Question 1

Match each item with a statement below:
-a password recovery program available from AccessData

Accepted Answer

PRTK, or Password Recovery Toolkit, is a program developed by AccessData that is designed for recovering lost or forgotten passwords from various types of files, making it the correct match for a password recovery program available from AccessData.

Question 2

To generate reports with the FTK ReportWizard, first you need to ____________________ files during an examination.

Accepted Answer

The answer of To generate reports with the FTK ReportWizard,...

Question 3

Match each item with a statement below:
-an FTK searching option

Accepted Answer

Live search is an FTK (Forensic Toolkit) searching option, allowing users to search and analyze data in real-time on a digital device.

Question 4

____________________ search catalogs all words on the evidence disk so that FTK can find them quickly.

Accepted Answer

The answer of ____________________ search catalogs all words on the...

Question 5

FTK provides two options for searching for keywords: indexed search and ____________________ search.

Accepted Answer

The answer of FTK provides two options for searching for...

Question 6

Match each item with a statement below:
-a disk-partitioning utility

Accepted Answer

System Commander is a disk-partitioning utility that allows for the management and creation of partitions on a hard drive, enabling users to install and boot multiple operating systems on a single computer.

Question 7

Match each item with a statement below:
-defines the investigation's goal and scope, the materials needed, and the tasks to perform

Accepted Answer

An investigation plan defines the investigation's goal and scope, the materials needed, and the tasks to perform.

Answer: C
 Digital Intelligence PDWipe is a tool used to securely wipe data from storage devices.

Answer: D
 Live search is a method used to search for and collect digital evidence while a system is still running.

Answer: E
 A cabinet is a physical storage unit used to securely store evidence.

Answer: F
 PRTK (Passware Kit Forensic) is a toolkit used to recover passwords and decrypt encrypted files.

Answer: G
 Validating digital evidence involves ensuring the integrity and authenticity of the evidence collected.

Answer: H
 MD5 is a hashing algorithm used to verify the integrity of digital evidence.

Answer: I
 System Commander is a tool used to manage and deploy software and hardware on multiple computers.

Question 8

Match each item with a statement below:
-a type of compressed file

Accepted Answer

Cabinet files (.cab) are a type of compressed file used to store data.

Question 9

Match each item with a statement below:
-limit a civil investigation

Accepted Answer

Court orders for discovery can limit a civil investigation by specifying what documents or information can be requested and how they can be obtained.

Answer: B
 An investigation plan can outline the scope and limits of a civil investigation, including what evidence can be collected and analyzed.

Answer: C
 Digital Intelligence PDWipe is a tool for securely wiping electronic devices, which can be used to limit a civil investigation by preventing unauthorized access to sensitive information.

Answer: G
 Validating digital evidence can limit a civil investigation by ensuring that only relevant, admissible evidence is presented and that any questionable evidence is excluded.

Answer: H
 MD5 is a cryptographic hash function that can be used to limit a civil investigation by providing a tamper-proof way to verify the integrity of digital evidence.

Answer: I
 System Commander is a software tool for managing computer systems, which can be used to limit a civil investigation by restricting access to certain files or data.

Question 10

____ are handy when you need to image the drive of a computer far away from your location or when you don't want a suspect to be aware of an ongoing investigation.

Accepted Answer

Remote acquisitions are the best choice when you need to image the drive of a computer far away from your location or when you don't want a suspect to be aware of an ongoing investigation. This process allows you to access and copy data from a computer remotely, without physically accessing it. Tools like Remote Desktop Protocol (RDP), Virtual Private Networks (VPNs), or specialized software like FTK Imager can be used for remote acquisitions.

Question 11

____ is a remote access program for communication between two computers. The connection is established by using the DiskExplorer program (FAT or NTFS) corresponding to the suspect (remote) computer's file system.

Accepted Answer

HDHOST is the only option among the given choices that is a remote access program used for communication between two computers. DiskExplorer is used to establish a connection with the suspected (remote) computer's file system. The other options (DiskHost, DiskEdit, and HostEditor) are not relevant in this context.

Question 12

Many commercial encryption programs use a technology called ____, which is designed to recover encrypted data if users forget their passphrases or if the user key is corrupted after a system data failure.

Accepted Answer

The technology described is known as key escrow, where a copy of the encryption key is securely stored by a third party. This allows for recovery of the encrypted data in case the user forgets their passphrase or if the user key is corrupted after a system data failure. Option A, steganography, is a technique used to hide information within other information. Option C, password backup, refers to the process of saving user passwords for future reference. Option D, key splitting, is a method of dividing an encryption key into multiple parts.

Question 13

Match each item with a statement below:
-a hashing algorithm

Accepted Answer

MD5 is a widely used cryptographic hashing algorithm that produces a 128-bit (16-byte) hash value. It's commonly used for validating the integrity of digital evidence by ensuring that a file or data has not been altered.

Question 14

Match each item with a statement below:
-one of the most critical aspects of computer forensics

Accepted Answer

Validating digital evidence is one of the most critical aspects of computer forensics to ensure the integrity and reliability of the evidence for legal proceedings.

Question 15

People who want to hide data can also use advanced encryption programs, such as PGP or ____.

Accepted Answer

The question asks for an advanced encryption program, and PGP is already mentioned as one option. Therefore, the best choice is BestCrypt, which is another widely used encryption program. NTI and FTK are computer forensics tools, and PRTK is a password recovery tool - none of which are specifically designed for data encryption.

Question 16

The data-hiding technique ____________________ changes data from readable code to data that looks like binary executable code.

Accepted Answer

The answer of The data-hiding technique ____________________ changes data from...

Question 17

____ attacks use every possible letter, number, and character found on a keyboard when cracking a password.

Accepted Answer

Brute-force attacks attempt every possible combination of characters until the correct password is found. This includes using every letter, number, and character found on a keyboard. Therefore, the best choice is A) Brute-force. The other choices, Dictionary and Profile attacks, do not necessarily use every possible character on a keyboard. Statistics is not a relevant choice in this context.

Question 18

____ recovery is a fairly easy task in computer forensic analysis.

Accepted Answer

The answer of ____ recovery is a fairly easy task...

Question 19

Match each item with a statement below:
-program used to clean all data from the target drive you plan to use

Accepted Answer

Digital Intelligence PDWipe is a program used to clean all data from the target drive you plan to use.

Answer: A
 Court orders for discovery are legal documents issued by a court ordering a party to a lawsuit to produce certain documents or evidence.

Answer: D
 Live search refers to the act of searching a computer or other digital device while it is still running.

Answer: G
 Validating digital evidence refers to the process of verifying that the evidence has not been tampered with or altered in any way.

Answer: H
 MD5 is a cryptographic hash function used to verify the integrity of digital data.

Answer: I
 System Commander is a utility software used to manage multiple operating systems on a single computer.

The other options, B (Investigation plan) and E (Cabinet) are not directly related to digital forensics. Option F (PRTK) is a tool used for password recovery and not for data forensics.

Question 20

For most law-enforcement-related computing investigations, the investigator is limited to working with data defined in the search ____________________.

Accepted Answer

The answer of For most law-enforcement-related computing investigations, the investigator...

Quiz 9: Computer Forensics Analysis and Validation

Match each item with a statement below: -a password recovery program available from AccessData

To generate reports with the FTK ReportWizard, first you need to ____________________ files during an examination.

Match each item with a statement below: -an FTK searching option

____________________ search catalogs all words on the evidence disk so that FTK can find them quickly.

FTK provides two options for searching for keywords: indexed search and ____________________ search.

Match each item with a statement below: -a disk-partitioning utility

Match each item with a statement below: -defines the investigation's goal and scope, the materials needed, and the tasks to perform

Match each item with a statement below: -a type of compressed file

Match each item with a statement below: -limit a civil investigation