Deck 24: Forensic Techniques

Question 1

The ____ file is used by the system to assist with virtual memory paging and is quite large.

A)Hiberfil.sys
B)IO.sys
C)Virtfile.sys
D)Pagefile.sys

Answer 1

D

Question 2

Each RP folder contains a set of files that were changed since the last Restore Point.

Answer 2

True

Question 3

A forensic examiner must be familiar with the structure and operation of different file systems and operating systems.

Answer 3

True

Question 4

A ____ of a hard disk is a bit by bit duplicate,including the boot sector,the partition table,all partitions,hidden files,bad sectors,and even the unallocated space on the hard drive.

A)usable copy
B)forensic copy
C)bit copy
D)file copy

Question 5

The printer spool files will have extensions of ____.

A).ips and .ipl
B).spl and .ips
C).spl and .shd
D).spl and .splx

Question 6

The FAT stores files in dynamic chains of ____________________.

Question 7

The ____ file is used when Windows goes into hibernation.

A)Hiberfil.sys
B)Pagefile.sys
C)IO.sys
D)BOOT.INI

Question 8

Information that is transferred to an external device should also have a(n)____ calculated to verify integrity during collection and at a later date.

A)MD5 hash
B)RC4 hash
C)DES hash
D)RSA hash

Question 9

A ____ contains a copy of the Registry that existed at the time the Restore Point was created.

A)snapshot folder
B)registry directory
C)hive folder
D)revert folder

Question 10

____ will search through a file or folder and report on all the ASCII strings it finds.

A)Ascii.exe
B)Strings.exe
C)Names.exe
D)Parse.exe

Question 11

The first thing you want to do before analyzing network traffic is make sure you have permission to look at it.

Question 12

Working with the Registry is easy for the inexperienced user.

Question 13

____ is a very common file system used by computers and is supported by many different operating systems.

A)File Allocation Table
B)File Arrangement Table
C)File Allocation Tree
D)File Attribute Tree

Question 14

The ____________________ is a written record of all interaction with the evidence from the moment it is acquired to the moment it is released.

Question 15

____________________ tools are programs designed to look at specific data structures within the operating system.

Question 16

A network of honeypots is called a(n)____________________.

Question 17

The ____ provides the platform on which computer hardware is managed and made available to the computer software applications.

A)application software
B)network software
C)operating system
D)router software

Question 18

The ____________________ contains items that were recently deleted from a Windows computer system.

Question 19

Using the System Reset tool a Restore Point may be chosen and the system returned back to that point in time.

Question 20

A ____ is a hardware device or software program designed to prevent any write operations from taking place on the original media.

A)read-blocker
B)selective write filter
C)selective filter
D)write-blocker

Question 21

List the skills that you need to become proficient at analyzing malware.

Question 22

List the steps in the incident response process.

Question 23

MATCHING
Match each item with a statement below.
a.Restore Point
d.Slack space
b.CSIRT
e.Honeypot
c.Regular expression
The part of a cluster that is not used when a file is written to it

Question 24

List five laws that have been put into effect to help monitor and control the use of electronic communication systems and computers as well as provide guidelines for prosecution of computer and information-related crimes.

Question 25

MATCHING
Match each item with a statement below.
a.Restore Point
d.Slack space
b.CSIRT
e.Honeypot
c.Regular expression
A computer that is made deliberately vulnerable in order to make it attractive to hackers

Question 26

What is the pre-incident preparation that must take place for a CSIRT?

Question 27

MATCHING
Match each item with a statement below.
a.Restore Point
d.Slack space
b.CSIRT
e.Honeypot
c.Regular expression
A symbolic representation of a family of strings that can be generated from the expression

Question 28

MATCHING
Match each item with a statement below.
a.Restore Point
d.Slack space
b.CSIRT
e.Honeypot
c.Regular expression
A group of individuals at an organization responsible for detecting,investigating,solving,and documenting computer security incidents

Question 29

List UNIX/Linux systems files that are of particular interest to the forensic examiner.

Question 30

MATCHING
Match each item with a statement below.
a.Restore Point
d.Slack space
b.CSIRT
e.Honeypot
c.Regular expression
A snapshot of the state of the system at a point in time