CNIT 420 - Exam 1 Latest Update with Verified Solutions

CNIT 420 - Exam 1 Latest Update with Verified Solutions Inculpatory "incriminating" or provides evidence of an action Exculpatory provides evidence of a lack of action Investigations Triad Vuln/Threat Assessment and Risk Management | Network Intrusion Detection and Incident Response | Digital Investigations case law When statutes don't exist, ______ is used Public Sector Gov agencies, subject to US Criminal and Constitutional Law Private Sector Corporate, policy violations and litigation disputes, can transform into a criminal investigation Blotter Historical database of previous crimes Digital Evidence First Responder Arrives on an incident scene, assesses the situation, and takes precautions to acquire and preserve evidence Digital Evidence Specialist Has the skill to analyze the data and determine when another specialist should be called in to assist Affidavit a sworn statement of support of facts about or evidence of a crime Line of authority states who has the legal right to initiate an investigation, who can take possession of evidence, and who can have access to evidence Acceptable Use Policy Most important policies define rules for using the company's computers and networks warning banner Business can avoid litigation by displaying a ____ on computer screens To minimize risk to the company What is a private-sector investigator's job? You search for evidence to support allegations of violations What happens during private investigations? Chain of custody Route the evidence takes from the time you find it until the case is closed or goes to court Write-blockers Enables you to boot to Windows w/o writing data to the evidence drive Tool shall block any manipulative commands to a protected drive, shall not block access commands, and shall give an indication to the user that the tool is active What are the big three mandatory requirements for write blockers? Bit-stream copy bit-by-bit copy of the original storage medium Bit-stream image File containing the bit-stream copy of all data on a disk or partition Preserve the original evidence...conduct the analysis on a copy of the data What is the first rule of computer forensics? T Deleted files linger on the disk until new data is saved on the same physical location (T/F) image file Data in a forensics acquisition tool is stored in what type of file? Raw, Proprietary, Advanced Forensics What are the three formats of an image file? Raw Format Writes bit-stream data to files, ignores minor data read errors, tools might not collect marginal (bad) sectors, requires as much storage as original disk or data Proprietary Format Can integrate metadata into the image file, Expert Witness Compression format is unofficial standard Advanced Forensics Format Provide (un/)compressed image files, Includes metadata, self-authentication Static acquisition Live acquisition Disk-to-image Data collection method: Most common method and offers most flexibility, copies are bit-for-bit replications of the original drive Disk-to-disk Data collection method: tools can adjust disk's geometry configuration Logical acquisition Data collection method: captures only specific files of interest to the case Sparse acquisition Data collection method: collects fragments of unallocated data Creating a copy Data collection method: Size of source disk (lossless compression), large drives 2 (use different tools or techniques) How many images of digital evidence should be made at minimum? BIOS level Copying a host protected area allows the investigator to access the drive at what level? Whole disk encryption BitLocker is a Windows feature that may require a decryption key. What is this called? fdisk What command lists, creates, deletes, and verifies partitions in Linux? What command formats a FAT file system from Linux? dd ("data dump") Creates raw format file that most computer forensics analysis tools can read FTK Imager Lite Makes disk-to-image copies of evidence drives, designed for viewing evidence disks CRC-32, MD5, and SHA1 to SHA-512 What are the validation techniques (hashing) F Raw format image files contain metadata (T/F) Redundant array of independent disks (RAID) Computer configuration involving two or more disks RAID 0 Rapid access and increased storage, lack of redundancy (striping) RAID 1 Designed for data recovery, files duplicated across disks (mirroring) RAID 2 Data written to disk on bit level, uses parity bit (striping) RAID 3 Striping and dedicated parity, requires at least 3 disks RAID 4 similar to RAID 3, data is written in blocks RAID 5 Parity recovery data on each disk, similar to RAID 0 and 3 RAID 6 Redundant parity on each disk RAID 10 Provides fast access and redundancy, (mirrored striping) RAID 15 Combo of RAID 1 and 5, costly ISO standard 27037 What standard gives guidance on what procedures countries should have in place for digital evidence? It can be changed more easily Why is digital evidence unlike other physical evidence? Computer-generated records and computer-stored records Computer records are usually categorized into: authentic and trustworthy Computer-generated and computer-stored records must be shown to be ____ and ____ to be admitted into evidence Fourth Amendment "describing the place to be searched, and the persons of things to be seized" Plain view doctrine "Objects falling in plain view of an officer who has the right to be in position to have that view are subject to seizure w/o a warrant and may be introduced into evidence" 1. Officer is where he or she has a legal right to be 2. Ordinary senses must not be enhanced by advanced technology in any way 3. Any discovery must be by chance (the incriminating character of the object must be immediately apparent) What are the three criteria that must be met for Plain View Doctrine T The plain view doctrine's applicability in the digital forensics world is being rejected (T/F) Forensically sound Term used to qualify and, in some cases, justify the use of a particular forensic technology or methodology Complementary Metal Oxide Semiconductor Where does the computer store system configuration and date and time info? Erase cycles Why does flash memory have a write endurance limit? wear-leveling All flash memory devices have a feature called ______ garbage collector Where are old memory cells listed in? logical addresses Cluster numbers assigned by the OS physical addresses Sector numbers disk partition Clusters and their addresses are specific to a logical disk drive partition A _____ is a logical drive partition gap Unused space between partitions 0x1BE What offset is the first partition at in a hex editor? A file is deleted å replaces the first letter of the filename representing what? resident and nonresident File or folder info is typically stored in what two ways in an MFT record? Alternate data streams Ways data can be appended to existing files w/o being seen Registry A database that stores hardware and software config information, network connections, user preferences, and setup info .50 Lossless compression can compress up to what percentage of data? hash, hashlog, and vf In the Linux dcfldd command, which three options are used for validating data? Amount of data storage needed and type of RAID What are two concerns when acquiring data from a RAID server? Antivirus, antispyware, and firewall programs With remote acquisitions, what problems should you be aware of? Fragments of unallocated data in addition to the logical allocated data What does a sparse acquisition collect for an investigation? 2 GB What's the maximum file size when writing data to a FAT32 drive? T The main goal of a static acquisition is the preservation of digital evidence. (T/F) T With newer Linux kernel distributions, USB devices are automatically mounted, which can alter data on it. (T/F) F FTK Imager can acquire data in a drive's host protected area. (T/F) T A hashing algorithm is a program designed to create a binary or hexadecimal number that represents the uniqueness of a data set, file, or entire disk. (T/F) Validation What's the most critical aspect of digital evidence? F The plain view doctrine in computer searches is well-established law. (T/F) 1 As a private-sector investigator, you can become an agent of law enforcement when which of the following happens? 1. You begin to take orders from a police detective without a warrant or subpoena. 2. Your internal investigation has concluded, and you have filed a criminal complaint and turned over the evidence to law enforcement. 3. Your internal investigation begins. 4. None of the above. T Commingling evidence means that sensitive or confidential information being mixed with data collected as evidence. (T/F) T If a company doesn't distribute a computing use policy stating an employer's right to inspect employees' computers freely, including e-mail and Web use, employees have an expectation of privacy. (T/F) N Which of the following Windows 8 files contains user-specific information? Unicode characters and better security List two features NTFS has that FAT does not. MRU files list What does the N file contain? T A virtual cluster number represents the assigned clusters of files that are nonresident in the MFT. (T/F) 4 or more How many sectors are typically in a cluster on a disk drive? The file is unencrypted automatically. What happens when you copy an encrypted file from an EFS-enabled NTFS disk to a non-EFS disk or folder? 2 Clusters in Windows always begin numbering at what number?