Deck 6: Current Computer Forensics Tools

Question 1

A keyword search is part of the ​analysis process within what forensic function?

A)​reconstruction
B)​acquisition
C)extraction
D)reporting

Answer 1

C

Question 2

What program serves as the GUI front end for accessing Sleuth Kit's tools?​

A)​KDE
B)​DetectiveGUI
C)Autopsy
D)SMART

Answer 2

C

Question 3

Which of the following options is not a subfunction of extraction?​

A)​carving
B)​decrypting
C)logical data copy
D)bookmarking

Answer 3

C

Question 4

All forensics acquisition tools have a method for verification of the data-copying process that compares the original drive ​with the image.

Question 5

In what temporary location below might passwords be stored? ​

A)​​pagefile.sys
B)​Windows registry
C)system32.dll
D)CD-ROM drive

Question 6

​Software forensics tools are grouped into command-line applications and GUI applications

Question 7

ISO standard 27037 sta​tes that the most important factors in data acquisition are the DEFR's competency and the use of validated tools.

Question 8

What hex value is the standard indicator for jpeg graphics files?​

A)FF D9​
B)​F8 D8
C)FF D8
D)AB CD

Question 9

​What algorithm is used to decompress Windows files?

A)​Shannon-Fano
B)​Fibonacci
C)Lempel-Ziv
D)Zopfli

Question 10

In general, what would a lightweight forensics workstation consist of?​

A)​A tower with several bays and many peripheral devices
B)​A laptop computer with almost as many bays and peripherals as a tower
C)A laptop computer built into a carrying case with a small selection of peripheral options
D)A tablet with peripherals and forensics apps

Question 11

The physical data copy subfunction exists under the ______________ function.​

A)​acquisition
B)​validation ​/ verification
C)extraction
D)reporting

Question 12

Reconstructing fragments of files that have been deleted from a suspect drive, is known as ____________ in North America.​

A)salvaging
B)​scraping
C)carving
D)sculpting

Question 13

_______________ proves that two sets of data are identical by calculating hash values or using another similar method.​

A)​Validation
B)​Compilation
C)Integration
D)Verification

Question 14

Making a logical acquisition of a drive with whole disk encryption can result in unreadable files.​

Question 15

Physically copying the entire drive is the only type of data-copying method used in software acquisitions.

Question 16

What option below is an example of a platform specific encryption tool?

A)​Pretty Good Privacy (PGP)
B)​GnuPG
C)TrueCrypt
D)BitLocker

Question 17

What is the goal of the NSRL project, created by NIST?​

A)​Collect known hash values for commercial software and OS files using MD5 hashes.
B)​Collect known hash values for commercial software and OS files using SHA hashes.
C)Create hash values for illegal files and distribute the information to law enforcement.
D)Search for collisions in hash values, and contribute to fixing hashing programs.

Question 18

​The ProDiscover utility makes use of the proprietary _______________ file format.

A)​.eve
B)​.pro
C).img
D).iso

Question 19

What tool below was written for MS-DOS and was commonly used for manual digital investigations?​

A)​Norton DiskEdit
B)​ByteBack
C)DataLifter
D)SMART

Question 20

Passwords are typically stored as one-way _____________ rather than in plaintext.​

A)​variables
B)​hex values
C)hashes
D)slack spaces

Question 21

The __________ Linux Live CD includes tools such as Autopsy and Sleuth Kit, ophcrack, ​dcfldd, MemFetch, and MBoxGrep, and utilizes a KDE interface.​

A)Ubuntu​
B)​Helix3
C)Arch
D)Kali

Question 22

Match each term with its definition:

-?The process of rebuilding data files; one of the required functions of digital forensics tools.

A)acquisition
B)brute-force attack
C)Computer Forensics Tool Testing (CFTT)
D)extraction
E)keyword search
F)National Software Reference Library (NSRL)
G)password dictionary attack
H)reconstruction
I)validation
J)write-blocker

Question 23

The purpose of having a ______________ function in a forensics tool is to re-create a suspect drive to show what happened during a crime or incident.​

Question 24

The _____________ utility is designed to be installed on Linux distributions, and can be used to analyze a variety of different file systems, while also offering the ability to use plugins.

Question 25

Which of the following is stated within the ISO 27037 standard?​

A)​Digital Evidence First Responders should use validated tools.
B)​Software forensics tools must provide a GUI interface.
C)Software forensics tools must use the Windows OS.
D)Hardware acquisition tools can only use CRC-32 hashing.

Question 26

In what mode do most write-blockers run??

A)?GUI mode
B)?Shell mode
C)BIOS mode
D)RW mode

Question 27

Match each term with its definition:

-The process of creating a duplicate image of data; one of the required functions of digital forensics tools?

A)acquisition
B)brute-force attack
C)Computer Forensics Tool Testing (CFTT)
D)extraction
E)keyword search
F)National Software Reference Library (NSRL)
G)password dictionary attack
H)reconstruction
I)validation
J)write-blocker

Question 28

Match each term with its definition:

-An attack that uses a collection of words or phrases that might be passwords for an encrypted file.

A)acquisition
B)brute-force attack
C)Computer Forensics Tool Testing (CFTT)
D)extraction
E)keyword search
F)National Software Reference Library (NSRL)
G)password dictionary attack
H)reconstruction
I)validation
J)write-blocker

Question 29

Match each term with its definition:

-The process of pulling relevant data from an image and recovering or reconstructing data fragments; one of the required functions of digital forensics tools.?

A)acquisition
B)brute-force attack
C)Computer Forensics Tool Testing (CFTT)
D)extraction
E)keyword search
F)National Software Reference Library (NSRL)
G)password dictionary attack
H)reconstruction
I)validation
J)write-blocker

Question 30

Match each term with its definition:

-A method of finding files or other information by entering relevant characters, words, or phrases in a search tool?

A)acquisition
B)brute-force attack
C)Computer Forensics Tool Testing (CFTT)
D)extraction
E)keyword search
F)National Software Reference Library (NSRL)
G)password dictionary attack
H)reconstruction
I)validation
J)write-blocker

Question 31

The NIST ________________ program establishes guidelines for selecting and using forensics tools.

Question 32

​When performing disk acquisition, the raw data format is typically created with the UNIX​/ Linux _____________ command.

A)​format
B)​dd
C)dump
D)tar

Question 33

Match each term with its definition:

-The process of trying every combination of characters--letters, numbers, and special characters typically found on a keyboard-- to find a matching password or passphrase value for an encrypted file?

A)acquisition
B)brute-force attack
C)Computer Forensics Tool Testing (CFTT)
D)extraction
E)keyword search
F)National Software Reference Library (NSRL)
G)password dictionary attack
H)reconstruction
I)validation
J)write-blocker

Question 34

__________ can be platform specific, such as BitLocker, or done with third-party tools, such as Pretty Good Privacy (PGP) ​and GNuPG

Question 35

Match each term with its definition:

-A way to confirm that a tool is functioning as intended; one of the functions of digital forensics tools.?

A)acquisition
B)brute-force attack
C)Computer Forensics Tool Testing (CFTT)
D)extraction
E)keyword search
F)National Software Reference Library (NSRL)
G)password dictionary attack
H)reconstruction
I)validation
J)write-blocker

Question 36

​What is the purpose of the reconstruction function in a forensics investigation?

A)​Prove that two sets of data are identical.
B)​Copy all information from a suspect's drive, including information that may have been hidden.
C)Re-create a suspect's drive to show what happened during a crime or incident.
D)Generate reports or logs that detail the processes undertaken by a forensics investigator.

Question 37

Match each term with its definition:

-A NIST project with the goal of collecting all known hash values for commercial software and OS files?

A)acquisition
B)brute-force attack
C)Computer Forensics Tool Testing (CFTT)
D)extraction
E)keyword search
F)National Software Reference Library (NSRL)
G)password dictionary attack
H)reconstruction
I)validation
J)write-blocker

Question 38

Match each term with its definition:

-A hardware device or software program that prevents a computer from writing data to an evidence drive?

A)acquisition
B)brute-force attack
C)Computer Forensics Tool Testing (CFTT)
D)extraction
E)keyword search
F)National Software Reference Library (NSRL)
G)password dictionary attack
H)reconstruction
I)validation
J)write-blocker

Question 39

Match each term with its definition:

-A project sponsored by the National Institute of Standards and Technology to manage research on digital forensics tools?

A)acquisition
B)brute-force attack
C)Computer Forensics Tool Testing (CFTT)
D)extraction
E)keyword search
F)National Software Reference Library (NSRL)
G)password dictionary attack
H)reconstruction
I)validation
J)write-blocker

Question 40

The National Software Reference Library has compiled a list of known ___________ for a variety of OSs, applications, and images​.

Question 41

Explain the difference between validation and verification.

Question 42

What two different options are available for write blockers, and how do these options work?​

Question 43

List three of the six subfunctions that exist under the reconstruction function.​

Question 44

In general, forensics workstations can be divided into what categories? Explain each category.

Question 45

​List the five (5) categories of functions that are meant as guidelines for evaluating digital forensic tools, with subfunctions for refining data analysis and recovery and ensuring data quality.​

Question 46

How does a password dictionary attack work?​

Question 47

Name at least four subfunctions of the extraction function that are used in forensics investigations.

Question 48

​Describe two methods for filtering data- separating good data from suspicious data.

Question 49

What are the three minimum steps of a basic digital forensics examination protocol?​

Question 50

What guidelines exist for the selection and use of forensics software? Name at least three.