Question 1

Describe with examples why the approach you take for a forensics case depends largely on the specific type of case you're investigating.

Accepted Answer

The answer of Describe with examples why the approach you...

Question 2

Many commercial encryption programs use a technology called ____, which is designed to recover encrypted data if users forget their passphrases or if the user key is corrupted after a system data failure.

Accepted Answer

A)  steganography 
B)  key escrow 
C)  password backup 
D)  key splitting

Question 3

In FTK ____ search mode, you can also look for files that were accessed or changed during a certain time period.

Accepted Answer

A)  live 
B)  indexed 
C)  active 
D)  inline

Question 4

The term ____ comes from the Greek word for"hidden writing."

Accepted Answer

A)  creep 
B)  steganography 
C)  escrow 
D)  hashing

Question 5

To generate reports with the FTK ReportWizard, first you need to ____________________ files during an examination.

Accepted Answer

The answer of To generate reports with the FTK ReportWizard,...

Question 6

Briefly describe how to use steganography for creating digital watermarks.

Accepted Answer

The answer of Briefly describe how to use steganography for...

Question 7

How should you approach a case in which an employee is suspected of industrial espionage?

Accepted Answer

The answer of How should you approach a case in...

Question 8

The ____ search feature allows you to look for words with extensions such as "ing,""ed," and so forth.

Accepted Answer

A)  fuzzy 
B)  stemming 
C)  permutation 
D)  similar-sounding

Question 9

Match each item with a statement below:
-program used to clean all data from the target drive you plan to use

Accepted Answer

A) Court orders for discovery 
B) Investigation plan 
C) Digital Intelligence PDWipe 
D) Live search 
E) Cabinet
F)PRTK
G)Validating digital evidence
H)MD5
I)System Commander

Question 10

There are ____ searching options for keywords which FTK offers.

Accepted Answer

A)  2 
B)  3 
C)  4 
D)  5

Question 11

Match each item with a statement below:
-a disk-partitioning utility

Accepted Answer

A) Court orders for discovery 
B) Investigation plan 
C) Digital Intelligence PDWipe 
D) Live search 
E) Cabinet
F)PRTK
G)Validating digital evidence
H)MD5
I)System Commander

Question 12

In civil and criminal cases, the scope is often defined by search warrants or ____, which specify what data you can recover.

Accepted Answer

A)  risk assessment reports 
B)  investigation plans 
C)  scope creeps 
D)  subpoenas

Question 13

The data-hiding technique ____________________ changes data from readable code to data that looks like binary executable code.

Accepted Answer

The answer of The data-hiding technique ____________________ changes data from...

Question 14

What are the file systems supported by FTK for forensic analysis?

Accepted Answer

The answer of What are the file systems supported by...

Question 15

What are the basic guidelines to identify steganography files?

Accepted Answer

The answer of What are the basic guidelines to identify...

Question 16

FTK cannot perform forensics analysis on FAT12 file systems.

Accepted Answer

A) True 
 B)False

Question 17

____ attacks use every possible letter, number, and character found on a keyboard when cracking a password.

Accepted Answer

A)  Brute-force 
B)  Dictionary 
C)  Profile 
D)  Statistics

Question 18

Match each item with a statement below:
-an FTK searching option

Accepted Answer

A) Court orders for discovery 
B) Investigation plan 
C) Digital Intelligence PDWipe 
D) Live search 
E) Cabinet
F)PRTK
G)Validating digital evidence
H)MD5
I)System Commander

Question 19

____ is a remote access program for communication between two computers. The connection is established by using the DiskExplorer program (FAT or NTFS) corresponding to the suspect (remote) computer's file system.

Accepted Answer

A)  HDHOST 
B)  DiskHost 
C)  DiskEdit 
D)  HostEditor

Question 20

AccessData ____ compares known file hash values to files on your evidence drive or image files to see whether they contain suspicious data.

Accepted Answer

A)  KFF 
B)  PKFT 
C)  NTI 
D)  NSRL

Exam 9: Computer Forensics Analysis and Validation

Describe with examples why the approach you take for a forensics case depends largely on the specific type of case you're investigating.

Many commercial encryption programs use a technology called ____, which is designed to recover encrypted data if users forget their passphrases or if the user key is corrupted after a system data failure.

In FTK ____ search mode, you can also look for files that were accessed or changed during a certain time period.

The term ____ comes from the Greek word for"hidden writing."

To generate reports with the FTK ReportWizard, first you need to ____________________ files during an examination.

Briefly describe how to use steganography for creating digital watermarks.

How should you approach a case in which an employee is suspected of industrial espionage?

The ____ search feature allows you to look for words with extensions such as "ing,""ed," and so forth.

Match each item with a statement below: -program used to clean all data from the target drive you plan to use

There are ____ searching options for keywords which FTK offers.

Match each item with a statement below: -a disk-partitioning utility

In civil and criminal cases, the scope is often defined by search warrants or ____, which specify what data you can recover.

The data-hiding technique ____________________ changes data from readable code to data that looks like binary executable code.

What are the file systems supported by FTK for forensic analysis?

What are the basic guidelines to identify steganography files?

FTK cannot perform forensics analysis on FAT12 file systems.

____ attacks use every possible letter, number, and character found on a keyboard when cracking a password.

Match each item with a statement below: -an FTK searching option

____ is a remote access program for communication between two computers. The connection is established by using the DiskExplorer program (FAT or NTFS) corresponding to the suspect (remote) computer's file system.

AccessData ____ compares known file hash values to files on your evidence drive or image files to see whether they contain suspicious data.