to ensure the integrity of data.​

What letter should be typed into DiskEdit in order to mark a good sector as bad?​

​ Explain what data hiding is and list techniques used to hide data.

Match the following terms with the correct definitions below:? -?The process of hashing all sectors of a file and then comparing them with sectors on a suspect's disk drive to determine whether there are any remnants of the original file that couldn't be recovered.

The term ​_____________ comes from the Greek word for "hidden writing".

Match the following terms with the correct definitions below:? -?A file containing the hash value for every possible password that can be generated from a computer's keyboard.

When performing a static acquisition, what should be done after the hardware on a suspect's computer has been inventoried and documented?​

​Examining and analyzing digital evidence depend on the nature of the investigation and the amount of data to process. Criminal investigations are limited to ﬁnding data deﬁned in the search warrant, and _____ investigations are often limited by court orders for discovery.

Illustrate how an investigator would detect whether a suspect's drive contains hidden partitions.

Typically, anti-virus tools run hashes on potential malware files, but some advanced malware uses ________________ as a way to hide its malicious code from antivirus tools.​

What format below is used for VMware images?

Match the following terms with the correct definitions below:? -?A technology designed to recover encrypted data if users forget their passphrases or if the user key is corrupted after a system failure.

Which option below is not a disk management tool?​

Understanding the Digital Forensics Profession and Investigations

The Investigators Office and Laboratory

Data Acquisition

Processing Crime and Incident Scenes

Working With Windows and Cli Systems

Current Computer Forensics Tools

Macintosh and Linux Boot Processes and File Systems

Recovering Graphics Files

Virtual Machine and Cloud Forensics

Live Acquisitions and Network Forensics

Email Investigations

Cell Phone and Mobile Device Forensics

Report Writing for High Tech Investigations

Expert Testimony in High Tech Investigations

Ethics for the Investigator and Expert Witness

Filters

Advanced hexadecimal editors offer many features not available in digital forensics tools, such as hashing speciﬁc ﬁles or sectors.

Describe what happens if a FAT partition containing bad cluster is converted to an NTFS partition, and how you miss evidence that's being hidden.

What technique is designed to reduce or eliminate the possibility of a rainbow table being used to discover passwords?

The goal of recovering as much information as possible can result in ________________, in which an investigation expands beyond the original description because of unexpected evidence found.

A ____________ image file containing software is intended to be bit-stream copied to floppy disks or other external media.

In ProDiscover and other digital forensics tools, raw format image files (.dd extension) don't contain ________, so you must validate them manually to ensure the integrity of data.

What letter should be typed into DiskEdit in order to mark a good sector as bad?

Explain what data hiding is and list techniques used to hide data.

The term _____________ comes from the Greek word for "hidden writing".

When performing a static acquisition, what should be done after the hardware on a suspect's computer has been inventoried and documented?

Examining and analyzing digital evidence depend on the nature of the investigation and the amount of data to process. Criminal investigations are limited to ﬁnding data deﬁned in the search warrant, and _____ investigations are often limited by court orders for discovery.

Typically, anti-virus tools run hashes on potential malware files, but some advanced malware uses ________________ as a way to hide its malicious code from antivirus tools.

Which option below is not a disk management tool?