CS 305 Final ACTUAL Questions and
CORRECT Answers
Because attorneys do not have the right of full discovery of digital evidence, it is not possible
for new evidence to come to light while complying with a defense request for full discovery.
T/F - CORRECT ANSWER- ✔✔False
One of the most critical aspects of digital forensics is validating digital evidence because
ensuring the integrity of data you collect is essential for presenting evidence in court.T/F -
CORRECT ANSWER- ✔✔True
The advantage of recording hash values is that you can determine whether data has
changed.T/F - CORRECT ANSWER- ✔✔true
In private sector cases, like criminal and civil cases, the scope is always defined by a search
warrant.T/F - CORRECT ANSWER- ✔✔false
Advanced hexadecimal editors offer many features not available in digital forensics tools,
such as hashing specific filesor sectors.T/F - CORRECT ANSWER- ✔✔true
What format below is used for VMware images? - CORRECT ANSWER- ✔✔.vmdk
In which file system can you hide data by placing sensitive or incriminating data in free or
slack space on disk partition clusters? - CORRECT ANSWER- ✔✔FAT
Which password recovery method uses every possible letter, number, and character found on
a keyboard? - CORRECT ANSWER- ✔✔Brute-force attack
The goal of recovering as much information as possible can result in ________________, in
which an investigation expands beyond the original description because of unexpected
evidence found.? - CORRECT ANSWER- ✔✔scope creep
Which file systems can't be analyzed by OSForensics? - CORRECT ANSWER- ✔✔XFS
, In Windows, the ______________ command can be used to both hide and reveal partitions
within Explorer. - CORRECT ANSWER- ✔✔diskpart
Which tools do not use dictionary attacks or brute force attacks to crack passwords? -
CORRECT ANSWER- ✔✔OSForensics
Within Windows Vista and later, partition gaps are _____________ bytes in length. -
CORRECT ANSWER- ✔✔128
What are examples of a disk management tool? - CORRECT ANSWER- ✔✔Partition Magic
Partition Master
GRUB
Typically, anti-virus tools run hashes on potential malware files, but some advanced malware
uses ________________ as a way to hide its malicious code from antivirus tools. -
CORRECT ANSWER- ✔✔bit-shifting
A user with programming experience may use an assembler program (also called a
__________) on a file to scramble bits, in order to secure the information contained inside. -
CORRECT ANSWER- ✔✔macro
What letter should be typed into DiskEdit in order to mark a good sector as bad? -
CORRECT ANSWER- ✔✔B
Many commercial encryption programs use a technology called _____________, which is
designed to recover encrypted data if users forget their passphrases or if the user key is
corrupted after a system failure.? - CORRECT ANSWER- ✔✔key escrow
What technique is designed to reduce or eliminate the possibility of a rainbow table being
used to discover passwords. - CORRECT ANSWER- ✔✔salted passwords
When performing a static acquisition, what should be done after the hardware on a suspect's
computer has been inventoried and documented. - CORRECT ANSWER- ✔✔The hard drive
CORRECT Answers
Because attorneys do not have the right of full discovery of digital evidence, it is not possible
for new evidence to come to light while complying with a defense request for full discovery.
T/F - CORRECT ANSWER- ✔✔False
One of the most critical aspects of digital forensics is validating digital evidence because
ensuring the integrity of data you collect is essential for presenting evidence in court.T/F -
CORRECT ANSWER- ✔✔True
The advantage of recording hash values is that you can determine whether data has
changed.T/F - CORRECT ANSWER- ✔✔true
In private sector cases, like criminal and civil cases, the scope is always defined by a search
warrant.T/F - CORRECT ANSWER- ✔✔false
Advanced hexadecimal editors offer many features not available in digital forensics tools,
such as hashing specific filesor sectors.T/F - CORRECT ANSWER- ✔✔true
What format below is used for VMware images? - CORRECT ANSWER- ✔✔.vmdk
In which file system can you hide data by placing sensitive or incriminating data in free or
slack space on disk partition clusters? - CORRECT ANSWER- ✔✔FAT
Which password recovery method uses every possible letter, number, and character found on
a keyboard? - CORRECT ANSWER- ✔✔Brute-force attack
The goal of recovering as much information as possible can result in ________________, in
which an investigation expands beyond the original description because of unexpected
evidence found.? - CORRECT ANSWER- ✔✔scope creep
Which file systems can't be analyzed by OSForensics? - CORRECT ANSWER- ✔✔XFS
, In Windows, the ______________ command can be used to both hide and reveal partitions
within Explorer. - CORRECT ANSWER- ✔✔diskpart
Which tools do not use dictionary attacks or brute force attacks to crack passwords? -
CORRECT ANSWER- ✔✔OSForensics
Within Windows Vista and later, partition gaps are _____________ bytes in length. -
CORRECT ANSWER- ✔✔128
What are examples of a disk management tool? - CORRECT ANSWER- ✔✔Partition Magic
Partition Master
GRUB
Typically, anti-virus tools run hashes on potential malware files, but some advanced malware
uses ________________ as a way to hide its malicious code from antivirus tools. -
CORRECT ANSWER- ✔✔bit-shifting
A user with programming experience may use an assembler program (also called a
__________) on a file to scramble bits, in order to secure the information contained inside. -
CORRECT ANSWER- ✔✔macro
What letter should be typed into DiskEdit in order to mark a good sector as bad? -
CORRECT ANSWER- ✔✔B
Many commercial encryption programs use a technology called _____________, which is
designed to recover encrypted data if users forget their passphrases or if the user key is
corrupted after a system failure.? - CORRECT ANSWER- ✔✔key escrow
What technique is designed to reduce or eliminate the possibility of a rainbow table being
used to discover passwords. - CORRECT ANSWER- ✔✔salted passwords
When performing a static acquisition, what should be done after the hardware on a suspect's
computer has been inventoried and documented. - CORRECT ANSWER- ✔✔The hard drive
