SANS 500 TEST PAPER ANSWERS AND QUESTIONS
SET A+
✔✔EMDMgmt - ✔✔Traditionally used for ReadyBoost to remember whether it passed
inspection. Each key in it provides the USB device manufacturer, ID, Serial Number,
Volume Name, and Volume Serial Number.
✔✔ESE Database - ✔✔A proprietary Microsoft database format. Can be broken up into
multiple storage groups, each able to contain multiple database files.
✔✔Exif Data - ✔✔Also called metadata, this is information electronically attached to
each image file, such as shutter speed, aperture, ISO, lens length, white balance, and
other settings used when taking the picture.
✔✔File Carving - ✔✔The process of recovering intact files from memory or unallocated
space. It is done by scanning for known file headers at cluster boundaries and carve a
file out based on a "predicted" length or until a known footer is found. Generally results
in a lot of false positives.
✔✔File Header - ✔✔A sequence of bytes that are generally unique to each file found at
the beginning of the file itself.
✔✔File MRU - ✔✔This key will list many of the recent documents, spreadsheets, and
PowerPoint presentation that the user has opened. This key can go much further back
in time than RecentDocs, due to having more space and not needing to overwrite the
data as fast.
✔✔Hive Flush - ✔✔In a dirty hive situation, where transaction log files contain data not
yet written to the registry, when the changes are written to disk, it is called a hive flush.
✔✔HKEY_CLASSES_ROOT - ✔✔Includes information about which filename
extensions map to particular applications.
,✔✔HKEY_CURRENT_USER - ✔✔Stores settings that concern the current logged on
user.
✔✔HKEY_LOCAL_MACHINE - ✔✔Contains the majority of the configuration
information for the software / hardware you have installed and for the OS itself.
✔✔HKEY_USERS - ✔✔Stores data corresponding to all users who have ever logged
on to the computer.
✔✔Cloud-Based Email - ✔✔All email has been located on an email server, but if the
email resides on the server rather than locally on the workstation, then it is cloud-based.
Most corporate environments employ dedicated mail servers.
✔✔Host-Based Email - ✔✔Any email archive stored locally on a computer, independent
of an email server. Typically uses an index file that acts as a table of contents and
stores metadata. A separate message store houses the email messages themselves.
✔✔Image Mounting - ✔✔The benefit to mounting images is that it is seen as a mounted
filesystem, so you can interact with files with their native or associated application, run
antivirus and malware detection, share with remote computers, and copy files out of the
image. It is also forensically sound.
✔✔Index.dat - ✔✔Prior to IE10, index.dat files were used to store metadata for browser
history, cache, cookies, and download history.
✔✔Journaling - ✔✔A filesystem function that makes use of a log file to track changes to
the metadata to track the state and integrity of the filesystem at all times.
✔✔Jumplist - ✔✔Allows users to jump to items they frequent. These are the icons you
see if you right click on an app in the taskbar. Provides another location to verify the
opening and/or creation of non-executable files. Helps identify wiped/deleted files had
existed at one point.
✔✔LastVisitedMRU - ✔✔Tracks the specific executable used by an application to open
the files documented in the OpenSaveMRU key. Each value also tracks the directory
location for the last file that was accessed by that application. This is how OpenSave
dialog box shows where you last opened a file from.
✔✔Layout.ini - ✔✔Contains the original path names of the files located in the Prefetch
✔✔Local Security Authority Subsystem Service (LSASS) - ✔✔Responsible for enforcing
the security policy on the system
, ✔✔Low (Low Folder) - ✔✔A duplicate set of directories is necessary to store files form
unprivileged use, since not all activities using the browser are unprivileged. Most of our
internet usage should be found in the low folders.
✔✔Mail Transfer Agent (MTA) - ✔✔Formal name for mail server software
✔✔Extended MAPI Headers - ✔✔Core component of Exchange and Outlook
messaging architecture. Significantly increases email header properties by adding
additional timestamps, unique identifiers, and information on actions taken on the
message itself.
✔✔Master Boot Record (MBR) - ✔✔The first sector on a hard drive, which contains the
partition table and a program the BIOS uses to boot an OS from the drive.
✔✔Memory Aquisition - ✔✔Necessary to acquire volatile data. Without a memory
image, there is a little chance to bypass whole disk encryption. This is where a massive
amount of useful user-attributed data lives. You can find running processes, open files,
encryption keys and passwords, network connections, configuration parameters, and
memory-only exploits / rootkits.
✔✔Message Tracing - ✔✔Log recording a wealth of details about sent and received
messages in the organization.
✔✔Message-ID - ✔✔Provided by the originating mail server and consists of a unique ID
appended to the server name with an @ symbol. Similar to a tracking number.
✔✔Master File Table (MFT) - ✔✔NTFS uses this database to store a link to files. It
contains information about access rights, date and time stamps, system attributes, and
other information about files. Makes up the first section of the disk.
✔✔MFU - ✔✔Closely associated with MRU.
✔✔MIME - ✔✔End-to-End protocol and enables users to digitally sign and encrypt
messages. Most common type of encryption encountered in emails. Typically encodes
email attachments too.
✔✔Mobile Email - ✔✔Many smartphones are synced to a corporate mail server and
maintain only copies of emails. The device could have messages on it that would be
difficult to get elsewhere. Consider MDM as well.
✔✔Modern Standby (MS) - ✔✔Makes computers operate more like mobile devices by
delivering low-power consumption and enables low-power communications (Wi-Fi,
mobile broadband, and Ethernet) to receive essential communication while reducing the
time for the computer to wake and be fully operational. This extends the life of RAM
SET A+
✔✔EMDMgmt - ✔✔Traditionally used for ReadyBoost to remember whether it passed
inspection. Each key in it provides the USB device manufacturer, ID, Serial Number,
Volume Name, and Volume Serial Number.
✔✔ESE Database - ✔✔A proprietary Microsoft database format. Can be broken up into
multiple storage groups, each able to contain multiple database files.
✔✔Exif Data - ✔✔Also called metadata, this is information electronically attached to
each image file, such as shutter speed, aperture, ISO, lens length, white balance, and
other settings used when taking the picture.
✔✔File Carving - ✔✔The process of recovering intact files from memory or unallocated
space. It is done by scanning for known file headers at cluster boundaries and carve a
file out based on a "predicted" length or until a known footer is found. Generally results
in a lot of false positives.
✔✔File Header - ✔✔A sequence of bytes that are generally unique to each file found at
the beginning of the file itself.
✔✔File MRU - ✔✔This key will list many of the recent documents, spreadsheets, and
PowerPoint presentation that the user has opened. This key can go much further back
in time than RecentDocs, due to having more space and not needing to overwrite the
data as fast.
✔✔Hive Flush - ✔✔In a dirty hive situation, where transaction log files contain data not
yet written to the registry, when the changes are written to disk, it is called a hive flush.
✔✔HKEY_CLASSES_ROOT - ✔✔Includes information about which filename
extensions map to particular applications.
,✔✔HKEY_CURRENT_USER - ✔✔Stores settings that concern the current logged on
user.
✔✔HKEY_LOCAL_MACHINE - ✔✔Contains the majority of the configuration
information for the software / hardware you have installed and for the OS itself.
✔✔HKEY_USERS - ✔✔Stores data corresponding to all users who have ever logged
on to the computer.
✔✔Cloud-Based Email - ✔✔All email has been located on an email server, but if the
email resides on the server rather than locally on the workstation, then it is cloud-based.
Most corporate environments employ dedicated mail servers.
✔✔Host-Based Email - ✔✔Any email archive stored locally on a computer, independent
of an email server. Typically uses an index file that acts as a table of contents and
stores metadata. A separate message store houses the email messages themselves.
✔✔Image Mounting - ✔✔The benefit to mounting images is that it is seen as a mounted
filesystem, so you can interact with files with their native or associated application, run
antivirus and malware detection, share with remote computers, and copy files out of the
image. It is also forensically sound.
✔✔Index.dat - ✔✔Prior to IE10, index.dat files were used to store metadata for browser
history, cache, cookies, and download history.
✔✔Journaling - ✔✔A filesystem function that makes use of a log file to track changes to
the metadata to track the state and integrity of the filesystem at all times.
✔✔Jumplist - ✔✔Allows users to jump to items they frequent. These are the icons you
see if you right click on an app in the taskbar. Provides another location to verify the
opening and/or creation of non-executable files. Helps identify wiped/deleted files had
existed at one point.
✔✔LastVisitedMRU - ✔✔Tracks the specific executable used by an application to open
the files documented in the OpenSaveMRU key. Each value also tracks the directory
location for the last file that was accessed by that application. This is how OpenSave
dialog box shows where you last opened a file from.
✔✔Layout.ini - ✔✔Contains the original path names of the files located in the Prefetch
✔✔Local Security Authority Subsystem Service (LSASS) - ✔✔Responsible for enforcing
the security policy on the system
, ✔✔Low (Low Folder) - ✔✔A duplicate set of directories is necessary to store files form
unprivileged use, since not all activities using the browser are unprivileged. Most of our
internet usage should be found in the low folders.
✔✔Mail Transfer Agent (MTA) - ✔✔Formal name for mail server software
✔✔Extended MAPI Headers - ✔✔Core component of Exchange and Outlook
messaging architecture. Significantly increases email header properties by adding
additional timestamps, unique identifiers, and information on actions taken on the
message itself.
✔✔Master Boot Record (MBR) - ✔✔The first sector on a hard drive, which contains the
partition table and a program the BIOS uses to boot an OS from the drive.
✔✔Memory Aquisition - ✔✔Necessary to acquire volatile data. Without a memory
image, there is a little chance to bypass whole disk encryption. This is where a massive
amount of useful user-attributed data lives. You can find running processes, open files,
encryption keys and passwords, network connections, configuration parameters, and
memory-only exploits / rootkits.
✔✔Message Tracing - ✔✔Log recording a wealth of details about sent and received
messages in the organization.
✔✔Message-ID - ✔✔Provided by the originating mail server and consists of a unique ID
appended to the server name with an @ symbol. Similar to a tracking number.
✔✔Master File Table (MFT) - ✔✔NTFS uses this database to store a link to files. It
contains information about access rights, date and time stamps, system attributes, and
other information about files. Makes up the first section of the disk.
✔✔MFU - ✔✔Closely associated with MRU.
✔✔MIME - ✔✔End-to-End protocol and enables users to digitally sign and encrypt
messages. Most common type of encryption encountered in emails. Typically encodes
email attachments too.
✔✔Mobile Email - ✔✔Many smartphones are synced to a corporate mail server and
maintain only copies of emails. The device could have messages on it that would be
difficult to get elsewhere. Consider MDM as well.
✔✔Modern Standby (MS) - ✔✔Makes computers operate more like mobile devices by
delivering low-power consumption and enables low-power communications (Wi-Fi,
mobile broadband, and Ethernet) to receive essential communication while reducing the
time for the computer to wake and be fully operational. This extends the life of RAM
