Question 1

The chance of two different files having the same MD5 value is roughly one in 340 billion billion billion billion which is approximately equivalent to winning 30,000 billion billion billion first prizes in the Hong Kong Mark Six - the lotto game in Hong Kong which randomly picks 6 numbers from 1 to 47 with a one in 10,737,573 chance of winning first prize.

Accepted Answer

The chance of two different files having the same MD5 value is extremely low, making it highly unlikely.

Question 2

If you are investigating a homicide and, while executing a search warrant, you find a computer in the suspect's home that appears to contain child pornography, what would you do?

Accepted Answer

The answer of If you are investigating a homicide and,...

Question 3

After the MD5 value of a piece of digital evidence has been calculated, any change in that piece of evidence can be detected.

Accepted Answer

MD5 is a widely used cryptographic hash function that produces a 128-bit (16-byte) hash value. Any alteration to the original data, even a single bit, results in a completely different hash value, allowing changes to be detected.

Question 4

Other than verifying the integrity of a file, how can the MD5 value of a file be useful?

Accepted Answer

The answer of Other than verifying the integrity of a...

Question 5

It is not possible to recover deleted system or network log files.

Accepted Answer

Deleted system or network log files can often be recovered using specialized data recovery tools or techniques, unless they have been securely deleted or overwritten.

Question 6

What is the difference between a class characteristic and an individualizing characteristic? Give examples of each involving digital evidence.

Accepted Answer

The answer of What is the difference between a class...

Question 7

TCP/IP network traffic never contains useful class characteristics.

Accepted Answer

TCP/IP network traffic can contain useful class characteristics such as packet sizes, timing, and protocol types, which can be analyzed for various purposes including network management, security, and performance optimization.

Question 8

When seeking authorization to search a network and digital evidence that may exist in more than one jurisdiction it is not necessary to obtain a search warrant for each location.

Accepted Answer

When seeking authorization to search a network and digital evidence that may exist in more than one jurisdiction, it is often necessary to obtain a search warrant for each location due to differing legal jurisdictions and requirements. Each jurisdiction may have its own legal standards and procedures for issuing search warrants.

Question 9

A digital evidence class characteristic is similar to toolmark analysis in the physical world.

Accepted Answer

Both digital evidence class characteristics and toolmark analysis in the physical world involve identifying patterns or features that can be associated with a specific group or category, rather than to a single source, aiding in the investigation process.

Question 10

What are the limitations of the message digest of digital evidence?

Accepted Answer

The answer of What are the limitations of the message...

Question 11

When drawing up an affidavit for a warrant, it is important to specifically mention all desired digital evidence.

Accepted Answer

In an affidavit for a warrant, it is crucial to specifically mention all desired digital evidence to ensure the warrant covers the seizure of such evidence, making the search and seizure legally permissible and focused.

Question 12

Digital investigators should remember that evidence can reside in unexpected places, such as network routers.

Accepted Answer

Network routers, along with other network devices, can store logs and other information that can be valuable in digital investigations, revealing details about data packets, source and destination IP addresses, and timestamps.

Question 13

How would you search for all image files on a disk? Explain the rationale of your approach.

Accepted Answer

The answer of How would you search for all image...

Question 14

Active monitoring is time consuming, invasive, and costly and should only be used as a last resort.

Accepted Answer

Active monitoring requires frequent patient visits, invasive procedures, and expensive tests, making it a resource-intensive option.

Question 15

What does a digital signature tell you?

Accepted Answer

The answer of What does a digital signature tell you?...

Quiz 22: Applying Forensic Science to Networks