Midterm Prep

1

According to the National Institute of Standards and Technology (NIST), digital forensics involves scientifically examining and analyzing data from computer storage media so that it can be used as evidence in court.

1

All suspected industrial espionage cases should be treated as civil case investigations.

1

User groups for a specific type of system can be very useful in a forensics investigation.

1

Most digital investigations in the private sector involve misuse of computing assets.

1

If you turn evidence over to law enforcement and begin working under their direction, you have become an agent of law enforcement, and are subject to the same restrictions on search and seizure as a law enforcement agent.

1

Signed into law in 1973, the _______ was/were created to ensure consistency in federal proceedings.

1

Which amendment to the U.S. Constitution protects everyone's right to be secure in their person, residence, and property from search and seizure?

1

Which Microsoft OS below is the least intrusive to disks in terms of changing data?

1

_______ is not recommended for a digital forensics workstation.

1

Within a computing investigation, the ability to perform a series of steps again and again to produce the same results is known as _______.

1

If a police officer or investigator has sufficient cause to support a search warrant, the prosecuting attorney might direct him or her to submit a(n) _______.

1

_______ describes an accusation of fact that a crime has been committed.

1

_______ is not one of the functions of the investigations triad.

1

In what year was the Computer Fraud and Abuse Act passed?

1

The _______ is not one of the three stages of a typical criminal case.

1

After a judge approves and signs a search warrant, the _______ is responsible for the collection of evidence as defined by the warrant.

1

The _______ is responsible for analyzing data and determining when another specialist should be called in to assist with analysis.

1

The sale of sensitive or confidential company information to a competitor is known as _______.

1

Which option below is not a standard systems analysis step?

1

A chain-of-evidence form, which is used to document what has and has not been done with the original evidence and forensic copies of the evidence, is also known as a(n) _______.

1

An evidence custody form does not usually contain _______.

1

What tool, currently maintained by the IRS Criminal Investigation Division and limited to use by law enforcement, can analyze and read special files that are copies of a disk?

1

The term _______ describes a database containing informational records about crimes that have been committed previously by a criminal.

1

_______ must be included in an affidavit to support an allegation in order to justify a warrant.

1

After the evidence has been presented in a trial by jury, the jury must deliver a(n) _______.

1

Linux Live CDs and WinFE disks do not automatically mount hard drives, but can be used to view file systems.

1

The shielding of sensitive computing systems and prevention of electronic eavesdropping of any computer emissions is known as FAUST by the U.S. Department of Defense.

1

The recording of all updates made to a workstation or machine is referred to as configuration management.

1

A disaster recovery plan ensures that workstations and file servers can be restored to their original condition in the event of a catastrophe.

1

Because they are outdated, ribbon cables should not be considered for use within a forensics lab.

1

Candidates who complete the IACIS test successfully are designated as a _______.

1

What certification program, sponsored by ISC2, requires knowledge of digital forensics, malware analysis, incident response, e-discovery, and other disciplines related to cyber investigations?

1

How long are computing components designed to last in a normal business environment?

1

Which of the following scenarios should be covered in a disaster recovery plan?

1

Which operating system listed below is not a distribution of the Linux OS?

1

_______ describes the characteristics of a safe storage container.

1

In order to qualify for the Certified Computer Forensic Technician, Basic Level certification, how many hours of computer forensics training are required?

1

Which file system below is utilized by the Xbox gaming system?

1

Which ISO standard below is followed by the ASCLD?

1

_______ is responsible for creating and monitoring lab policies for staff, and provides a safe and secure workplace for staff and evidence.

1

What percentage of consumers utilize Intel and AMD PCs?

1

_______ can be used to restore backup files directly to a workstation.

1

How often should hardware be replaced within a forensics lab?

1

A TEMPEST facility is designed to accomplish which of the following goals?

1

In order to qualify for the Advanced Certified Computer Forensic Technician certification, a candidate must have _______ years of hands-on experience in computer forensics investigations.

1

In order to qualify for the Certified Computer Crime Investigator, Basic Level certification, candidates must provide documentation of at least _______ cases in which they participated.

1

Which tool below is not recommended for use in a forensics lab?

1

Which option below is not a recommendation for securing storage containers?

1

Which option below is not one of the recommended practices for maintaining a keyed padlock?

1

_______ is a specialized viewer software program.

1

Hardware and software errors or incompatibilities are a common problem when dealing with older hard drives.

1

A forensics investigator should verify that acquisition tools can copy data in the HPA of a disk drive.

1

FTK Imager software can acquire a drive's host protected area.

1

The ImageUSB utility can be used to create a bootable flash drive.

1

Which option below is not a hashing function used for validation checks?

1

The Linux command _____ can be used to write bit-stream data to files.

1

Which option below is not a Linux Live CD meant for use as a digital forensics tool?

1

The _______ command was developed by Nicholas Harbour of the Defense Computer Forensics Laboratory.

1

Which RAID type utilizes mirrored striping, providing fast access and redundancy?

1

Within the fdisk interactive menu, what character should be entered to view existing partitions?

1

When using a target drive that is FAT32 formatted, what is the maximum size limitation for split files?

1

Which RAID type provides increased speed and data storage capability, but lacks redundancy?

1

Which RAID type utilizes a parity bit and allows for the failure of one drive without losing data?

1

_______ creates a virtual volume of a RAID image file, and then makes repairs on the virtual volume, which can then be restored to the original RAID.

1

_______ is the utility used by the ProDiscover program for remote access.

1

The _______ copies evidence of intrusions to an investigation workstation automatically for further analysis over the network.

1

Which open-source acquisition format is capable of producing compressed or uncompressed image files, and uses the .afd extension for segmented image files?

1

What is the name of the Microsoft solution for whole disk encryption?

1

Which technology below is not a hot-swappable technology?

1

Computer-stored records are data the system maintains, such as system log files and proxy server logs.

1

An emergency situation under the PATRIOT Act is defined as the immediate risk of death or personal injury, such as finding a bomb threat in an e-mail.

1

The Fourth Amendment states that only warrants "particularly describing the place to be searched and the persons or things to be seized" can be issued. The courts have determined that this phrase means a warrant can authorize a search of a specific place for anything.

1

State public disclosure laws apply to state records, but FOIA allows citizens to request copies of public documents created by federal agencies.

1

To investigate employees suspected of improper use of company digital assets, a company policy statement about misuse of digital assets allows corporate investigators to conduct covert surveillance with little or no cause, and access company computer systems and digital devices without a warrant.

1

_______ would not be found in an initial-response field kit.

1

_______ is a common cause for lost or corrupted evidence.

1

What does FRE stand for?

1

If practical, _______ team(s) should collect and catalog digital evidence at a crime scene or lab.

1

_______ is the term for a statement that is made by someone other than an actual witness to the event while testifying at a hearing.

1

You must abide by the _______ while collecting evidence.

1

Which of the following is not done when preparing for a case?

1

A _______ is not a private sector organization.

1

In cases that involve dangerous settings, what kind of team should be used to recover evidence from the scene?

1

_______ are a special category of private sector businesses, due to their ability to investigate computer abuse committed by employees only, but not customers.

1

The ability to obtain a search warrant from a judge that authorizes a search and seizure of specific evidence requires sufficient _______.

1

Which court case established that it is not necessary for computer programmers to testify in order to authenticate computer-generated records?

1

What should you do while copying data on a suspect's computer that is still live?

1

The term _______ describes rooms filled with extremely large disk systems that are typically used by large business data centers.

1

_______ does not recover data in free or slack space.

1

When seizing digital evidence in criminal investigations, whose standards should be followed?

1

The term _______ is used to describe someone who might be a suspect or someone with additional knowledge that can provide enough evidence of probable cause for a search warrant or arrest.

1

What type of media has a 30-year lifespan?

1

As a general rule, what should be done by forensics experts when a suspect computer is seized in a powered-on state?

1

Which system below can be used to quickly and accurately match fingerprints in a database?

1

A computer stores system configuration and date and time information in the BIOS when power to the system is off.

1

When data is deleted on a hard drive, only references to it are removed, which leaves the original data on unallocated disk space.

1

Someone who wants to hide data can create hidden partitions or voids- large unused gaps between partitions on a disk drive. Data that is hidden in partition gaps cannot be retrieved by forensics utilities.

1

FAT32 is used on older Microsoft OSs, such as MS-DOS 3.0 through 6.22, Windows 95 (first release), and Windows NT 3.3 and 4.0.

1

Each MFT record starts with a header identifying it as a resident or nonresident attribute.

1

A typical disk drive stores how many bytes in a single sector?

1

Most manufacturers use what technique in order to deal with the fact that a platter's inner tracks have a smaller circumference than the outer tracks?

1

What hexadecimal code below identifies an NTFS file system in the partition table?

1

When using the File Allocation Table (FAT), where is the FAT database typically written to?

1

Select below the file system that was developed for mobile personal storage devices, such as flash memory devices, secure digital eXtended capacity (SDCX), and memory sticks:

1

What term is used to describe a disk's logical structure of platters, tracks, and sectors?

1

A Master Boot Record (MBR) partition table marks the first partition starting at what offset?

1

The ___________ command inserts a HEX E5 (0xE5) in a filename's first letter position in the associated directory entry.

1

What metadata record in the MFT keeps track of previous transactions to assist in recovery after a system failure in an NTFS volume?

1

What command below can be used to decrypt EFS files?

1

Which of the following commands creates an alternate data stream?

1

What term below describes a column of tracks on two or more disk platters?

1

Which of the following is not a valid configuration of Unicode?

1

What does the MFT header field at offset 0x00 contain?

1

The ReFS storage engine uses a __________ sort method for fast access to large data sets.

1

What third party encryption tool creates a virtual encrypted volume, which is a file mounted as though it were a disk drive?

1

The _________ branches in HKEY_LOCAL_MACHINE\Software consist of SAM, Security, Components, and System.

1

What registry file contains user account management and security settings?

1

What registry file contains installed programs' settings and associated usernames and passwords?

1

Addresses that allow the MFT to link to nonresident files are known as _______________.

1

Software forensics tools are grouped into command-line applications and GUI applications

1

Making a logical acquisition of a drive with whole disk encryption can result in unreadable files.

1

Physically copying the entire drive is the only type of data-copying method used in software acquisitions.

1

ISO standard 27037 states that the most important factors in data acquisition are the DEFR's competency and the use of validated tools.

1

All forensics acquisition tools have a method for verification of the data-copying process that compares the original drive with the image.

1

What tool below was written for MS-DOS and was commonly used for manual digital investigations?

1

In general, what would a lightweight forensics workstation consist of?

1

In what mode do most software write-blockers run?

1

Reconstructing fragments of files that have been deleted from a suspect drive, is known as ____________ in North America.

1

The ProDiscover utility makes use of the proprietary _______________ file format.

1

What is the purpose of the reconstruction function in a forensics investigation?

1

Which of the following options is not a subfunction of extraction?

1

In what temporary location below might passwords be stored?

1

The __________ Linux Live CD includes tools such as Autopsy and Sleuth Kit, ophcrack, dcfldd, MemFetch, and MBoxGrep, and utilizes a KDE interface.

1

What option below is an example of a platform specific encryption tool?

1

What hex value is the standard indicator for jpeg graphics files?

1

Passwords are typically stored as one-way _____________ rather than in plaintext.

1

What program serves as the GUI front end for accessing Sleuth Kit's tools?

1

Which of the following is stated within the ISO 27037 standard?

1

The physical data copy subfunction exists under the ______________ function.

1

A keyword search is part of the analysis process within what forensic function?

1

What algorithm is used to decompress Windows files?

1

What is the goal of the NSRL project, created by NIST?

1

When performing disk acquisition, the raw data format is typically created with the UNIX/Linux _____________ command.

1

_______________ proves that two sets of data are identical by calculating hash values or using another similar method.

since I am required to include a description here it is... happy?

Midterm Prep

​According to the National Institute of Standards and Technology (NIST), digital forensics involves scientifically examining and analyzing data from computer storage media so that it can be used as evidence in court.

All suspected industrial espionage cases should be treated as civil case investigations.​

User groups for a specific type of system can be very useful in a forensics investigation.​

Most digital investigations in the private sector involve misuse of computing assets.

If you turn evidence over to law enforcement and begin working under their direction, you have become an agent of law enforcement, and are subject to the same restrictions on search and seizure as a law enforcement agent.​

Signed into law in 1973, the _______ was/were created to ensure consistency in federal proceedings.

Which amendment to the U.S. Constitution protects everyone's right to be secure in their person, residence, and property from search and seizure?

Which Microsoft OS below is the least intrusive to disks in terms of changing data?​

_______ is not recommended for a digital forensics workstation.

​Within a computing investigation, the ability to perform a series of steps again and again to produce the same results is known as _______.

If a police officer or investigator has sufficient cause to support a search warrant, the prosecuting attorney might direct him or her to submit a(n) _______.​

_______ describes an accusation of fact that a crime has been committed.

_______ is not one of the functions of the investigations triad.

In what year was the Computer Fraud and Abuse Act passed?​

​The _______ is not one of the three stages of a typical criminal case.

​After a judge approves and signs a search warrant, the _______ is responsible for the collection of evidence as defined by the warrant.

The _______ is responsible for analyzing data and determining when another specialist should be called in to assist with analysis.

The sale of sensitive or confidential company information to a competitor is known as _______.

Which option below is not a standard systems analysis step?​

A chain-of-evidence form, which is used to document what has and has not been done with the original evidence and forensic copies of the evidence, is also known as a(n) _______.

According to the National Institute of Standards and Technology (NIST), digital forensics involves scientifically examining and analyzing data from computer storage media so that it can be used as evidence in court.

All suspected industrial espionage cases should be treated as civil case investigations.

User groups for a specific type of system can be very useful in a forensics investigation.

If you turn evidence over to law enforcement and begin working under their direction, you have become an agent of law enforcement, and are subject to the same restrictions on search and seizure as a law enforcement agent.

Which Microsoft OS below is the least intrusive to disks in terms of changing data?

Within a computing investigation, the ability to perform a series of steps again and again to produce the same results is known as _______.

If a police officer or investigator has sufficient cause to support a search warrant, the prosecuting attorney might direct him or her to submit a(n) _______.

In what year was the Computer Fraud and Abuse Act passed?

The _______ is not one of the three stages of a typical criminal case.

After a judge approves and signs a search warrant, the _______ is responsible for the collection of evidence as defined by the warrant.

Which option below is not a standard systems analysis step?

An evidence custody form does not usually contain _______.

What tool, currently maintained by the IRS Criminal Investigation Division and limited to use by law enforcement, can analyze and read special files that are copies of a disk?

Linux Live CDs and WinFE disks do not automatically mount hard drives, but can be used to view file systems.

The shielding of sensitive computing systems and prevention of electronic eavesdropping of any computer emissions is known as FAUST by the U.S. Department of Defense.

What certification program, sponsored by ISC2, requires knowledge of digital forensics, malware analysis, incident response, e-discovery, and other disciplines related to cyber investigations?

How long are computing components designed to last in a normal business environment?

Which of the following scenarios should be covered in a disaster recovery plan?

In order to qualify for the Certified Computer Forensic Technician, Basic Level certification, how many hours of computer forensics training are required?