Digital Forensics and Incident Response questions
with accurate answers
/what are some digital forensic artifacts Ans✓✓✓file download,
program execution, file/folder opening, deleted files, physical location,
external device/usb usage,
account usage, browser usage
a bit for bit copy of a device or disk Ans✓✓✓forensic image
allow access of digital evidence, but avoid writing any additional data to
the disk Ans✓✓✓write blockers
any command run from the "start-->run" dialog is logged here
Ans✓✓✓run mru
any unauthorized action that involves a computer system or network
Ans✓✓✓incident
any unauthorized action that involves a computer system or network
Ans✓✓✓incident response
assigned to a usb's file system when inserted to a system
Ans✓✓✓volume serial number
, captures folders that were accesses by a user at a particular time
Ans✓✓✓shellbags
contains thumbnail images of full-size image files that have been deleted
from the system Ans✓✓✓thumbs.db
data for downloaded files that indicate whether the file was downloaded
from an internal or external source Ans✓✓✓ADS zone.identifier
determine the extent of an attacker or incident Ans✓✓✓scoping
driver installation logs from when usb's are inserted into Ans✓✓✓PnP
events
files that have been opened and/or saved in a windows dialogue box
Ans✓✓✓open/save mru
GUI-based apps create ____________ key of the calling users ntuser.dat
registry hive Ans✓✓✓UserAssist
intelligence from evidence gathered from the collection and exploitation
of captured digital equipment Ans✓✓✓media exploitation
maintains the history of a piece of evidence including the first person
who acquired it and who currently has it Ans✓✓✓chain of custody
with accurate answers
/what are some digital forensic artifacts Ans✓✓✓file download,
program execution, file/folder opening, deleted files, physical location,
external device/usb usage,
account usage, browser usage
a bit for bit copy of a device or disk Ans✓✓✓forensic image
allow access of digital evidence, but avoid writing any additional data to
the disk Ans✓✓✓write blockers
any command run from the "start-->run" dialog is logged here
Ans✓✓✓run mru
any unauthorized action that involves a computer system or network
Ans✓✓✓incident
any unauthorized action that involves a computer system or network
Ans✓✓✓incident response
assigned to a usb's file system when inserted to a system
Ans✓✓✓volume serial number
, captures folders that were accesses by a user at a particular time
Ans✓✓✓shellbags
contains thumbnail images of full-size image files that have been deleted
from the system Ans✓✓✓thumbs.db
data for downloaded files that indicate whether the file was downloaded
from an internal or external source Ans✓✓✓ADS zone.identifier
determine the extent of an attacker or incident Ans✓✓✓scoping
driver installation logs from when usb's are inserted into Ans✓✓✓PnP
events
files that have been opened and/or saved in a windows dialogue box
Ans✓✓✓open/save mru
GUI-based apps create ____________ key of the calling users ntuser.dat
registry hive Ans✓✓✓UserAssist
intelligence from evidence gathered from the collection and exploitation
of captured digital equipment Ans✓✓✓media exploitation
maintains the history of a piece of evidence including the first person
who acquired it and who currently has it Ans✓✓✓chain of custody
