Deck 18: Digital Evidence on Unix Systems

Question 1

In a block group, file data is located in___________ .

A) The block bitmap
B) Data blocks
C) Inode bitmap
D) Directory entry

Answer 1

Data blocks

Question 2

The file system mount table shows local and remote file systems that are automatically mounted when the system is booted. This information is stored in:

A) /etc/fstab
B) /etc/mount/mtab
C) /etc/hosts
D) None of the above

Answer 2

A

Question 3

FireFox 3 stores potentially notable information in:

A) DBF format databases
B) ASCII text files
C) SQLite databases
D) Proprietary format files

Answer 3

C

Question 4

One of the difficulties in examining UNIX systems is that the file system is extremely complex, making it difficult for the examiner to recover data.

Question 5

When a file is deleted on a UNIX System, the ctime of its parent directory is:

A) Unchanged
B) Updated
C) Set to epoch time
D) Set to last modified date-time

Question 6

Why is it important to determine the level of network connectivity on a UNIX system as soon as possible?

A) As UNIX Systems may be configured to store critical evidence on remote systems, network connections must be determined and exploited before any evidence stored remotely is destroyed.
B) To keep suspects and spectators from accessing the target system during the investigation.
C) To determine if the system administrator is a suspect.
D) None of the above.

Question 7

Unlike the standard DOS/Windows environments, the UNIX environment has the capability of_________ , thereby preventing the contents of evidentiary media from being changed.

A) Encrypting all data on the media
B) Copying the contents of the media
C) Warning the examiner of an impending write
D) Mounting storage media as Read-Only

Question 8

The UNIX convention of "piping" the results of one command into another is a serious limitation and is detrimental to using the UNIX platform for forensic examinations.

Question 9

The inode table can be found in the ___________.

A) Block group
B) Superblock table
C) MBR
D) Partition table

Question 10

Most data-carving tools operate on the assumption that the operating system generally tries to save data in contiguous sectors.

Question 11

MAC times, which are found in the___________ , are an example of file system traces.

A) Inode table
B) MBR's partition table
C) Inode bitmap
D) Data blocks

Question 12

What is the most efficient method for a forensic examiner to confirm whether a particular tool or methodology works in a forensically acceptable manner?

A) Search the Internet for accounts of other examiners using the tool or methodology
B) Contact the author of the tool or methodology and have them provide confirmation
C) Test the tool under controlled conditions
D) Contact other forensic examiners to determine if they have any experience with the tool or methodology

Question 13

One of the most common web browsers on UNIX systems is:

A) Internet Explorer
B) Safari
C) Opera
D) FireFox

Question 14

grep is a standard Linux tool that searches a specified file or region for a specified string.

Question 15

On UNIX systems that receive e-mail, incoming messages are held in , in separate files for each user account until a user accesses them.

A) /home//desktop/mail
B) /var/spool/mqueue/mail
C) /etc/mailbox/mail
D) None of the above

Question 16

The Coroner's Toolkit and The Sleuth Kit are examples of open source___________ .

A) Hard drive repair tools
B) System administrator tools
C) Forensic examination tools
D) Network management tools

Question 17

In UNIX, when a file is moved within a volume, the inode change date-time (ctime) is:

A) Unchanged
B) Updated
C) Set to epoch time
D) Set to last modified date-time

Question 18

___________, which is part of the standard Linux distribution, can be used to make a bitstream copy of evidentiary media to either image files or sterile media.

A) grep
B) icat
C) dd
D) sha1sum

Question 19

One of the most useful areas to search for notable data on a Linux system is in file slack.

Question 20

Deleting a file has the effect of preserving its inode until it is reused because:

A) The inode is flagged as deleted.
B) The inode table entry is moved to the recycle bin.
C) Deleted inodes are not accessible to the file system.
D) The inode number is added to a deleted files journal entry.

Question 21

The mainstay of acquiring digital evidence using UNIX is the "icopy" command.

Question 22

As UNIX was never designed to work on networks, there are very few native utilities designed to access the Internet.

Question 23

When examining a UNIX system, searching for network traces is not usually necessary.

Question 24

When requesting a search warrant, remotely connected systems cannot be considered part of the target system, so it may be necessary to obtain proper authorization before examining them.

Question 25

On UNIX systems, e-mails and all attachments are stored as plaintext in
"/var/spool/mail," or "/var/mail," or in a directory under the user's account.

Question 26

A list of currently mounted drives, including those not listed in the file system mount table, is kept in "/etc/mtab."

Question 27

Given a sufficiently powerful computer, even "strong" encryption can be broken in a short time.

Question 28

UNIX log files (or those of any operating system, for that matter) can provide a great deal of useful information to the examiner.

Question 29

The "istat" command, found in The Coroner's Toolkit, can be used to examine specific inode bitmaps.

Question 30

When a target system is connected to other systems in remote locations, it is expedient for the digital investigator to access these systems via remote access.