Deck 9: Computer Forensics Analysis and Validation

Question 1

​Select the tool below that does not use dictionary attacks or brute force attacks to crack passwords:

A)​Last Bit
B)​AccessData PRTK
C)OSForensics
D)Passware

Answer 1

C

Question 2

The advantage of recording hash values is that you can determine whether data has changed.​

Answer 2

True

Question 3

One of the most critical aspects of digital forensics is validating digital evidence because ensuring the integrity of data you collect is essential for presenting evidence in court.​

Answer 3

True

Question 4

Which password recovery method uses every possible letter, number, and character found on a keyboard?​

A)​rainbow table
B)​dictionary attack
C)hybrid attack
D)brute-force attack

Question 5

​In order to aid a forensics investigation, a hardware or software ______________ can be utilized to capture keystrokes remotely.

A)​keygrabber
B)​keylogger
C)packet capture
D)protocol analyzer

Question 6

Advanced hexadecimal editors offer many features not available in digital forensics tools, such as hashing specific files or sectors. ​

Question 7

In private sector cases, like criminal and civil cases, the scope is always defined by a search warrant.​

Question 8

Which option below is not a disk management tool?​

A)Partition Magic​
B)​Partition Master
C)GRUB
D)HexEdit

Question 9

Typically, anti-virus tools run hashes on potential malware files, but some advanced malware uses ________________ as a way to hide its malicious code from antivirus tools.​

A)​hashing
B)​bit-shifting
C)registry edits
D)slack space

Question 10

​In Windows, the ______________ command can be used to both hide and reveal partitions within Explorer.

A)​format
B)​fdisk
C)grub
D)diskpart

Question 11

The _______________________ maintains a national database of updated file hash values for a variety of OSs, applications, and images, but does not list hash values of known illegal files.​

A)​Open Hash Database
B)​HashKeeper Online
C)National Hashed Software Reference
D) National Software Reference Library

Question 12

​Within Windows Vista and later, partition gaps are _____________ bytes in length.

A)​64
B)​128
C)256
D)512

Question 13

A ____________ image file containing software is intended to be bit-stream copied to floppy disks or other external media.​

A)​fdisk
B)​format
C)dd
D)DiskEdit

Question 14

What letter should be typed into DiskEdit in order to mark a good sector as bad?​

A)​M
B)​B
C)T
D)D

Question 15

A user with programming experience may use an assembler program (also called a __________ ) on a file to scramble bits, in order to secure the information contained inside.​

A)​compiler
B)shifter
C)macro
D)script

Question 16

When performing a static acquisition, what should be done after the hardware on a suspect's computer has been inventoried and documented?​

A)​Inventory and documentation information should be stored on a drive and then the drive should be reformatted.
B)​Start the suspect's computer and begin collecting evidence.
C) The hard drive should be removed, if practical, and the system's date and time values should be recorded from the system's CMOS.​
D)Connect the suspect's computer to the local network so that up to date forensics utilities can be utilized.

Question 17

Many commercial encryption programs use a technology called _____________, which is designed to recover encrypted data if users forget their passphrases or if the user key is corrupted after a system failure.​

A)​key vault
B)​key escrow
C)bump key
D)master key

Question 18

Because attorneys do not have the right of full discovery of digital evidence, it is not possible for new evidence to come to light while complying with a defense request for full discovery.​

Question 19

What technique is designed to reduce or eliminate the possibility of a rainbow table being used to discover passwords?​

A)salted passwords
B)​scrambled passwords
C)indexed passwords
D) master passwords

Question 20

The term for detecting and analyzing steganography files is _________________.​

A)​carving
B)​steganology
C)steganalysis
D)steganomics

Question 21

Match the following terms with the correct definitions below:?

-?A technology designed to recover encrypted data if users forget their passphrases or if the user key is corrupted after a system failure.

A)?bit-shifting
B)block-wise hashing?
C)?cover-media
D)key-escrow?
E)?Known File Filter (KFF)
F)rainbow table?
G)?salting passwords
H)scope creep?
I)?steganography
J)stego-media

Question 22

The AccessData program has a hashing database, ________________, which is available only with FTK, and can be used to filter known program files from view and contains the hash values of known illegal files.​

A)​DeepScan Filter
B)Unknown File Filter (UFF)
C)Known File Filter (KFF)
D)FTK Hash Imager

Question 23

In ________ investigations, evidence​ collection tends to be fairly easy and straightforward because investigators usually have ready access to the necessary records and files.

Question 24

Match the following terms with the correct definitions below:?

-?The pnrocess of shifting one or more digits in a binary number to the left or right to produce a different value.

A)?bit-shifting
B)block-wise hashing?
C)?cover-media
D)key-escrow?
E)?Known File Filter (KFF)
F)rainbow table?
G)?salting passwords
H)scope creep?
I)?steganography
J)stego-media

Question 25

Match the following terms with the correct definitions below:?

-?The result of an investigation expanding beyond its original description because the discovery of unexpected evidence increases the amount of work required.

A)?bit-shifting
B)block-wise hashing?
C)?cover-media
D)key-escrow?
E)?Known File Filter (KFF)
F)rainbow table?
G)?salting passwords
H)scope creep?
I)?steganography
J)stego-media

Question 26

In addition to steganography, _____________________ was developed as a way to protect file ownership.​

Question 27

Match the following terms with the correct definitions below:?

-?In steganalysis, the original file with no hidden message.

A)?bit-shifting
B)block-wise hashing?
C)?cover-media
D)key-escrow?
E)?Known File Filter (KFF)
F)rainbow table?
G)?salting passwords
H)scope creep?
I)?steganography
J)stego-media

Question 28

​Examining and analyzing digital evidence depend on the nature of the investigation and the amount of data to process. Criminal investigations are limited to finding data defined in the search warrant, and _____ investigations are often limited by court orders for discovery.

Question 29

What format below is used for VMware images?

A)?.vhd
B)?.vmdk
C).s01
D).aff

Question 30

Match the following terms with the correct definitions below:?

-?In steganalysis, the file containing the hidden message.

A)?bit-shifting
B)block-wise hashing?
C)?cover-media
D)key-escrow?
E)?Known File Filter (KFF)
F)rainbow table?
G)?salting passwords
H)scope creep?
I)?steganography
J)stego-media

Question 31

Match the following terms with the correct definitions below:?

-?A cryptographic technique for embedding information in another file for the purpose of hiding the information from casual observers.

A)?bit-shifting
B)block-wise hashing?
C)?cover-media
D)key-escrow?
E)?Known File Filter (KFF)
F)rainbow table?
G)?salting passwords
H)scope creep?
I)?steganography
J)stego-media

Question 32

Match the following terms with the correct definitions below:?

-?The process of hashing all sectors of a file and then comparing them with sectors on a suspect's disk drive to determine whether there are any remnants of the original file that couldn't be recovered.

A)?bit-shifting
B)block-wise hashing?
C)?cover-media
D)key-escrow?
E)?Known File Filter (KFF)
F)rainbow table?
G)?salting passwords
H)scope creep?
I)?steganography
J)stego-media

Question 33

Which of the following file systems can't be analyzed by OSForensics?

A)​FAT12
B)Ext2fs
C)HFS+
D)XFS

Question 34

In ProDiscover and other digital forensics tools, raw format image files (.dd extension) don't contain ________, so you must validate them manually to ensure the integrity of data.​

Question 35

Match the following terms with the correct definitions below:?

-?Adding bits to a password before it's hashed so that a rainbow table can't find a matching hash value to decifer the password.

A)?bit-shifting
B)block-wise hashing?
C)?cover-media
D)key-escrow?
E)?Known File Filter (KFF)
F)rainbow table?
G)?salting passwords
H)scope creep?
I)?steganography
J)stego-media

Question 36

The term ​_____________ comes from the Greek word for "hidden writing".

Question 37

​In which file system can you hide data by placing sensitive or incriminating data in free or slack space on disk partition clusters?

A)​NTFS
B)​FAT
C)HFSX
D)Ext3fs

Question 38

The goal of recovering as much information as possible can result in ________________, in which an investigation expands beyond the original description because of unexpected evidence found.​

A)​litigation
B)​scope creep
C)criminal charges
D)violations

Question 39

Match the following terms with the correct definitions below:?

-?A file containing the hash value for every possible password that can be generated from a computer's keyboard.

A)?bit-shifting
B)block-wise hashing?
C)?cover-media
D)key-escrow?
E)?Known File Filter (KFF)
F)rainbow table?
G)?salting passwords
H)scope creep?
I)?steganography
J)stego-media

Question 40

Match the following terms with the correct definitions below:?

-?An AccessData database containing the hash values of known legitimate and suspicious files. It's used to identify files for evidence or eliminate them from the investigation if they are legitimate files.

A)?bit-shifting
B)block-wise hashing?
C)?cover-media
D)key-escrow?
E)?Known File Filter (KFF)
F)rainbow table?
G)?salting passwords
H)scope creep?
I)?steganography
J)stego-media

Question 41

Describe the process of block-wise hashing.​

Question 42

For most forensics investigations, you follow the same general procedure. Summarize the steps in the procedure.

Question 43

​List and explain the five steganalysis methods described by Neil F. Johnson and Sushil Jajodia.

Question 44

Describe what happens if a FAT partition containing bad cluster​ is converted to an NTFS partition, and how you miss evidence that's being hidden.

Question 45

​
Explain what data hiding is and list techniques used to hide data.

Question 46

Explain how bit-shifting, and related techniques, are used to hide data.​

Question 47

Describe some of the forensic processes involved in investigating an employee suspected of industrial espionage.

Question 48

Explain what a digital watermark is and how it's used with data.

Question 49

Why is it important to validate forensic data, and why are advanced hexadecimal editors necessary for this process?

Question 50

Illustrate how an investigator would detect whether a suspect's drive contains hidden partitions.