Forensics Chapter 9

Shani wants to run the newest version of Windows 11 and use Kali Linux on her computer. She has decided to use a hypervisor so she does not have to use a dual boot system. What type of hypervisor should Shani use?

Type 1 hypervisor

Type 2 hypervisor

Type 3 hypervisor

Type 4 hypervisor

Type 2 hypervisor

Talia is investigating a Windows OS host computer and is looking for a virtual machine. Where would Talia usually look to find the virtual machine?

Windows folder

Program files (x86)

Users or Documents folder

SystemApps folder

Users or Documents folder

Jamar is thinking about using a type 1 hypervisor, but there are some limitations. What are the three main limitations of a type 1 hypervisor?

Input devices, bus width, fan size

Video card, CPU, motherboard

RAM, storage, and throughput

Graphical processing units (GPU), central processing unit (CPU), and peripheral ports

RAM, storage, and throughput

Nori is investigating a suspect's machine when she discovers a type 2 hypervisor. Why would Nori find a type 2 hypervisor on a suspect's computer?

Type 1 hypervisors are too expensive for the average user.

It's easier to hide information on a type 2 hypervisor.

Type 2 hypervisors can be hidden within an OS so that investigators cannot see a user's virtual machine.

Users tend to be more familiar with type 2 hypervisors, and they are easier to install and use.

Users tend to be more familiar with type 2 hypervisors, and they are easier to install and use.

Khalil has Autopsy, FTK Imager, and OS Forensics tools available to her but she can't use them to read the VM files that she needs to investigate. Why is that?

Autopsy, FTK Imager, and OS Forensics can only read .VDI virtual image files.

Autopsy, FTK Imager, and OS Forensics can only read Virtual Box VM image files.

Autopsy, FTK Imager, and OS Forensics cannot read VM image files.

Autopsy, FTK Imager, and OS Forensics tools can only read .VMDK and .VHD VM image files.

Autopsy, FTK Imager, and OS Forensics tools can only read .VMDK and .VHD VM image files.

Martha is searching for the common Virtual Box image file. Where should she look, and what is the image file extension?

HKEY_LOCAL_MACHINE and the extension is .VMDK

HKEY_CURRENT_CONFIG and the extension is .VHD

HKEY_CURRENT_USER and the extension is .VPC

HKEY_CLASSES_ROOT and the extension is .VDI

HKEY_CLASSES_ROOT and the extension is .VDI

Levi types in ifconfig in the command line. What OS is Levi using, and what information will the command show?

Linux, and all open ports

Windows, and all network adapters

Linux, and all network adapters

Windows, and all open ports

Linux, and all network adapters

Teyana is investigating a suspect's host machine when she discovers a virtual machine. She needs to acquire the VM. She thinks that acquiring the snapshots will be enough to recover any evidence she might need. Or would it be better to complete a live acquisition?

A snapshot records the state of a VM at a particular moment and is a recording of changes in state.

Many network administrators depend on snapshots when working with VMs in case updates or software installations fail, so snapshots have everything an investigator needs.

Snapshots can show what type of software a suspect had installed on the VM and what they may have removed at a given point in time.

When acquiring an image of a VM file, snapshots might not be included. In this case, there is only the original VM, which might not have any of the changes made to it after it was created. Therefore, doing live acquisitions of VMs is important to make sure snapshots are incorporated.

CPU cache has more data capacity than regular RAM.

True

False

False CPU

FTK Imager and Mandiant Memoryze are software tools used for capturing RAM, which can list all open network sockets, including those hidden by rootkits.

True

False

False (FTK Imager)

Malcolm is at a critical stage of a live acquisition. As per order of volatility, he is acquiring RAM data first. What types of data can be discovered in RAM? Choose all that apply.

Passwords

Data from previous sessions

Inactive browser tabs

Login names

Passwords

Login Names

Command-line forensic tools give one a lot of control when acquiring RAM but might give false readings in Windows OSs.

True

False

False (Command-line Forensic tools)

Marquise has been performing live acquisitions on Windows computers for years. He has been asked to complete a live acquisition on a Linux computer. He is worried that his skillset will not be up to the task. What do live acquisitions for Windows and Linux computers have in common?

They both use the same type of command line commands such as ipconfig

They both have the same order of volatility. RAM, logs, network traffic and then actual drive

Both operating systems work the same

Both operating systems use the same tools for live acquisitions

They both have the same order of volatility. RAM, logs, network traffic and then actual drive

Antonella is performing a live acquisition from a local computer. What does she need to successfully complete the acquisition? Choose all that apply.

Access to the user's account and password

Target media drive or access to network server

Computer administrator's password

Permission from the employee who is being targeted

Access to the user's account and password

Target media drive or access to network server

Computer administrator's password

Clarice needs to perform a remote live acquisition and has FTK Imager and X-Ways Imager but cannot seem to perform the acquisition. Why can't Clarice get the information she needs?

She is using a version of the software that is to old

Her software is unlicensed

FTK Imager and X-Ways Imager only perform acquisitions on local or mapped drives

Her firewall is blocking the attempted acquisition

FTK Imager and X-Ways Imager only perform acquisitions on local or mapped drives

Tia's supervisor said she needs to perform a remote acquisition on an employee. The issue is that the employee is in London, United Kingdom, however, the office in the UK is a branch office of the company Tia works for, which is in the United States. What should Tia do first before performing the remote acquisition?

She must engage forensic experts with expertise in cross-border acquisitions to carry out the acquisition process while adhering to legal and ethical standards.

She must check that the employee has signed the policies and procedures manual that stipulates they give up their right to privacy.

She must check the laws regarding Data Protection in the UK, to be sure there are no legal ramifications because they have very strict data privacy laws.

Nia is performing e-discovery for a client on a remote computer. What acquisition tool is Nia using?

F-Response Collect

Magnet AXIOM Cyber

Belkasoft R

Volatility

F-Response Collect (Nia)

Carolyne is performing a remote acquisition on an AWS S3 Bucket. What acquisition tool is Carolyne using?

F-Response Collect

Magnet AXIOM Cyber

Belkasoft R

Volatility

Magnet AXIOM Cyber (Carolyne)

Shawn is performing a remote acquisition on a computer several states away. He needs to be sure that communications between the Windows devices is encrypted. What software should Shawn use?

Response Collect

Magnet AXIOM Cyber

Volatility

Belkasoft R

Belkasoft R (Shawn)

Lucy is using Belkasoft R for a remote acquisition she is performing. During the acquisition, she finds that the connection keeps timing out, and the acquisition is incomplete. How can this be fixed?

She should use a Secure Socket Layer.

She should make sure the screen saver is turned off.

She should make sure the computer cannot go into sleep mode

She should make sure that the IT Department does not flag the computer as having a malware intrusion due to extra data packets from the remote acquisition.

She should make sure the computer cannot go into sleep mode

Debbie is using F-Response Collect while performing a remote acquisition. She needs to create digital forensic images. Since she doesn't know what team will be reading these images, how will she create these images so they can be read by most forensics programs?

Create them in EnCase Forensics (EO1)

Create them in Smart File Format (SFF)

Create them in Raw Image Format (RAW)

Create them in Forensic Data File (FDF)

Create them in Raw Image Format (RAW)

fsutil allows users to interact with and manipulate aspects of the file system. It is a versatile tool for performing a wide range of file-system related tasks on Linux systems.

True

False

False (fsutil)

Kenya types the following Windows command in an Administrator Command Prompt. fsutil usn readjournal c:. What will that command do?

The command will output all of the network interfaces to a file on the screen.

The command will output all of the open ports to the screen.

The command will output the entire contents of the $UsnJrnl:$J file to the screen.

The command will output all the open processes to the screen.

The command will output the entire contents of the $UsnJrnl:$J file to the screen.

Alexi is new to the field of computer forensics. She has heard about this file called $UsnJrnl:$J file. A colleague of hers says it is used for digital forensics investigations. Alexi is puzzled. She turns to you and asks, what is this file used for? What is your answer?

It can show an investigator who the suspect is.

It can show an investigator where the attack came from.

It can show an investigator who the perpetrator was and who the victim was.

It can show an investigator a history of file system activity, helping them track file changes and potentially identify suspicious activities.

It can show an investigator a history of file system activity, helping them track file changes and potentially identify suspicious activities.

Nikki must examine a victim's computer for malware. Unfortunately, malware programs will sometimes change their names and then delete themselves to hide their presence. How would Nikki exam a computer to find out if there has been any malware activity?

Examine the $UsnJrnl using the fsutil command

Run lsmod command to check kernel module

Examine the VSBScript file using the fsutil command

Run ps aux and check all running processes

Examine the $UsnJrnl using the fsutil command