digital forensics (modules 1-4) exam prep

computer forensics/digital forensics

extraction of data in a consistent, scientific matter

forensics is the process of...

collecting, analyzing, and presenting evidence

computer forensics is...

analyzing, collecting, examining and preservation of evidence

What is the objective of computer forensics?

recover, analyze, and present computer-based material so it can be used as evidence in a court of law.

What are the seven domains of a typical IT infrastructure?

User, Workstation, LAN, LAN-to-WAN, WAN, Remote Access, System/Application

What is an expert report?

lists tests conducted, findings, and conclusions, must be complete/error free (thorough, back up evidence)

What is a deposition?

Testimony taken from a witness or party before trial

what rule lists what an expert/expert testimony is

rule 702

What is digital evidence?

Information processed/assembled so it is relevant to an investigation

What are the four evidence types listed?

Real, demonstrative, documentary, and testimonial.

What drive/connector types are listed?

SCSI, IDE, EIDE, PATA, and SATA.

What file systems are listed?

FAT, NTFS, ReFS, APFS, EXT, and Berkeley Fast File System

What network utilities are shown?

ipconfig, ping, and tracert.

What is obscured information?

Information that may be secured by encryption, hidden using steganographic software, compressed, or in a proprietary format.

What is anti-forensics?

Techniques attackers use to hide evidence

What are examples for obscured information/anti-forensics?

Data destruction, data hiding, data transformation, and file system alteration.

What is the Daubert Standard?

decides if a testimony is reliable and relevant for court

What four Daubert factors are listed?

1. Empirical testing

2. peer review

3. error rate and standards

4. generally accepted theory/technique

What does CALEA (communications assistance for law enforcement) address?

law for wired telephony, including signaling traffic/metadata.

What does FISA (foreign intelligence service act) address?

Collection of information between foreign powers using physical/electronic surveillance

What are the three roles a device can play in computer crime?

1. Target of the crime

2. instrument of the crime

3. evidence repository that stores valuable information about the crime.

What is identity theft?

Use of another person's identity, typically for economic gain

What are common identity-theft methods listed?

Phishing, spyware, and discarded information.

What is phishing?

tricking someone into giving up personal information

What are spear phishing and whaling?

More-targeted attacks

What is spyware?

Software that can monitor computer activity

How does the slide suggest investigating spyware/phishing?

Look for spyware on the victim's machine and where it sends data; for phishing, check email history and web history.

What is discarded information/dumpster diving?

A method for gathering information about a person's identity from discarded information

Where should investigators look for evidence of SQL injection?

Firewall logs and database logs.

What is cross-site scripting?

An attacker posts JavaScript where users can post text; if input is not filtered, the script executes when other users view it

What is Ophcrack used for?

It compares a rainbow table against the Windows SAM file, searching for matching passwords.

What is fraud?

Any attempt to gain financial reward through deception.

What are two forensic strategies for fraud?

Trace communications and follow the money

What are non-access computer crimes?

Crimes that do not involve an attempt to actually access the target.

What examples of non-access crimes are listed?

DoS attacks, viruses, and logic bombs

What are the steps of the three-way handshake?

Client sends SYN; server sends SYN/ACK; client sends ACK and communications begin.

What is a SYN flood?

An attacker keeps sending SYN packets but never responds to SYN/ACK, overwhelming the system

What virus categories are listed?

Macro, memory-resident, multipartite, armored, sparse infector, polymorphic

What is a logic bomb?

Malware harms a system when a certain condition is met (ex. time/date)

What are the four forensic methodology principles?

Handle original data as little as possible; avoid exceeding your knowledge; create an analysis plan; comply with the rules of evidence.

What does FRE 901 require?

Evidence sufficient to support a finding that the item is what the proponent claims it is

What is the example order of volatility?

1.Registers/cache

2. routing tables

3. ARP cache

4. process table

5. kernel statistics/modules

6. main memory

7. temporary file systems

8. secondary memory

9. router configuration

10. network topology.

What RFC 3227 collection order is listed?

1. Volatile data

2. file slack

3. file system

4. registry

5. memory dumps

6. system state backup

7. Internet traces.

What is file slack?

Unused space between the logical end and physical end

Why can file slack matter?

It can contain passwords, network logons, email, etc.

What is NIST CFTT?

Computer Forensics Tool Testing program, (verifies appropriateness of a tool)

What does ASCLD do?

Provides guidelines for managing a forensics lab, certification, and certifies labs that analyze digital evidence.

What does TEMPEST refer to?

DoD guidelines on electromagnetic radiation (EMR)

What is steganography?

The art/science of writing hidden messages

What is the most common steganography method listed?

LSB (least significant bit) used to store data

What are the basic steganography terms?

payload, carrier, channel

What is steganophony?

hiding messages in sound files

What is video steganography?

Hiding information in video files.

What advanced steganography technique is listed?

Bit-Plane Complexity Segmentation Steganography (BPCS).

What is steganalysis?

Analyzing files for hidden content

How can LSB steganography be detected?

By examining close-color pairs.

What does MP3Stego do?

hides data in mp3 files

What does Deep Sound do?

Allows files to be hidden in MP3, WAV, CDA, and other formats

What is encryption?

turns a message to where it cannot be read

What is cryptography?

The study of writing secret messages.

How do steganography and encryption differ?

Steganography hides the message; encryption/cryptography leaves the message present but unable to be read

What is the Caesar cipher?

substitution cipher that shifts letters by a number

What are plaintext and ciphertext?

Plaintext is the text to encrypt; ciphertext is the result after the algorithm and key.

What is Atbash?

A cipher that reverses the alphabet

What is ROT13?

A Caesar-cipher permutation rotating characters 13 positions

What is the Scytale cipher?

A cipher using a leather strip wrapped around a cylinder/baton; the same-sized cylinder/key is used to decrypt.

What is the Playfair cipher?

Encrypts pairs of letters (digraphs) using a 5×5 table with a keyword/key phrase.

What is multialphabet substitution?

Multiple shift values create multiple substitution alphabets

What is the Enigma machine?

WWII cipher system using multialphabet substitution

What are the two main types of modern cryptography?

Symmetric and asymmetric.

What is symmetric cryptography?

Uses the same key to encrypt and decrypt plaintext.

What is asymmetric cryptography?

Uses different keys to encrypt and decrypt plaintext

What are substitution and transposition?

Substitution changes plaintext to matching ciphertext parts; transposition swaps blocks of ciphertext.

What is a block cipher?

Encrypts data in groups of bits called blocks.

What is a stream cipher?

Encrypts data as a stream, one bit at a time

What is DES?

A cipher dividing data into 64-bit blocks and using 16 encryption steps with substitutions, bit shifting, logical operations, and a 56-bit key, followed by scrambling/transposition.

What is 3DES?

An interim solution to DES that performs DES three times with three different keys

What is AES?

Advanced Encryption Standard, also called the Rijndael block cipher.

What AES key sizes and block size are listed?

128, 192, or 256-bit keys; all use a 128-bit block size.

What are cryptographic-hash characteristics?

One-way/not reversible; fixed-length output; collision resistant.

What is RSA?

An asymmetric algorithm, difficulty of factoring large integers made from large prime factors.

What is Diffie-Hellman?

A protocol allowing two parties to establish a shared key over a channel

What is cryptanalysis?

Using techniques other than brute force to attempt to uncover a key; also academic/knowledge-based code breaking

What methods of cryptanalysis are listed?

Frequency analysis; Kasiski examination; known plaintext; chosen plaintext; ciphertext-only; related-key attack.

What is frequency analysis?

Using frequencies of letters in natural language to derive information about a key

What is Kasiski examination?

An attack on substitution ciphers such as Vigenère that can deduce keyword length, then arrange ciphertext into columns for frequency analysis.

What is John the Ripper?

A password cracker popular with network administrators and hackers; it can use word-list text files and is command-line based with no Windows interface.

Why does quantum computing matter to RSA and Diffie-Hellman?

with a fully working quantum computer, these algorithms would no longer be secure.

what is curriculum vitae?

like a resume, specific to forensic investigators experience