Computer Forensics Exam 2

What chapters and modules are covered on Exam 2?

Chapter 5, Chapter 6, Chapter 7, and Modules 6-10, along with the lab exercises.

What is an EnCase evidence file?

An evidence file is a forensic image/container used by EnCase to store and examine acquired evidence from subject media.

What is CRC?

CRC (Cyclic Redundancy Check) is an error-detection value used to check the integrity of data.

What is MD5?

MD5 is a hashing algorithm that produces a 128-bit hash value used to identify and verify data.

Where are CRC and MD5 used in an EnCase evidence file?

CRC and MD5 are used within the evidence file to help verify the integrity of the evidence and its data.

What is the physical layout of an EnCase evidence file?

Know the structure and organization of the evidence file, including where evidence data and integrity information are stored.

How are multiple files represented in an EnCase evidence file?

Multiple files can be organized within the evidence file according to the EnCase evidence-file structure.

What is the file integrity field?

The file integrity field contains information used to verify that the evidence file has not been altered or corrupted.

How does EnCase provide file integrity?

EnCase uses integrity checks and hashing to verify that evidence has not been changed.

What is hashing?

Hashing converts data into a fixed-length value that can be used to identify and verify the integrity of the data.

What is the recommended structure for EnCase case folders?

Use the recommended case-folder structure to keep case files, evidence, reports, and related forensic materials organized.

What is an EnCase case file?

A case file contains information used by EnCase to organize and manage a forensic investigation.

What can an EnCase case be made up of?

A case can contain evidence files, case information, configuration information, and other files related to the investigation.

How often should EnCase be backed up?

EnCase should be backed up regularly, using automatic backups when appropriate.

What is the backup file extension in EnCase?

Know the backup-file extension and the available backup parameters discussed in the chapter.

How do you open EnCase backup files?

Use EnCase's backup-file opening procedure to restore or access the saved case information.

What makes up an EnCase configuration file?

A configuration file contains settings used by EnCase to control its environment and operation.

What are the different types of .ini files in EnCase?

Know the different .ini file types and what settings or functions each one controls.

What is an acquisition hash?

The acquisition hash is calculated on the original subject media during acquisition.

What is a verification hash?

The verification hash is calculated on the data portion of the EVIDENCE FILE.

What is the difference between an acquisition hash and a verification hash?

The acquisition hash is calculated from the original subject media, while the verification hash is calculated from the data portion of the evidence file.

Why are acquisition and verification hashes important?

They help verify that the forensic acquisition accurately represents the original media and that the evidence has maintained its integrity.

What is the EnCase environment?

The EnCase environment is the interface used to manage cases, examine evidence, and navigate forensic data.

What are the main panes in EnCase?

The main panes include the Tree pane, Table pane, and View pane.

What is the Tree pane used for?

The Tree pane is used to navigate the structure and hierarchy of evidence and other items in EnCase.

What is the Table pane used for?

The Table pane displays information about items selected in the Tree pane.

What is the View pane used for?

The View pane displays detailed information or the contents of the item selected for examination.

What steps are used to create a case in EnCase?

Enter the required case information and fields, configure the case as required by the lab, and create the case.

Why is it important to know how to navigate the EnCase panes?

Each pane provides different information and functions needed to examine forensic evidence efficiently.

What do the icons in EnCase represent?

EnCase icons represent different tools, commands, views, and forensic functions.

What is the Dixon box used for?

The Dixon box is an EnCase feature used to assist with examining and viewing forensic information.

Why is the Dixon box useful?

It provides useful information or functionality while examining evidence in EnCase.

What types of views are available in EnCase?

EnCase provides different views for examining evidence and displaying information in different formats.

What is disk drive geometry?

Disk drive geometry describes the organization of a disk in terms such as cylinders, heads, and sectors.

What is the MBR?

The MBR (Master Boot Record) is a disk structure located at the beginning of a disk that contains boot information and the partition table on traditional partitioned disks.

What is the MFT?

The MFT (Master File Table) is the central file-record structure used by the NTFS file system to store information about files and directories.

What is the difference between logical and physical addresses?

A physical address refers to the actual location on the storage device, while a logical address refers to a location as represented by the file system or operating system.

What is FAT?

FAT (File Allocation Table) is a file system that uses a file allocation table to track how files are stored on a disk.

What is NTFS?

NTFS (New Technology File System) is a Windows file system that provides features such as file permissions, metadata, and journaling.

What is ReFS?

ReFS (Resilient File System) is a Microsoft file system designed to provide improved data integrity and resiliency.

What is slack space?

Slack space is unused space within allocated storage areas that can contain remnants of previously stored data.

What is the Windows Registry?

The Registry is a hierarchical database used by Windows to store system, hardware, software, user, and configuration information.

What are inodes?

Inodes are data structures used by Unix/Linux file systems to store information about files and directories, such as metadata and locations of data blocks.

What is HFS?

HFS (Hierarchical File System) is a file system historically used by Apple systems.

What is HFS+?

HFS+ is an enhanced version of HFS that was used by macOS before APFS.

What is APFS?

APFS (Apple File System) is a file system developed by Apple for modern macOS and other Apple devices.

Why must an image be made to examine macOS systems?

A forensic image allows investigators to examine a copy of the system while preserving the original evidence.

What is Kali Linux used for in forensics?

Kali Linux includes various tools that can be used for forensic analysis and investigation.

What are standard graphic file formats?

Standard graphic formats include common image formats such as JPEG, PNG, GIF, BMP, and TIFF.

What are non-standard graphic file formats?

Non-standard graphic formats are less common or proprietary formats that may require specialized tools or methods to examine.

What may be needed to examine non-standard graphic files?

Specialized software or forensic tools may be needed to properly identify and examine non-standard graphic files.

What are audio files?

Audio files store recorded or digitally generated sound and can exist in many different formats.

What is steganography?

Steganography is the practice of hiding information inside another file or medium so that the hidden information is not obvious.

What is bit shifting?

Bit shifting is an operation that moves the bits in a binary value to the left or right.

Where could someone hide data?

Data can potentially be hidden in unused or slack space, file metadata, image or audio files, alternate data areas, and other storage locations.

How can virtual machines be examined?

Virtual machines can be examined by analyzing their virtual disks, configuration files, snapshots, and other VM-related data.

What is live acquisition?

Live acquisition is the collection of forensic evidence from a system while the system is running.

What is network forensics?

Network forensics is the collection and analysis of network traffic and network-related evidence to investigate security incidents or other activity.

Why is it important to have procedures in place for forensic investigations?

Established procedures help ensure evidence is collected, handled, documented, and analyzed consistently.

What are some tools used for network forensics?

Network-forensics tools can capture, monitor, and analyze network traffic and other network evidence.

What is a zero-day vulnerability?

A zero-day vulnerability is a security vulnerability that is unknown or has not yet been addressed by the vendor, leaving little or no time for a patch before exploitation.

What is a honeypot?

A honeypot is a system or resource designed to attract or detect attackers and collect information about their activity.