Question 1

Match each term with its definition:
-A hardware device or software program that prevents a computer from writing data to an evidence drive?

Accepted Answer

A) acquisition 
B) brute-force attack 
C) Computer Forensics Tool Testing (CFTT) 
D) extraction 
E) keyword search
F)National Software Reference Library (NSRL)
G)password dictionary attack
H)reconstruction
I)validation
J)write-blocker 
A) acquisition 
B) brute-force attack 
C) Computer Forensics Tool Testing (CFTT) 
D) extraction 
E) keyword search
F)National Software Reference Library (NSRL)
G)password dictionary attack
H)reconstruction
I)validation
J)write-blocker J

Question 2

_______________ proves that two sets of data are identical by calculating hash values or using another similar method.​

Accepted Answer

A) ​Validation 
B) ​Compilation 
C) Integration 
D) Verification 
A) ​Validation 
B) ​Compilation 
C) Integration 
D) Verification D

Question 3

What option below is an example of a platform specific encryption tool?

Accepted Answer

A) ​Pretty Good Privacy (PGP) 
B) ​GnuPG 
C) TrueCrypt 
D) BitLocker 
A) ​Pretty Good Privacy (PGP) 
B) ​GnuPG 
C) TrueCrypt 
D) BitLocker D

Question 4

The _____________ utility is designed to be installed on Linux distributions, and can be used to analyze a variety of different file systems, while also offering the ability to use plugins.

Accepted Answer

The answer of The _____________ utility is designed to be...

Question 5

Match each term with its definition:
-An attack that uses a collection of words or phrases that might be passwords for an encrypted file.

Accepted Answer

A) acquisition 
B) brute-force attack 
C) Computer Forensics Tool Testing (CFTT) 
D) extraction 
E) keyword search
F)National Software Reference Library (NSRL)
G)password dictionary attack
H)reconstruction
I)validation
J)write-blocker 
A) acquisition 
B) brute-force attack 
C) Computer Forensics Tool Testing (CFTT) 
D) extraction 
E) keyword search
F)National Software Reference Library (NSRL)
G)password dictionary attack
H)reconstruction
I)validation
J)write-blocker

Question 6

What hex value is the standard indicator for jpeg graphics files?​

Accepted Answer

A) FF D9​ 
B) ​F8 D8 
C) FF D8 
D) AB CD 
A) FF D9​ 
B) ​F8 D8 
C) FF D8 
D) AB CD

Question 7

Reconstructing fragments of files that have been deleted from a suspect drive, is known as ____________ in North America.​

Accepted Answer

A) salvaging 
B) ​scraping 
C) carving 
D) sculpting 
A) salvaging 
B) ​scraping 
C) carving 
D) sculpting

Question 8

Which of the following is stated within the ISO 27037 standard?​

Accepted Answer

A) ​Digital Evidence First Responders should use validated tools. 
B) ​Software forensics tools must provide a GUI interface. 
C) Software forensics tools must use the Windows OS. 
D) Hardware acquisition tools can only use CRC-32 hashing. 
A) ​Digital Evidence First Responders should use validated tools. 
B) ​Software forensics tools must provide a GUI interface. 
C) Software forensics tools must use the Windows OS. 
D) Hardware acquisition tools can only use CRC-32 hashing.

Question 9

Match each term with its definition:
-?The process of rebuilding data files; one of the required functions of digital forensics tools.

Accepted Answer

A) acquisition 
B) brute-force attack 
C) Computer Forensics Tool Testing (CFTT) 
D) extraction 
E) keyword search
F)National Software Reference Library (NSRL)
G)password dictionary attack
H)reconstruction
I)validation
J)write-blocker 
A) acquisition 
B) brute-force attack 
C) Computer Forensics Tool Testing (CFTT) 
D) extraction 
E) keyword search
F)National Software Reference Library (NSRL)
G)password dictionary attack
H)reconstruction
I)validation
J)write-blocker

Question 10

How does a password dictionary attack work?​

Accepted Answer

Passwords are typically stored as hash v

Question 11

What tool below was written for MS-DOS and was commonly used for manual digital investigations?​

Accepted Answer

A) ​Norton DiskEdit 
B) ​ByteBack 
C) DataLifter 
D) SMART 
A) ​Norton DiskEdit 
B) ​ByteBack 
C) DataLifter 
D) SMART

Question 12

In what mode do most write-blockers run??

Accepted Answer

A) ?GUI mode 
B) ?Shell mode 
C) BIOS mode 
D) RW mode 
A) ?GUI mode 
B) ?Shell mode 
C) BIOS mode 
D) RW mode

Question 13

A keyword search is part of the ​analysis process within what forensic function?

Accepted Answer

A) ​reconstruction 
B) ​acquisition 
C) extraction 
D) reporting 
A) ​reconstruction 
B) ​acquisition 
C) extraction 
D) reporting

Question 14

__________ can be platform specific, such as BitLocker, or done with third-party tools, such as Pretty Good Privacy (PGP) ​and GNuPG

Accepted Answer

The answer of __________ can be platform specific, such as...

Question 15

Match each term with its definition:
-A way to confirm that a tool is functioning as intended; one of the functions of digital forensics tools.?

Accepted Answer

A) acquisition 
B) brute-force attack 
C) Computer Forensics Tool Testing (CFTT) 
D) extraction 
E) keyword search
F)National Software Reference Library (NSRL)
G)password dictionary attack
H)reconstruction
I)validation
J)write-blocker 
A) acquisition 
B) brute-force attack 
C) Computer Forensics Tool Testing (CFTT) 
D) extraction 
E) keyword search
F)National Software Reference Library (NSRL)
G)password dictionary attack
H)reconstruction
I)validation
J)write-blocker

Question 16

​Software forensics tools are grouped into command-line applications and GUI applications

Accepted Answer

A) True 
 B)False

Question 17

Explain the difference between validation and verification.

Accepted Answer

Validation is a means to confirm that a

Question 18

List three of the six subfunctions that exist under the reconstruction function.​

Accepted Answer

The six subfunctions or methods under th

Question 19

ISO standard 27037 sta​tes that the most important factors in data acquisition are the DEFR's competency and the use of validated tools.

Accepted Answer

A) True 
 B)False

Question 20

What two different options are available for write blockers, and how do these options work?​

Accepted Answer

Software and hardware based write blocke

Match each term with its definition: -A hardware device or software program that prevents a computer from writing data to an evidence drive?

_______________ proves that two sets of data are identical by calculating hash values or using another similar method.

What option below is an example of a platform specific encryption tool?

The _____________ utility is designed to be installed on Linux distributions, and can be used to analyze a variety of different file systems, while also offering the ability to use plugins.

Match each term with its definition: -An attack that uses a collection of words or phrases that might be passwords for an encrypted file.

What hex value is the standard indicator for jpeg graphics files?

Reconstructing fragments of files that have been deleted from a suspect drive, is known as ____________ in North America.

Which of the following is stated within the ISO 27037 standard?

Match each term with its definition: -?The process of rebuilding data files; one of the required functions of digital forensics tools.

How does a password dictionary attack work?

What tool below was written for MS-DOS and was commonly used for manual digital investigations?

In what mode do most write-blockers run??

A keyword search is part of the analysis process within what forensic function?

__________ can be platform specific, such as BitLocker, or done with third-party tools, such as Pretty Good Privacy (PGP) and GNuPG

Match each term with its definition: -A way to confirm that a tool is functioning as intended; one of the functions of digital forensics tools.?

Software forensics tools are grouped into command-line applications and GUI applications

Explain the difference between validation and verification.

List three of the six subfunctions that exist under the reconstruction function.

ISO standard 27037 states that the most important factors in data acquisition are the DEFR's competency and the use of validated tools.

What two different options are available for write blockers, and how do these options work?

Understanding the Digital Forensics Profession and Investigations

The Investigators Office and Laboratory

Data Acquisition

Processing Crime and Incident Scenes

Working With Windows and Cli Systems

Macintosh and Linux Boot Processes and File Systems

Recovering Graphics Files

Computer Forensics Analysis and Validation

Virtual Machine and Cloud Forensics

Live Acquisitions and Network Forensics

Email Investigations

Cell Phone and Mobile Device Forensics

Report Writing for High Tech Investigations

Expert Testimony in High Tech Investigations

Ethics for the Investigator and Expert Witness

Filters

Exam 6: Current Computer Forensics Tools

Match each term with its definition: -A hardware device or software program that prevents a computer from writing data to an evidence drive?

_______________ proves that two sets of data are identical by calculating hash values or using another similar method.​

What option below is an example of a platform specific encryption tool?

The _____________ utility is designed to be installed on Linux distributions, and can be used to analyze a variety of different file systems, while also offering the ability to use plugins.

Match each term with its definition: -An attack that uses a collection of words or phrases that might be passwords for an encrypted file.

What hex value is the standard indicator for jpeg graphics files?​

Reconstructing fragments of files that have been deleted from a suspect drive, is known as ____________ in North America.​

Which of the following is stated within the ISO 27037 standard?​

Match each term with its definition: -?The process of rebuilding data files; one of the required functions of digital forensics tools.

How does a password dictionary attack work?​

What tool below was written for MS-DOS and was commonly used for manual digital investigations?​

In what mode do most write-blockers run??

A keyword search is part of the ​analysis process within what forensic function?

__________ can be platform specific, such as BitLocker, or done with third-party tools, such as Pretty Good Privacy (PGP) ​and GNuPG

Match each term with its definition: -A way to confirm that a tool is functioning as intended; one of the functions of digital forensics tools.?

​Software forensics tools are grouped into command-line applications and GUI applications

Explain the difference between validation and verification.

List three of the six subfunctions that exist under the reconstruction function.​

ISO standard 27037 sta​tes that the most important factors in data acquisition are the DEFR's competency and the use of validated tools.

What two different options are available for write blockers, and how do these options work?​

Understanding the Digital Forensics Profession and Investigations

The Investigators Office and Laboratory

Data Acquisition

Processing Crime and Incident Scenes

Working With Windows and Cli Systems

Macintosh and Linux Boot Processes and File Systems

Recovering Graphics Files

Computer Forensics Analysis and Validation

Virtual Machine and Cloud Forensics

Live Acquisitions and Network Forensics

Email Investigations

Cell Phone and Mobile Device Forensics

Report Writing for High Tech Investigations

Expert Testimony in High Tech Investigations

Ethics for the Investigator and Expert Witness

Filters

_______________ proves that two sets of data are identical by calculating hash values or using another similar method.

What hex value is the standard indicator for jpeg graphics files?

Reconstructing fragments of files that have been deleted from a suspect drive, is known as ____________ in North America.

Which of the following is stated within the ISO 27037 standard?

How does a password dictionary attack work?

What tool below was written for MS-DOS and was commonly used for manual digital investigations?

A keyword search is part of the analysis process within what forensic function?

__________ can be platform specific, such as BitLocker, or done with third-party tools, such as Pretty Good Privacy (PGP) and GNuPG

Software forensics tools are grouped into command-line applications and GUI applications

List three of the six subfunctions that exist under the reconstruction function.

ISO standard 27037 states that the most important factors in data acquisition are the DEFR's competency and the use of validated tools.

What two different options are available for write blockers, and how do these options work?