Deck 3: Tools, Environments, Equipment, and Certifications

Question 1

If you need to remove a password from files,you could use a program such as

A)Jack the Cracker
B)WinHex
C)MacQuisition
D)John the Ripper

Answer 1

D

Question 2

Preserving e-evidence and good ________ of steps taken during the investigation are essential for success in computer crime cases.

Answer 2

documentation

Question 3

Under no circumstances should you attempt to create a forensically clean drive by simply ________ the drive.

Answer 3

formatting

Question 4

A defensible approach is an objective and unbiased approach that

A)Is performed in accordance with forensic science principles
B)Is conducted with verified tools
C)Is documented thoroughly
D)All the above

Question 5

The current best approach to powering down a suspect PC is to

A)Simply power it down using the operating system
B)Keep it running on an UPS
C)Don't power it down
D)Pull the power plug

Question 6

Documentation of the evidence can include which of the following?

A)Name of the suspect's supervisor
B)Status of the computer
C)Name of the investigating officer
D)All the above

Question 7

Which of the following tasks should be performed to maximize search results?

A)Confirm the objective of the investigation.
B)Identify relevant time periods.
C)Identify relevant types of data.
D)All are correct.

Question 8

Which of the following is the preferred way to make a forensic copy?

A)Create a mirror image.
B)Produce a sector-by-sector copy.
C)Copy residual data only.
D)Make a back-up tape image.

Question 9

If volatile data must be acquired,you may need to do your analysis in a(n)

A)Trusted environment
B)Postmortem environment
C)Untrusted environment
D)Dead environment

Question 10

Which of the following does NOT affect the choice of forensic tool(s)for a case?

A)The operating system
B)State of the data
C)Availability of an expert witness
D)Domestic and international laws

Question 11

To protect original data from any alteration,you

A)Use gloves when working with the hard drive
B)Make a forensic copy of the original data
C)Do your forensic work as quickly as possible
D)Use the operating system to copy all relevant files

Question 12

Which factor(s)determine the type of tools needed for an analysis?

A)The environment
B)The power sources available where the analysis will be done
C)The make of the equipment to be analyzed
D)None of the above

Question 13

________ data is data that has been deleted but not erased.

Question 14

When you forensically wipe a hard drive,you

A)Write over all areas of the disk with a single character
B)Reformat the hard drive using standard disk utilities
C)Delete all active data from the hard drive
D)Use a forensic tool to physically clean the hard drive

Question 15

When a copy is made,the contents of a hard drive are stored as a series of compressed ________ files.

Question 16

The first step in analyzing data is to _________ it.

Question 17

Which of the following tools is designed for use with Linux systems?

A)BlackBag
B)WinHex
C)Autopsy
D)PDA Seizure

Question 18

A forensics lab should have all of the following applications on hand EXCEPT

A)Microsoft Office versions
B)ClarisWorks
C)Peachtree Accounting
D)Visual Basic

Question 19

Encase softwarecan be used for all e-mail investigations EXCEPT which of the following?

A)GoogleMail
B)Hotmail
C)Outlook
D)AOL

Question 20

Data may be hidden by all of the following methods EXCEPT

A)Using special characters in the actual name
B)Renaming to a common name used by the operating system
C)Encrypting the file
D)Password-protecting the file

Question 21

You may need to do a(n)________ analysis during a hacker attack or other intrusion.

Question 22

A(n)________ can cause MD5 hashes to be different if different tools are used to acquire a disk image.

Question 23

________,from Paraben Forensics,is a comprehensive tool for investigating the contents of Palm Pocket PCs that run on Windows CE.

Question 24

________ is another name for the security key you need to access a system when using EnCase.

Question 25

A computer forensic specialist may examine the ________ to ascertain the true identity of a file.

Question 26

A forensics lab is typically considered to be a(n)________ environment.

Question 27

One ________ can be saved on numerous servers and be forwarded to a person unknown to its author.

Question 28

A drive image is "fingerprinted" using an encryption technique called ________.

Question 29

________ data can include spreadsheets,databases,and word processing files.

Question 30

A dead analysis is also referred to as a(n)________ analysis.