Question 1

​Select the tool below that does not use dictionary attacks or brute force attacks to crack passwords:

Accepted Answer

OSForensics uses various other techniques such as hash cracking, rainbow tables, and hybrid attacks to crack passwords instead of relying solely on dictionary or brute force attacks.

Question 2

The advantage of recording hash values is that you can determine whether data has changed.​

Accepted Answer

Hash values are unique digital fingerprints that are created from the data. If any changes are made to the data, the hash value will change as well, making it possible to detect any modifications. This is particularly useful in ensuring data integrity and security.

Question 3

One of the most critical aspects of digital forensics is validating digital evidence because ensuring the integrity of data you collect is essential for presenting evidence in court.​

Accepted Answer

Validating digital evidence is critical in digital forensics to ensure the integrity of data collected, which is necessary for presenting evidence in court. Without validation, the evidence may be dismissed or considered inadmissible, leading to a weakened case. Therefore, ensuring the authenticity and reliability of digital evidence is crucial.

Question 4

Which password recovery method uses every possible letter, number, and character found on a keyboard?​

Accepted Answer

A brute-force attack attempts every possible combination of letters, numbers, and characters until the correct password is found. It is a time-consuming process, but it has a high probability of success.

Question 5

​In order to aid a forensics investigation, a hardware or software ______________ can be utilized to capture keystrokes remotely.

Accepted Answer

A keylogger is a program or device that captures and logs the keystrokes made on a computer or mobile device. This can be useful in a forensics investigation to gather evidence of what was typed by a suspect. A keygrabber is a type of keylogger that is a physical device inserted between the keyboard and the computer that captures keystrokes, but it requires physical access to the device. Packet capture and protocol analyzer are tools used for analyzing network traffic and would not be ideal for capturing keystrokes.

Question 6

Advanced hexadecimal editors offer many features not available in digital forensics tools, such as hashing speciﬁc ﬁles or sectors. ​

Accepted Answer

Advanced hexadecimal editors provide additional features beyond basic digital forensic tools, including the ability to hash specific files or sectors.

Question 7

In private sector cases, like criminal and civil cases, the scope is always defined by a search warrant.​

Accepted Answer

In private sector cases, the scope is usually defined by a subpoena, not a search warrant.

Question 8

Which option below is not a disk management tool?​

Accepted Answer

HexEdit is a hex editor, not a disk management tool.

Question 9

Typically, anti-virus tools run hashes on potential malware files, but some advanced malware uses ________________ as a way to hide its malicious code from antivirus tools.​

Accepted Answer

Bit-shifting is a technique used by advanced malware to obfuscate its code, making it harder for antivirus tools to detect by altering the binary pattern of the code without changing its functionality.

Question 10

​In Windows, the ______________ command can be used to both hide and reveal partitions within Explorer.

Accepted Answer

The "diskpart" command can be used in Windows to both hide and reveal partitions within Explorer. The "format" command is used to prepare a storage device for use, "fdisk" is a command used for partitioning hard drives in DOS or Windows, and "grub" is a bootloader used in Linux systems.

Question 11

The _______________________ maintains a national database of updated file hash values for a variety of OSs, applications, and images, but does not list hash values of known illegal files.​

Accepted Answer

The National Software Reference Library (NSRL) maintains a national database of updated file hash values for a variety of OSs, applications, and images. However, they do not list hash values of known illegal files. The other options (A, B, C) are not recognized or established references for file hash values.

Question 12

​Within Windows Vista and later, partition gaps are _____________ bytes in length.

Accepted Answer

Partition gaps are 128 bytes in length in Windows Vista and later.

Question 13

A ____________ image file containing software is intended to be bit-stream copied to floppy disks or other external media.​

Accepted Answer

The "dd" command is commonly used for creating disk images and can be used for bit-stream copying to external media. The other options listed are not typically used for this purpose.

Question 14

What letter should be typed into DiskEdit in order to mark a good sector as bad?​

Accepted Answer

In DiskEdit, typing the letter "B" will mark a good sector as bad.

Question 15

A user with programming experience may use an assembler program (also called a __________ ) on a file to scramble bits, in order to secure the information contained inside.​

Accepted Answer

The answer of A user with programming experience may use...

Question 16

When performing a static acquisition, what should be done after the hardware on a suspect's computer has been inventoried and documented?​

Accepted Answer

After documenting the hardware on a suspect's computer, it is important to record the system's date and time values from the CMOS. Additionally, if practical, the hard drive should be removed to prevent any accidental modification to the data.

Question 17

Many commercial encryption programs use a technology called _____________, which is designed to recover encrypted data if users forget their passphrases or if the user key is corrupted after a system failure.​

Accepted Answer

Key escrow is a technology used by encryption programs to protect data by storing a copy of the encryption key with a trusted third party. This ensures that if users forget their passphrases or if the user key is corrupted, the trusted third party can recover the data.

Question 18

Because attorneys do not have the right of full discovery of digital evidence, it is not possible for new evidence to come to light while complying with a defense request for full discovery.​

Accepted Answer

This statement is false. Attorneys do have the right of full discovery of digital evidence, and new evidence can come to light while complying with a defense request for full discovery.

Question 19

What technique is designed to reduce or eliminate the possibility of a rainbow table being used to discover passwords?​

Accepted Answer

Salted passwords involve adding a random string of characters to each plain text password before hashing it. This makes it much more difficult to use rainbow tables to crack passwords because the attacker would need to generate a new rainbow table for each unique salt.

Question 20

The term for detecting and analyzing steganography files is _________________.​

Accepted Answer

The term for detecting and analyzing steganography files is called steganalysis. Choice A, carving, refers to the process of recovering files from fragmented or corrupted storage media. Choice B, steganology, is not a commonly used term and may refer to the study of steganography rather than the detection of steganography. Choice D, steganomics, is not a recognized term in the field of computer forensics.

Quiz 9: Computer Forensics Analysis and Validation

​Select the tool below that does not use dictionary attacks or brute force attacks to crack passwords:

The advantage of recording hash values is that you can determine whether data has changed.​

One of the most critical aspects of digital forensics is validating digital evidence because ensuring the integrity of data you collect is essential for presenting evidence in court.​

Which password recovery method uses every possible letter, number, and character found on a keyboard?​

​In order to aid a forensics investigation, a hardware or software ______________ can be utilized to capture keystrokes remotely.

Advanced hexadecimal editors offer many features not available in digital forensics tools, such as hashing speciﬁc ﬁles or sectors. ​

In private sector cases, like criminal and civil cases, the scope is always defined by a search warrant.​

Which option below is not a disk management tool?​

Typically, anti-virus tools run hashes on potential malware files, but some advanced malware uses ________________ as a way to hide its malicious code from antivirus tools.​

​In Windows, the ______________ command can be used to both hide and reveal partitions within Explorer.

The _______________________ maintains a national database of updated file hash values for a variety of OSs, applications, and images, but does not list hash values of known illegal files.​

​Within Windows Vista and later, partition gaps are _____________ bytes in length.

A ____________ image file containing software is intended to be bit-stream copied to floppy disks or other external media.​

What letter should be typed into DiskEdit in order to mark a good sector as bad?​

A user with programming experience may use an assembler program (also called a __________ ) on a file to scramble bits, in order to secure the information contained inside.​

When performing a static acquisition, what should be done after the hardware on a suspect's computer has been inventoried and documented?​

Many commercial encryption programs use a technology called _____________, which is designed to recover encrypted data if users forget their passphrases or if the user key is corrupted after a system failure.​

Because attorneys do not have the right of full discovery of digital evidence, it is not possible for new evidence to come to light while complying with a defense request for full discovery.​

What technique is designed to reduce or eliminate the possibility of a rainbow table being used to discover passwords?​

The term for detecting and analyzing steganography files is _________________.​

Select the tool below that does not use dictionary attacks or brute force attacks to crack passwords:

The advantage of recording hash values is that you can determine whether data has changed.

One of the most critical aspects of digital forensics is validating digital evidence because ensuring the integrity of data you collect is essential for presenting evidence in court.

Which password recovery method uses every possible letter, number, and character found on a keyboard?

In order to aid a forensics investigation, a hardware or software ______________ can be utilized to capture keystrokes remotely.

Advanced hexadecimal editors offer many features not available in digital forensics tools, such as hashing speciﬁc ﬁles or sectors.

In private sector cases, like criminal and civil cases, the scope is always defined by a search warrant.

Which option below is not a disk management tool?

Typically, anti-virus tools run hashes on potential malware files, but some advanced malware uses ________________ as a way to hide its malicious code from antivirus tools.

In Windows, the ______________ command can be used to both hide and reveal partitions within Explorer.

The _______________________ maintains a national database of updated file hash values for a variety of OSs, applications, and images, but does not list hash values of known illegal files.

Within Windows Vista and later, partition gaps are _____________ bytes in length.

A ____________ image file containing software is intended to be bit-stream copied to floppy disks or other external media.

What letter should be typed into DiskEdit in order to mark a good sector as bad?

A user with programming experience may use an assembler program (also called a __________ ) on a file to scramble bits, in order to secure the information contained inside.

When performing a static acquisition, what should be done after the hardware on a suspect's computer has been inventoried and documented?

Many commercial encryption programs use a technology called _____________, which is designed to recover encrypted data if users forget their passphrases or if the user key is corrupted after a system failure.

Because attorneys do not have the right of full discovery of digital evidence, it is not possible for new evidence to come to light while complying with a defense request for full discovery.

What technique is designed to reduce or eliminate the possibility of a rainbow table being used to discover passwords?

The term for detecting and analyzing steganography files is _________________.