Knowledge Check: Guide to Computer Forensics and Investigations Post-Assessment

Latrice is working for a firm that specializes in vulnerability/threat assessment and risk management. A client needs Latrice to come in and perform an integrity check. How is an integrity check applied? Choose all that apply.

a. monitors adherence to acceptable use policies

b. conducts authorized attacks on the network to assess vulnerabilities

c. tests for vulnerabilities of OSs and applications used in the network

d. checks the physical security of systems as well as the security of operating systems (OSs) and applications

b. conducts authorized attacks on the network to assess vulnerabilities

c. tests for vulnerabilities of OSs and applications used in the network

d. checks the physical security of systems as well as the security of operating systems (OSs) and applications

Julie works with a private investigator. Her company has been hired by Andor Corp. because the HR department has received complaints about an employee who has been harassing both female and male employees via email. They have been given permission by the company's attorneys to conduct an internal investigation. What private company issues must Julie address when conducting the investigation?

a. Dealing with a serial harasser is more important than the interruption to the business.

b. The perpetrator must be stopped and put in jail.

c. Email harassment is not a problem in today's business environment.

d. Business operations must continue with minimal interruption, and apprehension of the suspect is secondary to stopping the violation and minimizing damage or loss to the business.

d. Business operations must continue with minimal interruption, and apprehension of the suspect is secondary to stopping the violation and minimizing damage or loss to the business.

Kiko is a digital investigator and must follow a strict set of behaviors for professional conduct that she and her colleagues must abide by. What are some of the behaviors she must follow that are considered part of the professional conduct ethos? Choose all that apply.

a. telling her friends what she's up to and posting stories online

b. following a code of ethics

c. looking for ways to monetize (make money from) what she finds

d. maintaining confidentiality

b. following a code of ethics

d. maintaining confidentiality

Constance must investigate an email abuse case for her client; there is a defined acceptable use policy in place, and the email system is the Outlook Client and Exchange Server. Where will she need to look to gather the evidence to perform the investigation? Choose all that apply.

a. email footer

b. .pst or .ost files

c. internet keywords (web-based email)

d. copy of email with header logs, email server logs, and suspect's and victim's email folder or data

b. .pst or .ost files

d. copy of email with header logs, email server logs, and suspect's and victim's email folder or data

Jonathan has been asked to write a forensic report on a case his firm is handling. A forensic report presents evidence and facts. In what types of legal situations are forensic reports used? Choose all that apply.

a. administrative hearing

b. grand jury hearing

c. voir dire hearing

d. motion for continuance hearing

a. administrative hearing

b. grand jury hearing

Jabari is writing a preliminary report. He will create a forensic report when all the data has been gathered. Preliminary reports and forensic reports have statements, but what makes a preliminary report different? Choose all that apply.

a. Preliminary reports are still tentative and subject to change.

b. Preliminary reports can either be written or verbal.

c. Preliminary reports can be used as evidence in court.

d. Preliminary reports are a final source of information.

a. Preliminary reports are still tentative and subject to change.

b. Preliminary reports can either be written or verbal.

Larry was submitting his final report to the attorney he was working for. In the end, he saved it in a password-protected PDF. What reason did Larry have for saving the final document in this manner?

a. to prevent someone from altering it

b. to prevent someone from stealing it

c. to prevent someone from moving it to a different drive

d. to prevent someone from deleting it

a. to prevent someone from altering it

Narek is an expert witness working for the law firm Lathem and Sayzel. In his examination, he discovers negative findings. What procedure must Narek follow now that he's made this discovery?

a. Communicate these findings to the client as soon as possible.

b. Communicate these findings to the judge as soon as possible.

c. Communicate these findings to his attorney as soon as possible.

d. Bury these findings and hope no one discovers them.

c. Communicate these findings to his attorney as soon as possible.

Utama manages a prominent forensics lab in Washington, D.C. Because the lab is so busy, Utama and her staff need to stay on the cutting edge of technology. So what must they do to ensure the quality of their work? Choose all that apply.

a. Continue working and speaking with their peers.

b. Continue their technical training.

c. Maintain a record of their training.

d. Maintain status quo.

b. Continue their technical training.

c. Maintain a record of their training.

Jackie has been tasked with building a TEMPEST-qualified lab. There are strict guidelines for building a TEMPEST lab, and if Jackie doesn't build it correctly, he will not get paid—and may even be sued. What are some of the construction materials that Jackie must use to make a TEMPEST-qualified lab? Choose all that apply.

a. grounded conductive metal sheets

b. standard wiring

c. filters for electrical power

d. special screws and bolts

a. grounded conductive metal sheets

c. filters for electrical power

Arno needs to build a forensic workstation that can quickly crack passwords while still working on other assignments. What type of hardware should Arno buy for this purpose?

a. Multiple Graphics Processing Units (GPUs)

b. Multiple Central Processing Units (CPUs)

c. Multiple DRAM Units

d. Multiple Cooling Units

a. Multiple Graphics Processing Units (GPUs)

Zoe recently finished a special investigation where she had to install a suite of applications. This suite took up a large amount of hard drive space, and she had to remove some existing software to install the forensics suite. Zoe encounters configuration errors and must reinstall specific software. What must Zoe refer to before she begins a system restoration?

a. owner's manual

b. software documentation

c. hard drive manual

d. disaster recovery plan

d. disaster recovery plan

Devin is working with a freeware product using the raw file format. His partner, Josephine, says, "You might want to rethink that and move to a program like FTK Imager. Sometimes there are problems with the source drive." What is Josephine referring to with this statement? Choose all that apply.

a. Data in marginal (bad) sectors on the source drive may not be collected

b. low threshold of retry reads (some programs won't retry enough) on weak media spots on a drive

c. Data isn't natively compressed so you need two drives of the same size

d. Data collection can take hours, even days

a. Data in marginal (bad) sectors on the source drive may not be collected

b. low threshold of retry reads (some programs won't retry enough) on weak media spots on a drive

Kimber's disk acquisition does not require the examination of the entire drive. This type of acquisition collects fragments of unallocated (deleted) data along with specific types of files. What type of disk acquisition is Kimber using?

a. logical acquisition

b. sparse acquisition

c. partial acquisition

d. complete acquisition

b. sparse acquisition

Luiz is forensically examining a Windows XP hard drive and needs to copy data from an older disk to a newer disk. For Luiz to be successful, his imaging tools need to copy data to match the original suspect drive. How do Luiz's tools accomplish this task?

a. by copying to the same type of older disk

b. by adjusting the suspect disk's geometry

c. by adjusting the target disk's geometry

d. by copying to a new disk

c. by adjusting the target disk's geometry

Harry needs to acquire data located in the host protected area of the disk drive but is unable to do so. Therefore, Harry needs to find the next best solution. At what hardware level should Harry attempt to retrieve data from next?

a. CMOS level

b. Trusted Platform Module level

c. BIOS level

d. Bus Enumerator level

c. BIOS level

Eliza is a police officer with the San Fernando Police Department. She's just executed a search warrant for drug trafficking, and she is collecting evidence. During the process of collecting evidence, she finds other contraband. But before she can seize it, she must meet three conditions. These three conditions are referred to as the Horton test. Which one of the answers below is one of the conditions of the Horton test?

a. The officer does not have to be in a place where the evidence can be plainly viewed.

b. The officer does not need a lawful right to access the object.

c. Anyone can see evidence in plain view and report it to the officer.

d. The incriminating character of the object must be "immediately apparent."

d. The incriminating character of the object must be "immediately apparent."

Minato uses magnetic tape to store a target drive for archiving. To test that the data is good, he copies the contents from the tape back to a disk drive. How will Minato verify that the contents of the tape are identical to the contents on the disk drive?

a. Minato will complete a file comparison check.

b. Minato will verify the data is good by comparing the hash value from the archive tape to the hash value on the copied disk.

c. Minato will let the duplication software tell him whether there's a problem.

d. Minato will just assume that the data is correct.

b. Minato will verify the data is good by comparing the hash value from the archive tape to the hash value on the copied disk.

Mia is a digital forensics examiner with the Washington state police. She just arrived on scene and discovers a system that's powered on and running. The screen is on, and there are several active windows that are open and minimized. What should Mia do first to examine this system? Choose all that apply.

a. Power down the system.

b. Expand the windows and photograph them.

c. Write down each window's contents.

d. Save and close the open windows.

b. Expand the windows and photograph them.

c. Write down each window's contents.

Isaac is at a crime scene where there are multiple computers containing evidence that requires examination. Although computers can be a crime scene within a crime scene or a secondary crime scene containing evidence to be processed, what type of evidence has the court determined computers and digital evidence to be?

a. direct evidence

b. physical evidence

c. circumstantial evidence

d. documentary evidence

b. physical evidence

Sawyer is examining a hard drive using HxD. He locates the primary and second primary partition tables. What are the hexadecimal address offsets for the primary and second primary partition tables? Choose all that apply.

a. 0x1EE

b. 0x1DE

c. 0x1BE

d. 0x1CE

c. 0x1BE

d. 0x1CE

Bly is examining a hard drive with a FAT file system. During her examination, she experiences a system failure. When Bly finally gets her system running again, she finds that some cluster chains have been broken, and now the data has been lost. How did a system failure cause data loss?

a. The hard drive had a fatal error.

b. The cluster chains became fragmented.

c. Side-by-side cluster chains can no longer communicate, so the data is corrupted.

d. The cluster chain pointers disappeared.

c. Side-by-side cluster chains can no longer communicate, so the data is corrupted.

Elijah just loaded a new Hex program onto his computer. The first time he starts the program, it's slow. But the next time he starts it, prefetch has speeded up the program immensely. How does prefetch work?

a. pre-loads all of the program's files into memory

b. pre-loads necessary links to other data or executable files in memory

c. pre-loads registry files into memory

d. pre-loads DLL files into memory

b. pre-loads necessary links to other data or executable files in memory

Luiz is examining registry keys used by the operating system in his latest case. He is looking for the predefined key that contains information about installed hardware and software. What predefined key is Luiz looking for?

a. HKEY_CURRENT-USER

b. HKEY_LOCAL_MACHINE

c. HKEY_USERS

d. HKEY_CURRENT_CONFIG

b. HKEY_LOCAL_MACHINE

Tim is searching for the master password file in Linux. Which system file should Tim search to find this information?

a. /var/log/dmesg

b. /var/log/wtmp

c. /etc/shadow

d. /etc/group

c. /etc/shadow

Cameron knows there are four components that define the file system of UNIX/Linux. Those components are boot block, superblock, inode block, and data block. If Cameron were looking for disk geometry and available space, which component would Cameron investigate?

a. boot block

b. superblock

c. inode block

d. data block

b. superblock

Geoffrey is examining a Mac OS 8 computer. He's looking for metadata and application information. Where will that information be found in the Mac OS 8 file structure?

a. data fork

b. resource fork

c. allocation fork

d. metadata fork

b. resource fork

A logical block is a fundamental unit of storage that can hold 1024 bytes of data.

a. True

b. False

b. False

Geneviève is examining multiple graphics files. She's examining bitmap, JPEG, TIF, and vector images. Geneviève tends to like vector graphics the best when she finds them because they are easier to work with. Why does Geneviève believe that vector graphics are easiest to work with? Choose all that apply.

a. Vector images are smaller than bitmap files.

b. Vector images can be enlarged without affecting image quality.

c. Vector images can be rasterized.

d. Vector images can be pixelated.

a. Vector images are smaller than bitmap files.

b. Vector images can be enlarged without affecting image quality.

Rosa is searching for image files and discovers several that are compressed. She was able to uncompress them without any loss of data. What type of image files were they? Choose all that apply.

a. TIF

b. BMP

c. PNG

d. GIF

c. PNG

d. GIF

Malcolm is working with the steganalysis expert at the local police department. They are trying to break a message they found on a suspect's computer. The steganalysis expert says they are going to try a known cover attack. How is a known cover attack executed?

a. It's used when the hidden message is revealed later, allowing further analysis of new messages.

b. It's used when a steganography tool and stego-media were used to hide the message content because this method uses a known steganography tool.

c. It's used when the cover-media and the stego-media are available for analysis.

d. It's used to identify corresponding patterns used in stego-media; this technique creates stego-media and then analyzes them to determine how data is configured in the file.

c. It's used when the cover-media and the stego-media are available for analysis.

Chad was using a hex editor to look for altered files. He came across a .jpg file and tried to open it in Microsoft Photos but was unable to do so. What reason could there be for Chad not being able to open the file?

a. The file was corrupted.

b. The file extension shown was .jpg, but the actual file was .xlsx (Microsoft Excel).

c. Only the thumbs.db file remained.

d. The Microsoft Photos program was outdated and could not open the file.

b. The file extension shown was .jpg, but the actual file was .xlsx (Microsoft Excel).

Malachi's company needs to investigate an employee in an office in New York, but Malachi is in Los Angeles. What is the best way to monitor, image, and access the employee's device without traveling to New York?

a. remote acquisition

b. remote requisition

c. local acquisition

d. local requisition

a. remote acquisition

Yuri encountered null data while performing a RAM acquisition. What does it mean when null data is found in RAM?

a. The RAM is bad.

b. The RAM slot on the motherboard is damaged.

c. A protected area of RAM has been discovered.

d. The wrong tool is being used to acquire data from the RAM.

c. A protected area of RAM has been discovered.

Ethel needs to perform a selective live acquisition. If she is using xcopy or robocopy, what operating system is she working with?

a. Kali

b. Ubuntu

c. Windows

d. CentOS

b. Ubuntu

Alain needs to perform a remote acquisition on a suspected Windows computer in an office in another state. He is using his computer and deploying an agent on the endpoint. What acquisition tool is Alain using?

a. F-Response Collect

b. Magnet AXIOM Cyber

c. Belkasoft R

d. Volatility

c. Belkasoft R

Blake is requesting that his company switch to Windows Server 2022 from Windows Server 2016 due to a major security risk. What risk is Blake referring to?

a. Before Windows Server 2019, servers started up with no passwords.

b. Before Windows Server 2019, servers started up with all ports open.

c. Before Windows Server 2019, servers started up with all ports closed.

d. Before Windows Server 2019, servers started up with no anti-virus protection.

b. Before Windows Server 2019, servers started up with all ports open.

Jett is a part of a newly formed digital forensics and incident response team (DFIR). He is a member of the IT department. There are representatives from other departments involved too. What other departments are a part of the DFIR? Choose all that apply.

a. digital forensics specialists

b. human resources representatives

c. customer service representatives

d. legal department representatives

a. digital forensics specialists

b. human resources representatives

d. legal department representatives

Arya is using the netstat command. What is this command usually used for?

a. displays network adapters, subnet masks, and gateways

b. displays shared resources on a network

c. displays protocol statistics and current TCP/IP network connections

d. displays routing table, which shows the paths that data packets take to reach their destinations

c. displays protocol statistics and current TCP/IP network connections

Brantley is performing data capture and wants to be sure that any tools used by other experts can read the captured data. Which format should Brantley use?

a. libpcap

b. pcap

c. winpcap

d. ldap

b. pcap

Vesta is an application developer and has an idea for a new application but does not have the in-house resources to build it. What cloud service should she use?

a. platform as a service (PaaS)

b. software as a service (SaaS)

c. infrastructure as a service (IaaS)

d. anything as a service (XaaS)

a. platform as a service (PaaS)

Kelsie is searching for evidence on a hard drive. She only discovers it when she uses a Hex editor and notices that file extensions have been changed. What is this tactic called?

a. anti-metaforensics

b. anti-data forensics

c. anti-forensics

d. anti-analysis forensics

c. anti-forensics

Rocco is using a Hex editor in a Prefetch file to find an application's create date and time offset. Where will the create date and time be located?

a. 0x80

b. 0x90

c. 0x98

d. 0xD4

a. 0x80

Jackie is researching categories of the Internet of Anything. She wants to know which segment covers IoT technologies that improve efficiencies and manage infrastructure both for rural areas and for smart cities, in applications such as traffic control, energy, water and waste management, and public safety.

a. Infrastructure Internet of Things

b. Commercial Internet of Things

c. Consumer Internet of Things (CIoT)

d. Industrial Internet of Things (IIoT)

a. Infrastructure Internet of Things

Ananya works for a federal law enforcement agency and is investigating a terrorist cell in the United States. Ananya and her team are using a Stingray as a cell site simulator to track the movement of the cell. In this instance, what type of data might Ananya and her team be attempting to collect? Choose all that apply.

a. Obtain a voice print of the person or persons who are speaking on the phones.

b. Determine the exact location of the terrorist cell members' locations in real time.

c. Collect the content of text messages, emails, attachments, or websites visited.

d. Decrypt messages with low-level encryption in real time.

b. Determine the exact location of the terrorist cell members' locations in real time.

c. Collect the content of text messages, emails, attachments, or websites visited.

d. Decrypt messages with low-level encryption in real time.

Poppy is examining the cell phone data logs from a phone taken from a suspect. She is trying to tie the suspect to a crime that was committed a week ago in the town of Del Norte, but the suspect claims he was 20 miles away at the time. However, descriptions from eyewitnesses fit the description of the suspect. Which type of log file could place the suspect in the area at the time the crime was committed?

a. cell tower call logs

b. cell-site location information (CSLI)

c. call detail records (CDR)

d. cell phone pinging report

b. cell-site location information (CSLI)

The data in mobile devices can only be stored in internal storage.

a. True

b. False

b. False

Jaxon has been transferred to the department specializing in mobile device forensics. On the first day, Jaxon was warned about the main concerns of working with mobile devices. What are these concerns? Choose all that apply.

a. loss of power

b. synchronization with cloud services

c. remote locking

d. remote wiping

a. loss of power

b. synchronization with cloud services

d. remote wiping

Reade is trying to investigate a harassment complaint from an employee. The alleged harassment is coming from a Gmail email address. What issues will Reade face as he tries to find the suspect, since they are using a public email system? Choose all that apply.

a. Reade will need to get a subpoena or a warrant to retrieve information from the public email provider.

b. These accounts don't always use standard naming schemes, and email administrators aren't familiar with all the user accounts on their servers.

c. There are millions of addresses on public email servers, and that is too much data to review.

d. Names and addresses that are attached to newly generated email addresses can be falsified, so it will be difficult to track an email address back to the person responsible for the alleged harassment.

a. Reade will need to get a subpoena or a warrant to retrieve information from the public email provider.

b. These accounts don't always use standard naming schemes, and email administrators aren't familiar with all the user accounts on their servers.

d. Names and addresses that are attached to newly generated email addresses can be falsified, so it will be difficult to track an email address back to the person responsible for the alleged harassment.

Before Xyla can investigate any email crime, she must understand the applicable privacy laws for her jurisdiction, in this case, the United States. What are the privacy laws that apply to email in the United States? Choose all that apply.

a. Gramm-Leach-Bliley Act (GLBA)

b. Stored Communications Act (SCA)

c. Family Educational Rights and Privacy Act (FERPA)

d. Electronic Communications Privacy Act (ECPA)

b. Stored Communications Act (SCA)

d. Electronic Communications Privacy Act (ECPA)

Kali's specialty is analyzing language-related evidence. She looks for insights into authorship, identifies ambiguous language (clarifies the meaning of language that is open to multiple interpretations), and detects deception. What field is Kali trained in?

a. forensic listening

b. forensic language autopsy

c. forensic linguistics

d. forensic mannerisms

c. forensic linguistics

Ares is examining email headers on two suspects' machines who are under suspicion of attempting to send harassing emails threatening to Dox (the act of publicly providing personally identifiable information about an individual) a political candidate if they don't remove themselves from a local election. Ares finds files on the suspects' computers with files that have unfamiliar file extensions. Why might the suspects have unusual file extensions for files? Choose all that apply.

a. The suspects could be using programs that create those type of file extensions.

b. The suspects removed the program that created the file, so the computer doesn't know what to call it.

c. The file is corrupted so it has an unusual file extension.

d. The suspects could have changed the file extensions from a legitimate extension to hide the real file type.

a. The suspects could be using programs that create those type of file extensions.

d. The suspects could have changed the file extensions from a legitimate extension to hide the real file type.

Nadim decides to use the reverse funnel method to handle the huge amount of data he needs to review for an upcoming case. What is the benefit of this method?

a. Adhering to legal protocols and guidelines may necessitate a more structured and focused approach.

b. The reverse tunnel method is a more targeted and systematic approach from the outset than other types of e-discovery search methods.

c. The reverse funnel method begins with a narrow investigative scope and expands as necessary as the data or correspondence warrants it.

d. Using the reverse funnel method allows the investigator to find all unrelated personally identifiable information (PII) and remove it before retrieving pertinent data.

c. The reverse funnel method begins with a narrow investigative scope and expands as necessary as the data or correspondence warrants it.

Pablo is preparing for the BAR exam, and one of the questions pertains to the federal regulations that have a significant impact on digital forensics and e-discovery. What are the rules Pablo is searching for? Choose all that apply.

a. Federal Rules of Criminal Procedure (FRCrP)

b. Federal Rules of Evidence (FRE)

c. Federal Rules of Computer and Fraud Act (FRCF)

d. Federal Rules of Civil Procedure (FRCP)

a. Federal Rules of Criminal Procedure (FRCrP)

b. Federal Rules of Evidence (FRE)

d. Federal Rules of Civil Procedure (FRCP)

Kimberly is a law student. She has a lot of research to do and has access to several reliable sources that she can use for her research. What are the most widely known publications used for legal research? Choose all that apply.

a. American Jurisprudence

b. LexisNexis

c. Findlaw.com

d. Westlaw

b. LexisNexis

d. Westlaw

Melanie is an employee of a company that has recently received notification of an investigation by the Justice Department. The company's legal team has informed Melanie and her team that they have been placed on a litigation hold. However, Melanie is unfamiliar with the term and is unsure as to what it means. What is a litigation hold?

a. It's a notification that all document production must stop.

b. It's a notification that employees must save everything they have done previously up to the point of the litigation hold, but it is okay to continue doing business normally after that date.

c. It's a notification informing employees that they must stop overwriting backups, deleting files, and performing other tasks that could destroy evidence related to anticipated litigation.

d. It's a notification telling employees that their work will be scrutinized for any irregularities and be reported to the litigant.

c. It's a notification informing employees that they must stop overwriting backups, deleting files, and performing other tasks that could destroy evidence related to anticipated litigation.

Efram belongs to the International Association of Computer Investigative Specialists (IACIS) and follows the guidelines set forth by this organization. What are some of the guidelines that Efram must follow when testifying? Choose all that apply.

a. Never misrepresent training, credentials, or association membership.

b. Avoid any action that would appear to be a conflict of interest.

c. Conduct examinations based on established, validated principles.

d. Render opinions having a basis that is demonstratively reasonable.

c. Conduct examinations based on established, validated principles.

d. Render opinions having a basis that is demonstratively reasonable.

The American Bar Association (ABA) has stated that expert witnesses, unlike attorneys, do not owe a duty of loyalty to their clients.

a. True

b. False

a. True

Kimberly is a forensics examiner working for an attorney. She has been assigned to examine a suspect's computer. It is her job to look for both inculpatory and exculpatory information. What do exculpatory and inculpatory mean? Choose all that apply.

a. Inculpatory evidence is information or material that tends to clear someone from blame.

b. Inculpatory evidence is information or material that suggests a person's involvement in a particular act; typically indicates guilt.

c. Exculpatory evidence is information or material that tends to clear someone from blame.

d. Exculpatory evidence is information or material that suggests a person's involvement in a particular act; typically indicates guilt.

b. Inculpatory evidence is information or material that suggests a person's involvement in a particular act; typically indicates guilt.

c. Exculpatory evidence is information or material that tends to clear someone from blame.

Padilla has been hired by an attorney to be an expert witness in a fraud case. The attorney says he will pay half of Padilla's fee up front and the other half upon completion of a favorable report by Padilla. Is this considered ethical conduct? Choose all that apply.

a. All the attorney wants is an outcome that is favorable to his client, there is nothing wrong with that.

b. By making any portion of a fee dependent on a favorable report is inappropriate and should be a breach of the fee agreement.

c. Padilla will be paid regardless, he just has to make his report favorable to the attorney who hired him.

d. Padilla is owed fair compensation for his time and work under the terms of the fee agreement.

b. By making any portion of a fee dependent on a favorable report is inappropriate and should be a breach of the fee agreement.

d. Padilla is owed fair compensation for his time and work under the terms of the fee agreement.