Midterm Study 2

1

The first 3 bytes of an XIF file are exactly the same as a TIF file.

1

Graphics files are created and saved in a graphics editor, such as Microsoft Paint, Adobe Freehand MX, Adobe Photoshop, or Gnome GIMP.

1

Most digital cameras use the bitmap format to store photos.

1

When you decompress data that uses a lossy compression algorithm, you regain data lost by compression.

1

Each graphics file type has a unique header value.

1

How many bits are required to create a pixel capable of displaying 65,536 different colors?

1

Which of the following is not considered to be a non-standard graphics file format?

1

All TIF files start at offset 0 with what 6 hexadecimal characters?

1

What kind of graphics file combines bitmap and vector graphics types?

1

The process of converting raw picture data to another format is called _________________.

1

What format was developed as a standard for storing metadata in image files?

1

Which of the following formats is not considered to be a standard graphics file format?

1

Select below the utility that is not a lossless compression utility:

1

In simple terms, _____________ compression discards bits in much the same way rounding off decimal values discards numbers.

1

What file type starts at offset 0 with a hexidecimal value of FFD8?

1

How many different colors can be displayed by a 24 bit colored pixel?

1

The _____________ format is a proprietary format used by Adobe Photoshop.

1

For EXIF JPEG files, the hexadecimal value starting at offset 2 is _____________.

1

Referred to as a digital negative, the _______ is typically used on many higher-end digital cameras.

1

The Lempel-Ziv-Welch (LZW) algorithm is used in _____________ compression.

1

For all JPEG files, the ending hexadecimal marker, also known as the end of image (EOI), is ____________.

1

Which graphics file format below is rarely compressed?

1

When looking at a byte of information in binary, such as 11101100, what is the first bit on the left referred to as?

1

What act defines precisely how copyright laws pertain to graphics?

1

Which of the following is not a type of graphic file that is created by a graphics program?

1

Because attorneys do not have the right of full discovery of digital evidence, it is not possible for new evidence to come to light while complying with a defense request for full discovery.

1

One of the most critical aspects of digital forensics is validating digital evidence because ensuring the integrity of data you collect is essential for presenting evidence in court.

1

The advantage of recording hash values is that you can determine whether data has changed.

1

In private sector cases, like criminal and civil cases, the scope is always defined by a search warrant.

1

Advanced hexadecimal editors offer many features not available in digital forensics tools, such as hashing speciﬁc ﬁles or sectors.

1

What format below is used for VMware images?

1

In which file system can you hide data by placing sensitive or incriminating data in free or slack space on disk partition clusters?

1

Which password recovery method uses every possible letter, number, and character found on a keyboard?

1

The goal of recovering as much information as possible can result in ________________, in which an investigation expands beyond the original description because of unexpected evidence found.

1

Which of the following file systems can't be analyzed by OSForensics?

1

In Windows, the ______________ command can be used to both hide and reveal partitions within Explorer.

1

Select the tool below that does not use dictionary attacks or brute force attacks to crack passwords:

1

Within Windows Vista and later, partition gaps are _____________ bytes in length.

1

Which option below is not a disk management tool?

1

Typically, anti-virus tools run hashes on potential malware files, but some advanced malware uses ________________ as a way to hide its malicious code from antivirus tools.

1

A user with programming experience may use an assembler program (also called a __________ ) on a file to scramble bits, in order to secure the information contained inside.

1

What letter should be typed into DiskEdit in order to mark a good sector as bad?

1

Many commercial encryption programs use a technology called _____________, which is designed to recover encrypted data if users forget their passphrases or if the user key is corrupted after a system failure.

1

What technique is designed to reduce or eliminate the possibility of a rainbow table being used to discover passwords?

1

When performing a static acquisition, what should be done after the hardware on a suspect's computer has been inventoried and documented?

1

In order to aid a forensics investigation, a hardware or software ______________ can be utilized to capture keystrokes remotely.

1

The AccessData program has a hashing database, ________________, which is available only with FTK, and can be used to filter known program files from view and contains the hash values of known illegal files.

1

The term for detecting and analyzing steganography files is _________________.

1

A ____________ image file containing software is intended to be bit-stream copied to floppy disks or other external media.

1

The _______________________ maintains a national database of updated file hash values for a variety of OSs, applications, and images, but does not list hash values of known illegal files.

1

Type 2 hypervisors are typically loaded on servers or workstations with a lot of RAM and storage.

1

Forensics tools can't directly mount VMs as external drives.

1

The capability of type 1 hypervisors is limited only by the amount of available RAM, storage, and throughput.

1

The Honeynet Project was developed to make information widely available in an attempt to thwart Internet and network attackers.

1

The Sysinternals Handle utility shows only file system activity, but does not show what processes are using files on the file system.

1

What virtual machine software supports all Windows and Linux OSs as well as Macintosh and Solaris, and is provided as shareware?

1

The __________ disk image file format is associated with the VirtualBox hypervisor.

1

What Windows Registry key contains associations for file extensions?

1

In VirtualBox, ____________ different types of virtual network adapters are possible, such as AMD and Intel Pro adapters

1

The SANS Investigative Forensics Toolkit (SIFT) appliance can currently only be installed on what version of Ubuntu?

1

Select below the option that is not a common type 1 hypervisor:

1

The NSA's defense in depth (DiD) strategy contains three modes of protection. Which option below is not one of the three modes?

1

The _______________ command line program is a common way of examining network traffic, which provides records of network activity while it is running, and produce hundreds or thousands of records.

1

Select below the program within the PsTools suite that allows you to run processes remotely:

1

The tcpdump and Wireshark utilities both use what well known packet capture format?

1

The ___________________ is a good tool for extracting information from large Libpcap files; you simply specify the time frame you want to examine.

1

The _____________________ tool is an updated version of BackTrack, and contains more than 300 tools, such as password crackers, network sniffers, and freeware forensics tools.

1

In Windows, what PowerShell cmdlet can be used in conjunction with Get-VM to display a virtual machine's network adapters?

1

What file type below, associated with VMWare, stores VM paging files that are used as RAM for a virtual machine?

1

What processor instruction set is required in order to utilize virtualization software?

1

Select the file below that is used in VirtualBox to create a virtual machine:

1

The __________________ is the version of Pcap available for Linux based operating systems.

1

What utility is best suited to examine e-mail headers or chat logs, or network communication between worms and viruses?

1

At what layers of the OSI model do most packet analyzers function?

1

In a __________ attack, the attacker keeps asking your server to establish a connection, with the intent of overloading a server with established connections.

1

The DomainKeys Identified Mail service is a way to verify the names of domains a message is flowing through and was developed as a way to cut down on spam.

1

The Pagefile.sys file on a computer can contain message fragments from instant messaging applications.

1

In an e-mail address, everything before the @ symbol represents the domain name.

1

Committing crimes with e-mail is uncommon, and investigators are not generally tasked with linking suspects to e-mail.

1

An Internet e-mail server is generally part of a local network, and is maintained and managed by an administrator for internal use by a specific company.

1

What command below could be used on a UNIX system to help locate log directories?

1

The _______________ utility can be used to repair .ost and .pst files, and is included with Microsoft Outlook.

1

E-mail administrators may make use of _________________, which overwrites a log file when it reaches a specified size or at the end of a specified time frame.

1

Syslog is generally configured to put all e-mail related log information into what file?

1

What kind of files are created by Exchange while converting binary data to readable text in order to prevent loss of data?

1

On a UNIX system, where is a user's mail stored by default?

1

Where does the Postfix UNIX mail server store e-mail?

1

One of the most noteworthy e-mail scams was 419, otherwise known as the _______________.

1

What information is not typically included in an e-mail header?

1

In older versions of exchange, what type of file was responsible for messages formatted with Messaging Application Programming Interface, and served as the database file?

1

What type of Facebook profile is usually only given to law enforcement with a warrant?

1

Which option below is the correct path to the sendmail configuration file?

1

In what state is sending unsolicited e-mail illegal?

1

What service below can be used to map an IP address to a domain name, and then find the domain name's point of contact?

1

Which e-mail recovery program below can recover files from VMware and VirtualPC virtual machines, as well as ISOs and other types of file backups?

1

Exchange uses an Exchange database and is based on the _______________________, which uses several files in different combinations to provide e-mail service.

1

The Suni Munshani v. Signal Lake Venture Fund II, LP et al case is an example of a case that involves e-mail ____________.

1

In order to retrieve logs from exchange, the PowerShell cmdlet _______________________ can be used.

1

Select the program below that can be used to analyze mail from Outlook, Thunderbird, and Eudora.

1

Which service below does not put log information into /var/log/maillog?

1

What frequencies can be used by GSM with the TDMA technique?

1

What digital network technology is a digital version of the original analog standard for cell phones?

1

The _______________ component is made up of radio transceiver equipment that defines cells and communicates with mobile phones; sometimes referred to as a "cell phone tower".

1

What organization is responsible for the creation of the requirements for carriers to be considered 4G?

1

Nonvolatile memory on a mobile device can contain OS files and stored user data, such as a __________________ and backed-up files.

1

The ___________________ technology is designed for GSM and Universal Mobile Telecommunications Systems (UMTS) technology, supports 45 Mbps to 144 Mbps transmission speeds.

1

Which of the NIST guidelines below requires using a modified boot loader to access RAM for analysis?

1

GSM refers to mobile phones as "mobile stations" and divides a station into two parts, the __________ and the mobile equipment (ME).

1

What digital network technology was developed during World War II?

1

What type of mobile forensics method listed by NIST guidelines involves looking at a device's content page by page and taking pictures?

1

What method below is not an effective method for isolating a mobile device from receiving signals?

1

Select below the option that is not a typical feature of smartphones on the market today:

1

What standard introduced sleep mode to enhance battery life, and is used with TDMA?

1

Within NIST guidelines for mobile forensics methods, the ______________ method requires physically removing flash memory chips and gathering information at the binary level.

1

On what mobile device platform does Facebook use a SQLite database containing friends, their ID numbers, and phone numbers as well as files that tracked all uploads, including pictures?

1

Where is the OS stored on a smartphone?

1

The ________________ technology uses the IEEE 802.16e standard and Orthogonal Frequency Division Multiple Access (OFDMA) and supports transmission speeds of 12 Mbps

1

Which of the following is not a type of peripheral memory card used in PDAs?

1

Which component of cell communication is used to route digital packets for the network and relies on a database to support subscribers?

1

Most Code Division Multiple Access (CDMA) networks conform to ____________ , created by the Telecommunications Industry Association (TIA).

1

The use of smart phones for illicit activities is becoming more prevalent.

1

Because mobile phones are seized at the time of arrest, a search warrant is not necessary to examine the device for information.

1

Most Code Division Multiple Access networks conform to IS-95. The systems are referred to as CDMAOne, and when they went to 3G service, they became CDMAThree.

1

While travelling internationally with a GSM phone, you can pop in a SIM card for the country you're currently in, rather than get a new phone.

1

Search and seizure procedures for mobile devices are as important as procedures for computers.

This is a midterm study guide. Hopefully all answers were entered correctly :)

Midterm Study 2

Midterm Study 2

The first 3 bytes of an XIF file are exactly the same as a TIF file.​

Graphics files are created and saved in a graphics editor, such as Microsoft Paint, Adobe Freehand MX, Adobe Photoshop, or Gnome GIMP.​

Most digital cameras use the bitmap format to store photos.​

When you decompress ​data that uses a lossy compression algorithm, you regain data lost by compression.

Each graphics file type has a unique header value.​

​How many bits are required to create a pixel capable of displaying 65,536 different colors?

Which of the following is not considered to be a non-standard graphics file format?​

All TIF files start at offset 0 with what 6 hexadecimal characters?​

What kind of graphics file combines bitmap and vector graphics types?​

The process of converting raw picture data to another format is called _________________.​

What format was developed as a standard for storing metadata in image files?

Which of the following formats is not considered to be a standard graphics file format?

Select below the utility that is not a lossless compression utility:

In simple terms, _____________ compression ​discards bits in much the same way rounding off decimal values discards numbers.

What file type starts at offset 0 with a hexidecimal value of FFD8?​

How many different colors can be displayed by a 24 bit colored pixel?​

The _____________ format is a proprietary format used by Adobe Photoshop.

For EXIF JPEG files, the hexadecimal value starting at offset 2 is _____________.

Referred to as a digital negative, the _______ is typically used on many higher-end digital cameras.​

The first 3 bytes of an XIF file are exactly the same as a TIF file.

Graphics files are created and saved in a graphics editor, such as Microsoft Paint, Adobe Freehand MX, Adobe Photoshop, or Gnome GIMP.

Most digital cameras use the bitmap format to store photos.

When you decompress data that uses a lossy compression algorithm, you regain data lost by compression.

Each graphics file type has a unique header value.

How many bits are required to create a pixel capable of displaying 65,536 different colors?

Which of the following is not considered to be a non-standard graphics file format?

All TIF files start at offset 0 with what 6 hexadecimal characters?

What kind of graphics file combines bitmap and vector graphics types?

The process of converting raw picture data to another format is called _________________.

In simple terms, _____________ compression discards bits in much the same way rounding off decimal values discards numbers.

What file type starts at offset 0 with a hexidecimal value of FFD8?

How many different colors can be displayed by a 24 bit colored pixel?

Referred to as a digital negative, the _______ is typically used on many higher-end digital cameras.

The Lempel-Ziv-Welch (LZW) algorithm is used in _____________ compression.

For all JPEG files, the ending hexadecimal marker, also known as the end of image (EOI), is ____________.

When looking at a byte of information in binary, such as 11101100, what is the first bit on the left referred to as?

Which of the following is not a type of graphic file that is created by a graphics program?

Because attorneys do not have the right of full discovery of digital evidence, it is not possible for new evidence to come to light while complying with a defense request for full discovery.

One of the most critical aspects of digital forensics is validating digital evidence because ensuring the integrity of data you collect is essential for presenting evidence in court.

The advantage of recording hash values is that you can determine whether data has changed.

In private sector cases, like criminal and civil cases, the scope is always defined by a search warrant.

Advanced hexadecimal editors offer many features not available in digital forensics tools, such as hashing speciﬁc ﬁles or sectors.

In which file system can you hide data by placing sensitive or incriminating data in free or slack space on disk partition clusters?

Which password recovery method uses every possible letter, number, and character found on a keyboard?

The goal of recovering as much information as possible can result in ________________, in which an investigation expands beyond the original description because of unexpected evidence found.