CHFI Study guides, Class notes & Summaries

CHFI Chapter 5 Questions and Answers 100% Solved When a FAT File is deleted - The OS replaces the first letter of the deleted filename with E5H. Corresponding clusters of that file are marked unused, even though they are not empty. Until these clusters are overwritten, the file can still be recovered. When a NTFS File is deleted - The OS marks the index field in the MFT with a special code. The computer now looks at the clusters occupied by that file as being empty. Until these cluste...

CHFI – Steganography Questions with Answers 100% Solved Image Steganography - Hiding information in image files Document steganography - Adds white spaces and tabs to the ends of the lines Folder Steganography - Hiding one or more files in a folder Video steganography - Hiding files in a video file Audio Steganography - Hidden messages in digital sound White space steganography - User hides messages in ASCII text

CHFI Exam Questions and Answers 100% Solved What is the First Step required in preparing a computer for forensics investigation? Do not turn the computer off or on, run any programs, or attempt to access data on a computer Secure any relevant media Suspend automated document destruction and recycling policies that may pertain to any relevant media or users at Issue Identify the type of data you are seeking, the Information you are looking for, and the urgency level of the examinat...

CHFI - Chapter 7 (Network Forensics) Questions and Answers 100% Solved In this type of attack, the attacker sends messages to the computer with an address that indicates the messages are coming from a trusted host. - IP Address Spoofing This is the process of gathering information about a network that may help in an attacking the network. - Enumeration This attack refers to the exploitation of a session-token generation mechanism or token security controls, such that the attacker can...

CHFI Hard Disks and File Systems Study Set Questions and Answers 100% Solved About a thousand - How many tracks are typically contained on a platter of a 3.5" HDD? Volume Descriptor: Number 0 - refers that the volume descriptor is a boot record Volume Descriptor: Number 1 - refers that the volume descriptor is a primary volume descriptor Volume Descriptor: Number 2 - refers that the volume descriptor is a supplementary volume descriptor Volume Descriptor: Number 3 - refers that...

CHFI Hard Disks and File Systems Study Set Questions and Answers 100% Solved About a thousand - How many tracks are typically contained on a platter of a 3.5" HDD? Volume Descriptor: Number 0 - refers that the volume descriptor is a boot record Volume Descriptor: Number 1 - refers that the volume descriptor is a primary volume descriptor Volume Descriptor: Number 2 - refers that the volume descriptor is a supplementary volume descriptor Volume Descriptor: Number 3 - refers that t...

CHFI test with Complete Solutions 100% Verified do not turn the computer off or on, run any programs, or attempt to access data on a computer - the first step required in preparing a computer for forensics investigation is the sniffing recording acquisition and analysis of the the network traffic and event logs in order to investigate a network security incident - network forensics which of the follwing commands shows you the names of all open shared files on a server and number of f...

CHFI Forensic Rules Study Quiz and Answers 100% Solved Rule 101 - Rules govern proceedings in courts of US Rule 102 - Rules for secure fairness, eliminate unjustifiable expense and delay and promote growth and development of law *trust may be ascertained and proceedings justly determined* Rule 103 - Rulings on evidence Rule 105 - Limited Admissibility Rule 402 - General Admissibility of Relevant Evidence

CHFI Test 1 with Complete Solutions 100% Verified 18 USC §1030 covers: - fraud and related activity in connection with computers This Federal statute covers child pornography. - 18 USC 2252A This rule involves rulings on evidence. - Rule 103 Sara is an Assistant U.S. Attorney. She knows that this rule covers the general admissibility of relevant evidence. - Rule 402 This person provides legal advice about the investigation and any potential legal issues in the forensic investigat...

CHFI Study Guide Questions and Answers 100% Solved What is the first step required in preparing a computer for forensics investigation? - Do not turn the computer off or on, run any programs, or attempt to access data on a computer. True or false? Network forensics can be defined as the sniffing, recording, acquisition and analysis of the network traffic and event logs in order to investigate a network security incident. - True What command shows you the names of all open shared fil...