Deck 12: Processing of Evidence and Report Preparation

Question 1

How long should the CMOS battery be kept disconnected for the memory to be lost?

A) 24 hours
B) 12 hours
C) 6 hours
D) 30 minutes

Answer 1

A

Question 2

Which of the following makes digital forensics a science?

A) Its processes are repeatable and proven.
B) It analyzes various computer programs in order to arrive at assumptions.
C) It follows a universal, standard procedure.
D) It is a universally accepted discipline in universities.

Answer 2

A

Question 3

Which of the following defines artifacts?

A) temporary data files that were created by applications
B) data files that pertain to or were created by an individual user
C) system-generated files that are created for operational purposes
D) files that pertain to Internet history and e-mail

Answer 3

C

Question 4

Why should the imaging of drives always be initiated by booting the suspect drive from a previously verified forensic floppy?

A) New floppy drives bear the danger of being virus carriers.
B) A previously verified forensic floppy can detect anomalies in the drive faster.
C) Some users will configure their system to erase/modify data if third-party access is determined.
D) The verified forensic floppy can disable the write-blocking program found on most original media.

Question 5

Which of the following can NOT be categorized as file viewer software?

A) Conversions Plus
B) CompuPic
C) DiskEdit
D) Thumbs Plus

Question 6

________ are designed to be the first line of defense for users, thus preventing individuals from booting the computer's operating system.

A) Software passwords
B) BIOS passwords
C) CMOS passwords
D) Document passwords

Question 7

What is the minimum number of imaging programs that any forensic labs should be equipped with?

A) two
B) three
C) four
D) one

Question 8

Which rule remains unchanged in every computer investigation?

A) encrypt all notes
B) search every single file
C) pull the battery
D) document

Question 9

Testing forensic software at the extremes and becoming familiar with its capabilities is ________.

A) unnecessary if manufacturers provide documentation
B) a way to validate the forensic software
C) not recommended due to the danger of acquiring viruses
D) more common among computer criminals than investigators

Question 10

According to popular science Web sites, the scientific process of digital forensics normally starts with a(n) ________.

A) experiment
B) question
C) probable answer
D) possible solution

Question 11

________ is a mechanism that prevents the destruction, contamination, or corruption of original media and that can be accomplished with many of the popular imaging programs, disk management software, or simple DOS commands.

A) Jumping
B) AUTOEXEC.BAT
C) CONFIG.SYS
D) Write-blocking

Question 12

Which of the following is the most time-consuming method of circumventing CMOS passwords?

A) key disks
B) default passwords
C) social engineering
D) jumping

Question 13

Which of the following refers to a category of software that allows users to effectively hide the content of selected files?

A) steganography
B) key discs
C) VFS
D) artifacts

Question 14

What does "establish forensically sterile conditions" mean in the context of computer-crime investigation?

A) Maintain secrecy about the developments at the forensic lab.
B) Ensure that the members of the staff have no criminal history.
C) Keep the room for forensic tests clean and hygienic.
D) Use new media that have been forensically wiped.

Question 15

What would enable investigators to establish a step-by-step preliminary investigative process which runs programs in a specified order?

A) CONFIG.SYS files
B) batch files
C) AUTOEXEC.BAT files
D) compressed files

Question 16

Which of the following is NOT an advantage of the creation of images on forensic machines?

A) revealing any passwords used in operating systems
B) preserving the integrity of the original image
C) preventing data contamination
D) establishing the veracity of subsequent analysis

Question 17

According to the Association of Chief Police Officers, which of the following is NOT a part of computer forensics?

A) collection of computer-related evidence
B) publication of computer-related evidence
C) preservation of computer-related evidence
D) analysis of computer-related evidence

Question 18

In which of the following techniques do the investigators try to develop a profile of the suspect or the suspect computer and manually attempt password cracking?

A) program specific cracking
B) social engineering
C) short-circuiting the chip
D) verification of image

Question 19

Which of the following programs can be employed by an investigating officer to counter alteration of file extensions?

A) Simple 6.0
B) BIOSTAR
C) DiskEdit
D) Mareswares HexDump

Question 20

________, located either by the BIOS or elsewhere on the motherboard, are utilized to bypass protections found in the CMOS.

A) Artifacts
B) Key disks
C) Steganographic containers
D) Jumpers

Question 21

Disk editors list all files on the suspect drive after the recovery of erased, deleted, hidden, and compressed files.

Question 22

Licenses for forensic software that is expected to be employed in the analysis of suspect media are not required.

Question 23

The Net Section of an IP address may be used to identify the individual computer.

Question 24

Short-circuiting the chip often involves short-circuiting two pins of the BIOS chip for a few seconds.

Question 25

Investigators validate forensic software to be used by testing the software at the extremes and being familiarized with its capabilities.

Question 26

Unlike other types of passwords which may be defeated using traditional password cracking software, CMOS passwords often require hardware manipulation on the part of the investigator.

Question 27

According to popular science Web sites, the process of digital forensics normally starts with a hypothesis that forms into a question.

Question 28

In a suspect Linux/Unix machine, the /etc/passwd file contains all the following EXCEPT ________.

A) account ID
B) home directory
C) local domain name system entries
D) login shell

Question 29

Batch files provide a platform of consistency that validates their procedures to the court.

Question 30

The MAC address is a binary number made up of four octets or 32 bits.

Question 31

Traceroute is a tool designed to trace the path a packet takes upon traveling from one device to another.

Question 32

Program files are software applications that are installed in the computer.

Question 33

Jumping the CMOS involves the manipulation of software in which the password is cleared after the jumper has been reset.

Question 34

In the context of computer forensics, which of the following is NOT required as minimum documentation?

A) physical description of media
B) time, date, and place of analysis
C) methodology employed
D) a list of standardized defaults for password location

Question 35

Whois is a tool which can query a database that includes domain names, IP addresses, and points of contact.

Question 36

Which of the following is the unique identifier assigned to network interfaces for communications on the physical network segment?

A) DNS
B) MAC Address
C) Traceroute
D) IP address

Question 37

Which of the following is a tool that can query a database that includes domain names, IP addresses, and points of contact, including names, postal addresses, and telephone numbers?

A) whois
B) ARIN
C) Back Orifice
D) RIPE

Question 38

UFED is a stand-alone self-contained system that provides data extraction of content stored in mobile phones.

Question 39

Which of the following is NOT a cell phone forensics software?

A) Device Seizure
B) UFED
C) XRY Complete
D) Grep

Question 40

Linux systems are different in that they are characterized by a unified file system on three partitions: root, boot, and swap.

Question 41

In its most basic form, ________ refers to the process of converting a message from its original form ("plaintext") into an indecipherable or scrambled form ("ciphertext").

Question 42

Which are the most common places in a suspect computer where traces of evidence from Internet activity can be found?

Question 43

Investigators should validate any forensic software to be used by testing it at the ________ and familiarizing themselves with its capabilities.

Question 44

The ________ for a computer is the unique identifier assigned to network interfaces for communications on the physical network segment.

Question 45

Steganographic messages have two parts: the container, which is the file that conceals data, and the ________, which is the actual data.

Question 46

On Windows systems, ________ are system-generated files created for operational purposes.

Question 47

Briefly discuss some basic strategies for circumventing CMOS passwords.

Question 48

Some computers allow a BIOS bypass by inserting a ________ in the floppy disk drive while booting.

Question 49

________ is a software application designed for Windows-based systems which provides extraction and analysis tools for a multitude of devices, including smartphones and tablets.

Question 50

When investigators pull the CMOS battery to circumvent a password, the battery should be disconnected for at least ________ hours.

Question 51

The most time-consuming and exasperating method of circumventing CMOS passwords involves the use of ________.

Question 52

________ the CMOS involves the manipulation of hardware in which the password is cleared after the jumper has been reset.

Question 53

All media used in the analysis of computer evidence must be forensically ________ for courtroom purposes.

Question 54

________ contains the precise location of the satellite and the locations of all other satellites in the system.

Question 55

The most important aspect of data analysis is ________.

Question 56

________ may be created to incorporate all of the forensic software employed, including write-blocking, imaging and verification, disk management, and virus scan.

Question 57

In a rare case where investigators cannot remove a suspect drive, they may be confounded by the presence of a ________.

Question 58

Discuss forensic investigation in non-Window operating systems.

Question 59

What are the areas that should be documented in a forensic investigation? What, in your opinion, makes documentation the most important aspect of forensic science?

Question 60

Discuss some of the ways to recover passwords.Why do you think they are important to forensic investigation?