CySA Chapter 13 "Performing Forensic Analysis and Techniques" Review Questions and answers, rated A+/ LATEST EXAM PREDICTION PAPER FOR 2024/25. APPROVED.

CySA Chapter 13 "Performing Forensic Analysis and Techniques" Review Questions and answers, rated A+ KB: Which format does dd produce files in while disk imaging? - -dd creates files in RAW, bit-by-bit format. FYSA: EN01 is the EnCase forensic file format, and OVF is virtualization file format. KB: File carving is used to find file remnants found in clusters on disks that have been only partially rewritten by new files. What is the technical term for where these files are found? - -Slack space is the space that remains when only a portion of a cluster is used by a file. Data from previous files may remain in the slack space since it is typically not wiped or overwritten. FYSA: Unallocated space is space on a drive that has not been made into part of a partition. SB: Mike is looking for information about files that were changed on a Windows endpoint system. What are some examples of things that might contain useful information for his investigation? - -The Master File Table and file indexes (INDX files) both have specific information about files, whereas volume shadow copies can help show differences between files and locations at a point in time. SB: Alice wants to copy a drive without any chance of it being modified by the copying process. What type of decide should she use to ensure that this does not happen during her data acquisition process? - -Write blockers ensure that no changes are made to a source drive when creating a forensic copy. FYSA: Preventing reads would stop you from copying the drive, drive cloners may or may not have write blocking capabilities built in, and hash validation is useful to ensure contents match but don't stop changes to the source drive from occurring. SB: Frederick's organization has been informed that data must be preserved due to pending legal action. What is this type of requirement called? - -A legal hold is a process used to preserve all data related to pending legal action, or when legal action may be expected. FYSA: A retainer is paid to a lawyer to keep them available for work. KB: What two files may contain encryption keys normally stored only in memory on a Window system? - -Core dumps and hibernation files both contain an image of the live memory of a system, potentially allowing encryption keys to be retrieved from the stored file. FYSA: The MFT provides information about file layout, and the Registry contains system information but shouldn't have encryption keys stored in it. SB: Jeff is investigating a system compromise and knows that the first event was reported on October 5th. What forensic tool capability should he use to map other events found in logs and files to this date? - -Timelines are one of the most useful tools when conducting an investigation of a compromise or other event. Forensic tools provide built-in timeline capabilities to allow this type of analysis. SB: During her forensic copy validation process, Danielle hashed the original, cloned the image files, and received the following the MD5 sums. What is likely wrong? b4979e007e909c00a51ae208cacb169 d9ff8a0cf6bc0ab066b6416e7eabf35 - -Since Danielle did not hash her source drive prior to cloning, you cannot determine where the problem occurr