Question 1

Match the following terms with the correct definitions below:?
-?A technology designed to recover encrypted data if users forget their passphrases or if the user key is corrupted after a system failure.

Accepted Answer

Key-escrow is a technology designed to allow the recovery of encrypted data in situations where users might forget their passphrases or if there is a corruption of the user key after a system failure. This ensures that there is a way to access the data without the original key, by keeping a copy of the key in a secure location (the escrow).

Question 2

The AccessData program has a hashing database, ________________, which is available only with FTK, and can be used to filter known program files from view and contains the hash values of known illegal files.​

Accepted Answer

The hashing database in question contains the hash values of known illegal files, and it is only available with FTK. The other options (A, B, D) do not fit this description.

Question 3

In ________ investigations, evidence​ collection tends to be fairly easy and straightforward because investigators usually have ready access to the necessary records and files.

Accepted Answer

The answer of In ________ investigations, evidence​ collection tends to...

Question 4

Match the following terms with the correct definitions below:?
-?The pnrocess of shifting one or more digits in a binary number to the left or right to produce a different value.

Accepted Answer

Bit-shifting is the process of moving bits to the left or right within a binary number, effectively multiplying or dividing the number by two for each shift, respectively.

Question 5

Match the following terms with the correct definitions below:?
-?The result of an investigation expanding beyond its original description because the discovery of unexpected evidence increases the amount of work required.

Accepted Answer

Scope creep refers to the situation where the scope of a project or investigation expands beyond its initially defined parameters, often due to the discovery of new information or requirements as work progresses. This can lead to increased workloads and resources needed to complete the project.

Question 6

In addition to steganography, _____________________ was developed as a way to protect file ownership.​

Accepted Answer

The answer of In addition to steganography, _____________________ was developed...

Question 7

Match the following terms with the correct definitions below:?
-?In steganalysis, the original file with no hidden message.

Accepted Answer

Cover-media refers to the original file or message in steganography that has no hidden data within it. This is the file that will be used as the base for hiding information through steganographic techniques.

Question 8

​Examining and analyzing digital evidence depend on the nature of the investigation and the amount of data to process. Criminal investigations are limited to ﬁnding data deﬁned in the search warrant, and _____ investigations are often limited by court orders for discovery.

Accepted Answer

The answer of ​Examining and analyzing digital evidence depend on...

Question 9

What format below is used for VMware images?

Accepted Answer

VMware images are typically stored in the .vmdk format, which stands for Virtual Machine Disk.

Question 10

Match the following terms with the correct definitions below:?
-?In steganalysis, the file containing the hidden message.

Accepted Answer

Stego-media refers to the file or media that contains the hidden message or data in the context of steganography. Steganalysis is the analysis of these files to detect the presence of hidden information.

Question 11

Match the following terms with the correct definitions below:?
-?A cryptographic technique for embedding information in another file for the purpose of hiding the information from casual observers.

Accepted Answer

Steganography is the practice of concealing a file, message, image, or video within another file, message, image, or video. The goal is to hide the existence of the embedded data, making it undetectable to casual observers.

Question 12

Match the following terms with the correct definitions below:?
-?The process of hashing all sectors of a file and then comparing them with sectors on a suspect's disk drive to determine whether there are any remnants of the original file that couldn't be recovered.

Accepted Answer

Block-wise hashing is the process described, where individual sectors of a file are hashed and compared to sectors on a disk to find remnants of the original file.

Question 13

Which of the following file systems can't be analyzed by OSForensics?

Accepted Answer

OSForensics supports a wide range of file systems for analysis, including FAT12, Ext2fs, and HFS+. However, it does not support the XFS file system, making it the correct choice for a file system that can't be analyzed by OSForensics.

Question 14

In ProDiscover and other digital forensics tools, raw format image files (.dd extension) don't contain ________, so you must validate them manually to ensure the integrity of data.​

Accepted Answer

The answer of In ProDiscover and other digital forensics tools,...

Question 15

Match the following terms with the correct definitions below:?
-?Adding bits to a password before it's hashed so that a rainbow table can't find a matching hash value to decifer the password.

Accepted Answer

Salting passwords involves adding random data (bits) to a password before hashing it. This technique prevents attackers from using precomputed tables (rainbow tables) to crack the hash, as the salt ensures each password hash is unique, even if the original passwords are the same.

Question 16

The term ​_____________ comes from the Greek word for "hidden writing".

Accepted Answer

The answer of The term ​_____________ comes from the Greek...

Question 17

​In which file system can you hide data by placing sensitive or incriminating data in free or slack space on disk partition clusters?

Accepted Answer

The answer of ​In which file system can you hide...

Question 18

The goal of recovering as much information as possible can result in ________________, in which an investigation expands beyond the original description because of unexpected evidence found.​

Accepted Answer

The term "scope creep" refers to a situation in which an investigation expands beyond its original scope, often because of the discovery of unexpected evidence. This can happen when the goal is to recover as much information as possible, and can lead to increased costs and delays in the investigation.

Question 19

Match the following terms with the correct definitions below:?
-?A file containing the hash value for every possible password that can be generated from a computer's keyboard.

Accepted Answer

A rainbow table is a precomputed table for reversing cryptographic hash functions, primarily for cracking password hashes. Tables are used to recover a plaintext password from a password hash generated by a hash function, exploiting the fact that hashes are deterministic.

Question 20

Match the following terms with the correct definitions below:?
-?An AccessData database containing the hash values of known legitimate and suspicious files. It's used to identify files for evidence or eliminate them from the investigation if they are legitimate files.

Accepted Answer

The Known File Filter (KFF) is an AccessData database that contains hash values of known legitimate and suspicious files, which helps in identifying or eliminating files in an investigation.

Quiz 9: Computer Forensics Analysis and Validation

Match the following terms with the correct definitions below:? -?A technology designed to recover encrypted data if users forget their passphrases or if the user key is corrupted after a system failure.

The AccessData program has a hashing database, ________________, which is available only with FTK, and can be used to filter known program files from view and contains the hash values of known illegal files.

In ________ investigations, evidence collection tends to be fairly easy and straightforward because investigators usually have ready access to the necessary records and files.

Match the following terms with the correct definitions below:? -?The pnrocess of shifting one or more digits in a binary number to the left or right to produce a different value.

Match the following terms with the correct definitions below:? -?The result of an investigation expanding beyond its original description because the discovery of unexpected evidence increases the amount of work required.

In addition to steganography, _____________________ was developed as a way to protect file ownership.

Match the following terms with the correct definitions below:? -?In steganalysis, the original file with no hidden message.

Examining and analyzing digital evidence depend on the nature of the investigation and the amount of data to process. Criminal investigations are limited to ﬁnding data deﬁned in the search warrant, and _____ investigations are often limited by court orders for discovery.

What format below is used for VMware images?

Match the following terms with the correct definitions below:? -?In steganalysis, the file containing the hidden message.

Match the following terms with the correct definitions below:? -?A cryptographic technique for embedding information in another file for the purpose of hiding the information from casual observers.

Match the following terms with the correct definitions below:? -?The process of hashing all sectors of a file and then comparing them with sectors on a suspect's disk drive to determine whether there are any remnants of the original file that couldn't be recovered.

Which of the following file systems can't be analyzed by OSForensics?

In ProDiscover and other digital forensics tools, raw format image files (.dd extension) don't contain ________, so you must validate them manually to ensure the integrity of data.

Match the following terms with the correct definitions below:? -?Adding bits to a password before it's hashed so that a rainbow table can't find a matching hash value to decifer the password.

The term _____________ comes from the Greek word for "hidden writing".

In which file system can you hide data by placing sensitive or incriminating data in free or slack space on disk partition clusters?

The goal of recovering as much information as possible can result in ________________, in which an investigation expands beyond the original description because of unexpected evidence found.

Match the following terms with the correct definitions below:? -?A file containing the hash value for every possible password that can be generated from a computer's keyboard.

Match the following terms with the correct definitions below:? -?An AccessData database containing the hash values of known legitimate and suspicious files. It's used to identify files for evidence or eliminate them from the investigation if they are legitimate files.

Quiz 9: Computer Forensics Analysis and Validation

Match the following terms with the correct definitions below:? -?A technology designed to recover encrypted data if users forget their passphrases or if the user key is corrupted after a system failure.

The AccessData program has a hashing database, ________________, which is available only with FTK, and can be used to filter known program files from view and contains the hash values of known illegal files.​

In ________ investigations, evidence​ collection tends to be fairly easy and straightforward because investigators usually have ready access to the necessary records and files.

Match the following terms with the correct definitions below:? -?The pnrocess of shifting one or more digits in a binary number to the left or right to produce a different value.

Match the following terms with the correct definitions below:? -?The result of an investigation expanding beyond its original description because the discovery of unexpected evidence increases the amount of work required.

In addition to steganography, _____________________ was developed as a way to protect file ownership.​

Match the following terms with the correct definitions below:? -?In steganalysis, the original file with no hidden message.

​Examining and analyzing digital evidence depend on the nature of the investigation and the amount of data to process. Criminal investigations are limited to ﬁnding data deﬁned in the search warrant, and _____ investigations are often limited by court orders for discovery.

What format below is used for VMware images?

Match the following terms with the correct definitions below:? -?In steganalysis, the file containing the hidden message.

Match the following terms with the correct definitions below:? -?A cryptographic technique for embedding information in another file for the purpose of hiding the information from casual observers.

Match the following terms with the correct definitions below:? -?The process of hashing all sectors of a file and then comparing them with sectors on a suspect's disk drive to determine whether there are any remnants of the original file that couldn't be recovered.

Which of the following file systems can't be analyzed by OSForensics?

In ProDiscover and other digital forensics tools, raw format image files (.dd extension) don't contain ________, so you must validate them manually to ensure the integrity of data.​

Match the following terms with the correct definitions below:? -?Adding bits to a password before it's hashed so that a rainbow table can't find a matching hash value to decifer the password.

The term ​_____________ comes from the Greek word for "hidden writing".

​In which file system can you hide data by placing sensitive or incriminating data in free or slack space on disk partition clusters?

The goal of recovering as much information as possible can result in ________________, in which an investigation expands beyond the original description because of unexpected evidence found.​

Match the following terms with the correct definitions below:? -?A file containing the hash value for every possible password that can be generated from a computer's keyboard.

Match the following terms with the correct definitions below:? -?An AccessData database containing the hash values of known legitimate and suspicious files. It's used to identify files for evidence or eliminate them from the investigation if they are legitimate files.

The AccessData program has a hashing database, ________________, which is available only with FTK, and can be used to filter known program files from view and contains the hash values of known illegal files.

In ________ investigations, evidence collection tends to be fairly easy and straightforward because investigators usually have ready access to the necessary records and files.

In addition to steganography, _____________________ was developed as a way to protect file ownership.

Examining and analyzing digital evidence depend on the nature of the investigation and the amount of data to process. Criminal investigations are limited to ﬁnding data deﬁned in the search warrant, and _____ investigations are often limited by court orders for discovery.

In ProDiscover and other digital forensics tools, raw format image files (.dd extension) don't contain ________, so you must validate them manually to ensure the integrity of data.

The term _____________ comes from the Greek word for "hidden writing".

In which file system can you hide data by placing sensitive or incriminating data in free or slack space on disk partition clusters?

The goal of recovering as much information as possible can result in ________________, in which an investigation expands beyond the original description because of unexpected evidence found.