CNIT 420 Final Exam
Study online at https://quizlet.com/_d7fham
1. T/F examining and analyzing digital evidence de- true
pends on the nature of the investigation and the
amount of data to process
2. T/F scope creep has become more common be- true
cause investigations require more detailed ex-
amination of evidence
3. what is included in an investigation plan? - goal and scope of investigation
- materials needed
- tasks to perform
4. what is NSRL? NIST's National Software Refer-
ence Library, a set of MD5 hashes
for known software
5. what is block-wise hashing? process that builds a data set of
hashes of sectors from the origi-
nal file, used to look for known file
fragments to confirm if the file was
stored elsewhere on the drive
6. what is data hiding chaning or manipulating a file to
conceal information
7. what are the different data-hiding techniques? - hiding partitions (removing drive
letter)
- changing file extensions
- setting file attributes to hidden
- bit-shifting (changing order of
binary data)
- encryption
, CNIT 420 Final Exam
Study online at https://quizlet.com/_d7fham
- password protection
- stenography
8. how can a hidden parition be found? using disk management on Win-
dows
9. how big are the bigs between partitions in Win- 128 bytes
dows?
10. T/F marking good clusters as bad clusters was a true, but only applies to FAT table
valid technique for data hiding? so not common anymore
11. what is a type 1 hypervisor? hypervisor that sits on the physical
hardware and doesn't require a
seperate OS (like Windows) and is
usually loaded onto servers/work-
stations
12. what is a type 2 hypervisor? hypervisor that sits on top of an
existing OS (like Windows)
13. what are some examples of type 1 hypervisors? vSphere, esxi, hyper-v, xen, ibm
powervm
14. what are some examples of type 2 hypervisors? parallels, KVM, hyper-v (win 10),
wmware workstation/player,
15. what is the default location for VMware Player on C:\\Users\[username]\Docu-
Windows? ments\Virtual Machines\[VM
name]
16. what is the default location for VMware Player on /var/lib/vmware/virtual machines
Linux?
, CNIT 420 Final Exam
Study online at https://quizlet.com/_d7fham
17. what are the different files for VMware? - .vmx: stores VM config
- .log: logs about VM, like power
on
- .nvram: tracks state of VM's bios
- vmdk: VM's hard drive
- .vmem: stores VM paging files
- .vmsd: stores information about
snapshots
18. what are the different files for VirtualBox? - .ova/.ovf: file/template used to
create a VM
- .vdi: VM hard drive
- .r0: default libraries
- .vbox: saved settings of virtual
HDDs
- .vbox-extpack: plug-ins
- .vbox-prev: backups of VMs
- .xml-prev: backups of XML set-
tings
- .log: logs about VM, like power
on
19. T/F VMs are always interchangable between type false
2 hypervisors?
20. where should one look for the presence of VM on - user/documents folder
a host computer? - registry
- existence of virtual network
adapters
21. T/F VMs can be nested inside other VMs or stored true
on a USB drive
Study online at https://quizlet.com/_d7fham
1. T/F examining and analyzing digital evidence de- true
pends on the nature of the investigation and the
amount of data to process
2. T/F scope creep has become more common be- true
cause investigations require more detailed ex-
amination of evidence
3. what is included in an investigation plan? - goal and scope of investigation
- materials needed
- tasks to perform
4. what is NSRL? NIST's National Software Refer-
ence Library, a set of MD5 hashes
for known software
5. what is block-wise hashing? process that builds a data set of
hashes of sectors from the origi-
nal file, used to look for known file
fragments to confirm if the file was
stored elsewhere on the drive
6. what is data hiding chaning or manipulating a file to
conceal information
7. what are the different data-hiding techniques? - hiding partitions (removing drive
letter)
- changing file extensions
- setting file attributes to hidden
- bit-shifting (changing order of
binary data)
- encryption
, CNIT 420 Final Exam
Study online at https://quizlet.com/_d7fham
- password protection
- stenography
8. how can a hidden parition be found? using disk management on Win-
dows
9. how big are the bigs between partitions in Win- 128 bytes
dows?
10. T/F marking good clusters as bad clusters was a true, but only applies to FAT table
valid technique for data hiding? so not common anymore
11. what is a type 1 hypervisor? hypervisor that sits on the physical
hardware and doesn't require a
seperate OS (like Windows) and is
usually loaded onto servers/work-
stations
12. what is a type 2 hypervisor? hypervisor that sits on top of an
existing OS (like Windows)
13. what are some examples of type 1 hypervisors? vSphere, esxi, hyper-v, xen, ibm
powervm
14. what are some examples of type 2 hypervisors? parallels, KVM, hyper-v (win 10),
wmware workstation/player,
15. what is the default location for VMware Player on C:\\Users\[username]\Docu-
Windows? ments\Virtual Machines\[VM
name]
16. what is the default location for VMware Player on /var/lib/vmware/virtual machines
Linux?
, CNIT 420 Final Exam
Study online at https://quizlet.com/_d7fham
17. what are the different files for VMware? - .vmx: stores VM config
- .log: logs about VM, like power
on
- .nvram: tracks state of VM's bios
- vmdk: VM's hard drive
- .vmem: stores VM paging files
- .vmsd: stores information about
snapshots
18. what are the different files for VirtualBox? - .ova/.ovf: file/template used to
create a VM
- .vdi: VM hard drive
- .r0: default libraries
- .vbox: saved settings of virtual
HDDs
- .vbox-extpack: plug-ins
- .vbox-prev: backups of VMs
- .xml-prev: backups of XML set-
tings
- .log: logs about VM, like power
on
19. T/F VMs are always interchangable between type false
2 hypervisors?
20. where should one look for the presence of VM on - user/documents folder
a host computer? - registry
- existence of virtual network
adapters
21. T/F VMs can be nested inside other VMs or stored true
on a USB drive
