SANS 500 COMPREHENSIVE ANSWERS AND
QUESTIONS SET A+
✔✔Alternate Data Streams(ADS) - ✔✔alternative content for a file that exists by
creating additional data pointers within the same NTFS file
✔✔Zone.Identifier ADS evidence - ✔✔internet downloaded files via browser to NTFS
contain an alternate data stream called ______________ nozone=-1
mycomputer=0
intranet=1
trusted=2
internets=3
untrusted=4
✔✔Zone.Identifier
ZoneID=3 - ✔✔Determines that File was downloaded from the internet
✔✔VSC(Volume Shadow Copy - ✔✔System restore in windows. Equivalent to Time
Machine for macs. Performs Cluster-By-Cluster diffing/backup and stores that
information
✔✔Volume Shadow Copy - ✔✔When the second set of braces is {3808876b-c176-
4e48-b7ae-04046e6cc752} this is a:
✔✔ShadowExplorer - ✔✔Tool that allows for a user to browse through a familiar
explorer folder interface in the VSCs of their choosing.
✔✔PhotoRec - ✔✔File carving program that is command line based. Uses prebuilt
internal signatures targeting many media file types. Can be used directly against a hard
drive or against a mounted drive image.
✔✔Determine whether the drive is encrypted - ✔✔What critical step should be taken
before powering off a machine to remove the hard drive?
, ✔✔Arsenal Image Mounter - ✔✔What open-source tool mounts disk images as
complete disks that look like real SCSI disks to the Windows operating system?
✔✔ Analysis - ✔✔The act of looking at all the individual findings, including the existence
of data, or lack thereof, as well as associated metadata
✔✔DIP - ✔✔Digital Investigative Plan
✔✔What are the three items of a digital investigative plan? - ✔✔1. Basic Background of
the investigation for context
2. Clear, detailed explanation of what is being requested
3. Plan of Action
✔✔What are the evidence of analysis categories? - ✔✔1. User Communications
2. File Download
3. Program Execution
4. File Opening/Creation
5. File Knowledge
6. Physical Location
7. USB Key Usage
8. Account Usage
9. Browser Usage
✔✔Arsenal Image Mounter - ✔✔Forensic Tool Used to mount images as a drive or
physical device for read-only viewing
✔✔Volatile Data - ✔✔Data that will disappear or be destroyed once the computer
system is powered off
✔✔hiberfil.sys - ✔✔complete copy of everything in RAM when a computer is in
hibernation mode
✔✔working S0 - ✔✔System power state where the system is fully functional. Some
hardware components can be placed into low-power state when not being used to save
power
✔✔Sleep S0 - ✔✔System power state that can quickly switch from a low power state to
a high power state, so that it can respond quickly to hardware and network events
✔✔Sleep 1, 2, 3 - ✔✔System power state where enough power is trickled into RAM to
keep the system state maintained. SoC components remain powered.
✔✔Hibernate S4 - ✔✔System power state with hibernation file
QUESTIONS SET A+
✔✔Alternate Data Streams(ADS) - ✔✔alternative content for a file that exists by
creating additional data pointers within the same NTFS file
✔✔Zone.Identifier ADS evidence - ✔✔internet downloaded files via browser to NTFS
contain an alternate data stream called ______________ nozone=-1
mycomputer=0
intranet=1
trusted=2
internets=3
untrusted=4
✔✔Zone.Identifier
ZoneID=3 - ✔✔Determines that File was downloaded from the internet
✔✔VSC(Volume Shadow Copy - ✔✔System restore in windows. Equivalent to Time
Machine for macs. Performs Cluster-By-Cluster diffing/backup and stores that
information
✔✔Volume Shadow Copy - ✔✔When the second set of braces is {3808876b-c176-
4e48-b7ae-04046e6cc752} this is a:
✔✔ShadowExplorer - ✔✔Tool that allows for a user to browse through a familiar
explorer folder interface in the VSCs of their choosing.
✔✔PhotoRec - ✔✔File carving program that is command line based. Uses prebuilt
internal signatures targeting many media file types. Can be used directly against a hard
drive or against a mounted drive image.
✔✔Determine whether the drive is encrypted - ✔✔What critical step should be taken
before powering off a machine to remove the hard drive?
, ✔✔Arsenal Image Mounter - ✔✔What open-source tool mounts disk images as
complete disks that look like real SCSI disks to the Windows operating system?
✔✔ Analysis - ✔✔The act of looking at all the individual findings, including the existence
of data, or lack thereof, as well as associated metadata
✔✔DIP - ✔✔Digital Investigative Plan
✔✔What are the three items of a digital investigative plan? - ✔✔1. Basic Background of
the investigation for context
2. Clear, detailed explanation of what is being requested
3. Plan of Action
✔✔What are the evidence of analysis categories? - ✔✔1. User Communications
2. File Download
3. Program Execution
4. File Opening/Creation
5. File Knowledge
6. Physical Location
7. USB Key Usage
8. Account Usage
9. Browser Usage
✔✔Arsenal Image Mounter - ✔✔Forensic Tool Used to mount images as a drive or
physical device for read-only viewing
✔✔Volatile Data - ✔✔Data that will disappear or be destroyed once the computer
system is powered off
✔✔hiberfil.sys - ✔✔complete copy of everything in RAM when a computer is in
hibernation mode
✔✔working S0 - ✔✔System power state where the system is fully functional. Some
hardware components can be placed into low-power state when not being used to save
power
✔✔Sleep S0 - ✔✔System power state that can quickly switch from a low power state to
a high power state, so that it can respond quickly to hardware and network events
✔✔Sleep 1, 2, 3 - ✔✔System power state where enough power is trickled into RAM to
keep the system state maintained. SoC components remain powered.
✔✔Hibernate S4 - ✔✔System power state with hibernation file
