Question 1

Match each term with its definition:
-A project sponsored by the National Institute of Standards and Technology to manage research on digital forensics tools?

Accepted Answer

A) acquisition 
B) brute-force attack 
C) Computer Forensics Tool Testing (CFTT) 
D) extraction 
E) keyword search
F)National Software Reference Library (NSRL)
G)password dictionary attack
H)reconstruction
I)validation
J)write-blocker 
A) acquisition 
B) brute-force attack 
C) Computer Forensics Tool Testing (CFTT) 
D) extraction 
E) keyword search
F)National Software Reference Library (NSRL)
G)password dictionary attack
H)reconstruction
I)validation
J)write-blocker

Question 2

Which of the following options is not a subfunction of extraction?​

Accepted Answer

A) ​carving 
B) ​decrypting 
C) logical data copy 
D) bookmarking 
A) ​carving 
B) ​decrypting 
C) logical data copy 
D) bookmarking

Question 3

Match each term with its definition:
-The process of trying every combination of characters--letters, numbers, and special characters typically found on a keyboard-- to find a matching password or passphrase value for an encrypted file?

Accepted Answer

A) acquisition 
B) brute-force attack 
C) Computer Forensics Tool Testing (CFTT) 
D) extraction 
E) keyword search
F)National Software Reference Library (NSRL)
G)password dictionary attack
H)reconstruction
I)validation
J)write-blocker 
A) acquisition 
B) brute-force attack 
C) Computer Forensics Tool Testing (CFTT) 
D) extraction 
E) keyword search
F)National Software Reference Library (NSRL)
G)password dictionary attack
H)reconstruction
I)validation
J)write-blocker

Question 4

What guidelines exist for the selection and use of forensics software? Name at least three.

Accepted Answer

The following guidelines are available f

Question 5

​List the five (5) categories of functions that are meant as guidelines for evaluating digital forensic tools, with subfunctions for refining data analysis and recovery and ensuring data quality.​

Accepted Answer

​The following categories of functions a

Question 6

Match each term with its definition:
-A method of finding files or other information by entering relevant characters, words, or phrases in a search tool?

Accepted Answer

A) acquisition 
B) brute-force attack 
C) Computer Forensics Tool Testing (CFTT) 
D) extraction 
E) keyword search
F)National Software Reference Library (NSRL)
G)password dictionary attack
H)reconstruction
I)validation
J)write-blocker 
A) acquisition 
B) brute-force attack 
C) Computer Forensics Tool Testing (CFTT) 
D) extraction 
E) keyword search
F)National Software Reference Library (NSRL)
G)password dictionary attack
H)reconstruction
I)validation
J)write-blocker

Question 7

In what temporary location below might passwords be stored? ​

Accepted Answer

A) ​​pagefile.sys 
B) ​Windows registry 
C) system32.dll 
D) CD-ROM drive 
A) ​​pagefile.sys 
B) ​Windows registry 
C) system32.dll 
D) CD-ROM drive

Question 8

​What algorithm is used to decompress Windows files?

Accepted Answer

A) ​Shannon-Fano 
B) ​Fibonacci 
C) Lempel-Ziv 
D) Zopfli 
A) ​Shannon-Fano 
B) ​Fibonacci 
C) Lempel-Ziv 
D) Zopfli

Question 9

​Describe two methods for filtering data- separating good data from suspicious data.

Accepted Answer

​
To filter data, you can use hash value

Question 10

Making a logical acquisition of a drive with whole disk encryption can result in unreadable files.​

Accepted Answer

A) True 
 B)False

Question 11

What is the goal of the NSRL project, created by NIST?​

Accepted Answer

A) ​Collect known hash values for commercial software and OS files using MD5 hashes. 
B) ​Collect known hash values for commercial software and OS files using SHA hashes. 
C) Create hash values for illegal files and distribute the information to law enforcement. 
D) Search for collisions in hash values, and contribute to fixing hashing programs. 
A) ​Collect known hash values for commercial software and OS files using MD5 hashes. 
B) ​Collect known hash values for commercial software and OS files using SHA hashes. 
C) Create hash values for illegal files and distribute the information to law enforcement. 
D) Search for collisions in hash values, and contribute to fixing hashing programs.

Question 12

All forensics acquisition tools have a method for verification of the data-copying process that compares the original drive ​with the image.

Accepted Answer

A) True 
 B)False

Question 13

What program serves as the GUI front end for accessing Sleuth Kit's tools?​

Accepted Answer

A) ​KDE 
B) ​DetectiveGUI 
C) Autopsy 
D) SMART 
A) ​KDE 
B) ​DetectiveGUI 
C) Autopsy 
D) SMART

Question 14

Match each term with its definition:
-The process of creating a duplicate image of data; one of the required functions of digital forensics tools?

Accepted Answer

A) acquisition 
B) brute-force attack 
C) Computer Forensics Tool Testing (CFTT) 
D) extraction 
E) keyword search
F)National Software Reference Library (NSRL)
G)password dictionary attack
H)reconstruction
I)validation
J)write-blocker 
A) acquisition 
B) brute-force attack 
C) Computer Forensics Tool Testing (CFTT) 
D) extraction 
E) keyword search
F)National Software Reference Library (NSRL)
G)password dictionary attack
H)reconstruction
I)validation
J)write-blocker

Question 15

Match each term with its definition:
-The process of pulling relevant data from an image and recovering or reconstructing data fragments; one of the required functions of digital forensics tools.?

Accepted Answer

A) acquisition 
B) brute-force attack 
C) Computer Forensics Tool Testing (CFTT) 
D) extraction 
E) keyword search
F)National Software Reference Library (NSRL)
G)password dictionary attack
H)reconstruction
I)validation
J)write-blocker 
A) acquisition 
B) brute-force attack 
C) Computer Forensics Tool Testing (CFTT) 
D) extraction 
E) keyword search
F)National Software Reference Library (NSRL)
G)password dictionary attack
H)reconstruction
I)validation
J)write-blocker

Question 16

Passwords are typically stored as one-way _____________ rather than in plaintext.​

Accepted Answer

A) ​variables 
B) ​hex values 
C) hashes 
D) slack spaces 
A) ​variables 
B) ​hex values 
C) hashes 
D) slack spaces

Question 17

The purpose of having a ______________ function in a forensics tool is to re-create a suspect drive to show what happened during a crime or incident.​

Accepted Answer

The answer of The purpose of having a ______________ function...

Question 18

Match each term with its definition:
-A NIST project with the goal of collecting all known hash values for commercial software and OS files?

Accepted Answer

A) acquisition 
B) brute-force attack 
C) Computer Forensics Tool Testing (CFTT) 
D) extraction 
E) keyword search
F)National Software Reference Library (NSRL)
G)password dictionary attack
H)reconstruction
I)validation
J)write-blocker 
A) acquisition 
B) brute-force attack 
C) Computer Forensics Tool Testing (CFTT) 
D) extraction 
E) keyword search
F)National Software Reference Library (NSRL)
G)password dictionary attack
H)reconstruction
I)validation
J)write-blocker

Question 19

In general, what would a lightweight forensics workstation consist of?​

Accepted Answer

A) ​A tower with several bays and many peripheral devices 
B) ​A laptop computer with almost as many bays and peripherals as a tower 
C) A laptop computer built into a carrying case with a small selection of peripheral options 
D) A tablet with peripherals and forensics apps 
A) ​A tower with several bays and many peripheral devices 
B) ​A laptop computer with almost as many bays and peripherals as a tower 
C) A laptop computer built into a carrying case with a small selection of peripheral options 
D) A tablet with peripherals and forensics apps

Question 20

Name at least four subfunctions of the extraction function that are used in forensics investigations.

Accepted Answer

​
The following subfunctions o

Match each term with its definition: -A project sponsored by the National Institute of Standards and Technology to manage research on digital forensics tools?

Which of the following options is not a subfunction of extraction?

Match each term with its definition: -The process of trying every combination of characters--letters, numbers, and special characters typically found on a keyboard-- to find a matching password or passphrase value for an encrypted file?

What guidelines exist for the selection and use of forensics software? Name at least three.

List the five (5) categories of functions that are meant as guidelines for evaluating digital forensic tools, with subfunctions for refining data analysis and recovery and ensuring data quality.

Match each term with its definition: -A method of finding files or other information by entering relevant characters, words, or phrases in a search tool?

In what temporary location below might passwords be stored?

What algorithm is used to decompress Windows files?

Describe two methods for filtering data- separating good data from suspicious data.

Making a logical acquisition of a drive with whole disk encryption can result in unreadable files.

What is the goal of the NSRL project, created by NIST?

All forensics acquisition tools have a method for verification of the data-copying process that compares the original drive with the image.

What program serves as the GUI front end for accessing Sleuth Kit's tools?

Match each term with its definition: -The process of creating a duplicate image of data; one of the required functions of digital forensics tools?

Match each term with its definition: -The process of pulling relevant data from an image and recovering or reconstructing data fragments; one of the required functions of digital forensics tools.?

Passwords are typically stored as one-way _____________ rather than in plaintext.

The purpose of having a ______________ function in a forensics tool is to re-create a suspect drive to show what happened during a crime or incident.

Match each term with its definition: -A NIST project with the goal of collecting all known hash values for commercial software and OS files?

In general, what would a lightweight forensics workstation consist of?

Name at least four subfunctions of the extraction function that are used in forensics investigations.

Understanding the Digital Forensics Profession and Investigations

The Investigators Office and Laboratory

Data Acquisition

Processing Crime and Incident Scenes

Working With Windows and Cli Systems

Macintosh and Linux Boot Processes and File Systems

Recovering Graphics Files

Computer Forensics Analysis and Validation

Virtual Machine and Cloud Forensics

Live Acquisitions and Network Forensics

Email Investigations

Cell Phone and Mobile Device Forensics

Report Writing for High Tech Investigations

Expert Testimony in High Tech Investigations

Ethics for the Investigator and Expert Witness

Filters

Exam 6: Current Computer Forensics Tools

Match each term with its definition: -A project sponsored by the National Institute of Standards and Technology to manage research on digital forensics tools?

Which of the following options is not a subfunction of extraction?​

Match each term with its definition: -The process of trying every combination of characters--letters, numbers, and special characters typically found on a keyboard-- to find a matching password or passphrase value for an encrypted file?

What guidelines exist for the selection and use of forensics software? Name at least three.

​List the five (5) categories of functions that are meant as guidelines for evaluating digital forensic tools, with subfunctions for refining data analysis and recovery and ensuring data quality.​

Match each term with its definition: -A method of finding files or other information by entering relevant characters, words, or phrases in a search tool?

In what temporary location below might passwords be stored? ​

​What algorithm is used to decompress Windows files?

​Describe two methods for filtering data- separating good data from suspicious data.

Making a logical acquisition of a drive with whole disk encryption can result in unreadable files.​

What is the goal of the NSRL project, created by NIST?​

All forensics acquisition tools have a method for verification of the data-copying process that compares the original drive ​with the image.

What program serves as the GUI front end for accessing Sleuth Kit's tools?​

Match each term with its definition: -The process of creating a duplicate image of data; one of the required functions of digital forensics tools?

Match each term with its definition: -The process of pulling relevant data from an image and recovering or reconstructing data fragments; one of the required functions of digital forensics tools.?

Passwords are typically stored as one-way _____________ rather than in plaintext.​

The purpose of having a ______________ function in a forensics tool is to re-create a suspect drive to show what happened during a crime or incident.​

Match each term with its definition: -A NIST project with the goal of collecting all known hash values for commercial software and OS files?

In general, what would a lightweight forensics workstation consist of?​

Name at least four subfunctions of the extraction function that are used in forensics investigations.

Understanding the Digital Forensics Profession and Investigations

The Investigators Office and Laboratory

Data Acquisition

Processing Crime and Incident Scenes

Working With Windows and Cli Systems

Macintosh and Linux Boot Processes and File Systems

Recovering Graphics Files

Computer Forensics Analysis and Validation

Virtual Machine and Cloud Forensics

Live Acquisitions and Network Forensics

Email Investigations

Cell Phone and Mobile Device Forensics

Report Writing for High Tech Investigations

Expert Testimony in High Tech Investigations

Ethics for the Investigator and Expert Witness

Filters

Which of the following options is not a subfunction of extraction?

List the five (5) categories of functions that are meant as guidelines for evaluating digital forensic tools, with subfunctions for refining data analysis and recovery and ensuring data quality.

In what temporary location below might passwords be stored?

What algorithm is used to decompress Windows files?

Describe two methods for filtering data- separating good data from suspicious data.

Making a logical acquisition of a drive with whole disk encryption can result in unreadable files.

What is the goal of the NSRL project, created by NIST?

All forensics acquisition tools have a method for verification of the data-copying process that compares the original drive with the image.

What program serves as the GUI front end for accessing Sleuth Kit's tools?

Passwords are typically stored as one-way _____________ rather than in plaintext.

The purpose of having a ______________ function in a forensics tool is to re-create a suspect drive to show what happened during a crime or incident.

In general, what would a lightweight forensics workstation consist of?