Deck 14: Introduction to Forensics

Question 1

Windows stores information on web address,search queries,and recently opened files in a file called___________.

A)internet.txt
B)index.dat
C)default.dat
D)explore.exe

Answer 1

B

Question 2

Windows stores web browsing information in a file called index.dat.

Answer 2

True

Question 3

netstat is a command you can use with a forensic copy of a machine to compare two files.

Answer 3

False

Question 4

Frequently the first responder to a computer crime is ________.

A)The network administrator
B)A law enforcement officer
C)The news media
D)None of the above

Question 5

Usually,the first thing you do to a computer to prevent further tampering is to _________.

A)Make a backup.
B)Make a copy.
C)Take it offline.
D)Lock it in a secure room.

Question 6

If you fail to handle evidence properly ___________.

A)You may damage the hard drive.
B)It may be unusable in court.
C)Law enforcement may not look at it.
D)None of the above.

Question 7

The Windows command fc lists all active sessions to the computer.

Question 8

Windows logging can be turned on and off with a tool called auditpol.exe.

Question 9

Using Linux to backup your hard drive,if you want to create a hash,you would use the command-line command ___________.

A)cc
B)dd
C)nd
D)md5sum

Question 10

In Linux the command to set up a target forensics server to receive a copy of a drive is dd.

Question 11

_________ can include logs,portable storage,emails,tablets,and cell phones.

A)Computer evidence
B)Ancillary hardware
C)Network devices
D)None of the above

Question 12

You may use Linux to make a ______________ of the hard drive.

A)Bootable copy
B)Screen shot
C)New version
D)Forensically valid copy

Question 13

In Windows,the log that stores events from a single application or component rather than events that might have system wide impact is the ____________ log.

A)Application
B)System
C)Forwardedevents
D)Applications and services

Question 14

Most Windows logs are turned on automatically.

Question 15

The chain of custody accounts for the handling of evidence and documents that handling.

Question 16

The Windows Registry lists USB devices that have been connected to the machine.

Question 17

Frequently the first responder to a computer crime is the network administrator.

Question 18

Documentation of every person who had access to evidence,how they interacted with it,and where it was stored is called the ________________.

A)Forensic trail
B)Chain of custody
C)Audit trail
D)None of the above

Question 19

Using Linux to wipe the target drive,the command-line command would be ___ .

A)cc
B)dd
C)nd
D)md5sum

Question 20

The Windows Registry contains a list of USB devices that have been connected to the machine.

Question 21

In Windows the log that contains events collected from remote computers is the ____________ log.

A)Application
B)System
C)Forwardedevents
D)Applications and services

Question 22

_______ is a free tool that can be used to recover Windows files.

A)SearchIt
B)Disk Digger
C)FileRecover
D)None of the above

Question 23

The Linux log file that can reveal attempts to compromise the system or the presence of a virus or spyware is ______________.

A)/var/log/kern.log
B)/var/log/apache2/*
C)/var/log/lighttpd/*
D)/var/log/apport.log

Question 24

The Linux log file that contains activity related to the web server is ______.

A)/var/log/kern.log
B)/var/log/apache2/*
C)/var/log/lighttpd/*
D)/var/log/apport.log

Question 25

The Windows command to list any shared files that are currently open is ___________.

A)openfiles
B)fc
C)netstat
D)None of the above