Deck 24: Forensic Techniques

Question 1

The ____________________ is a written record of all interaction with the evidence from the moment it is acquired to the moment it is released.

Answer 1

chain of custody

Question 2

____________________ tools are programs designed to look at specific data structures within the operating system.

Answer 2

Data collection

Question 3

The ____ file is used by the system to assist with virtual memory paging and is quite large.

A) Hiberfil.sys
B) IO.sys
C) Virtfile.sys
D) Pagefile.sys

Answer 3

D

Question 4

____ will search through a file or folder and report on all the ASCII strings it finds.

A) Ascii.exe
B) Strings.exe
C) Names.exe
D) Parse.exe

Question 5

Each RP folder contains a set of files that were changed since the last Restore Point.

Question 6

A forensic examiner must be familiar with the structure and operation of different file systems and operating systems.

Question 7

____ is a very common file system used by computers and is supported by many different operating systems.

A) File Allocation Table
B) File Arrangement Table
C) File Allocation Tree
D) File Attribute Tree

Question 8

The first thing you want to do before analyzing network traffic is make sure you have permission to look at it.

Question 9

A ____ is a hardware device or software program designed to prevent any write operations from taking place on the original media.

A) read-blocker
B) selective write filter
C) selective filter
D) write-blocker

Question 10

A ____ contains a copy of the Registry that existed at the time the Restore Point was created.

A) snapshot folder
B) registry directory
C) hive folder
D) revert folder

Question 11

A ____ of a hard disk is a bit by bit duplicate, including the boot sector, the partition table, all partitions, hidden files, bad sectors, and even the unallocated space on the hard drive.

A) usable copy
B) forensic copy
C) bit copy
D) file copy

Question 12

A network of honeypots is called a(n) ____________________.

Question 13

Working with the Registry is easy for the inexperienced user.

Question 14

Using the System Reset tool a Restore Point may be chosen and the system returned back to that point in time.

Question 15

Information that is transferred to an external device should also have a(n) ____ calculated to verify integrity during collection and at a later date.

A) MD5 hash
B) RC4 hash
C) DES hash
D) RSA hash

Question 16

The ____ file is used when Windows goes into hibernation.

A) Hiberfil.sys
B) Pagefile.sys
C) IO.sys
D) BOOT.INI

Question 17

The FAT stores files in dynamic chains of ____________________.

Question 18

The ____________________ contains items that were recently deleted from a Windows computer system.

Question 19

The ____ provides the platform on which computer hardware is managed and made available to the computer software applications.

A) application software
B) network software
C) operating system
D) router software

Question 20

The printer spool files will have extensions of ____.

A) .ips and .ipl
B) .spl and .ips
C) .spl and .shd
D) .spl and .splx

Question 21

List the skills that you need to become proficient at analyzing malware.

Question 23

What is the pre-incident preparation that must take place for a CSIRT?

Question 24

List five laws that have been put into effect to help monitor and control the use of electronic communication systems and computers as well as provide guidelines for prosecution of computer and information-related crimes.

Question 25

List UNIX/Linux systems files that are of particular interest to the forensic examiner.

Question 26

List the steps in the incident response process.