Cyber Forensics Midterm

A hash matches, but chain of custody has a gap. What does the ahs prove?

Data Integrity

A powered-on encrypted laptop is unlocked. What could shutdown destroy

Volatile Evidence

Which evidence is most volatile?

RAM

Why examine a forensic copy instead of the original?

Protect the Original

What does a write blocker mainly prevent?

Writes to the source

Which tool action acquires an entire selected storage device?

Create Disk Image

A logical file collection usually misses what?

Unallocated Space

Which format can store case metadata and use lossless compression?

E01

Unallocated space is best described as:

Not assigned space

Unused bytes in a file’s final allocated cluster are called:

File Slack

A cluster is:

A filesystem allocation unit

An LBA is:

A Logical block address

Which NTFS structure stores records about files and folders?

MFT

A deleted file is recovered using its surviving filesystem record. Method?

Metadata-based recovery

No filesystem record survives. A tool searches raw bytes for JPEG structure. Method?

Carving

Which is a common JPEG starting signature?

FF D8 FF

Changing photo.jpg to photo.txt changes:

Only its filename extension

Why can carving lose the original filename?

Filesystem metadata may be gone

A JPEG header is overwritten. What matters most?

Which bytes were lost

Why can overwritten data become unrecoverable?

Original bytes were replaced

Fragmentation means a file is:

Stored in noncontiguous areas

Why is fragmented-file recovery harder after metadata loss?

Fragments may be hard to locate/order

HDDs store data mainly using

Magnetic patterns

NAND erase normally happens at what level?

Block level

TRIM mainly tells an SSD

Data i no longer needed

Garbage collection mainly helps an SSD

Reclaim storage internally

Wear leveling primarily helps:

Balance NAND Wear

The Windows Registry mainly stores:

Configuration/system information

Windows Event Logs record

Selected System/app/security events

Prefetch can support evidence that:

A program executed

A windows LNK file is best described as

A shortcut/reference

Jump Lists mainly relate to:

Frequent/pinned app items

On modern Windows, recycle Bin Metadata can preserve:

Origin Path, Time of deletion, and File name

USB + Excel + LNK time stamps close together prove file transfer.

False

A timestamp should be treated as:

Context requiring interpretation

When you create a standard physical image of an SSD, what is usually captured?

Data exposured

Autopsy finds a USB artifact sourced from the SYSTEM Registry hive. What does this mean?

USB information was parsed from the Registry

If deleted data still physically exists on an SSD, forensic software can always recover it.

False

A fragmented file is necessarily damaged because its data is stored in noncontiguous clusters.

False

A matching hash can prove integrity, but it cannot fix a gap in chain of custody.

True

In the Windows Registry, how is a hive different from a key?

A hive is a major Registry collection; a key is inside it

What is the correct order of the forensic process

Identify —> Preserve —> Collect —> Examine —> Analyze —> Report

A suspect Computer arrives powered OFF. What should the examiner do?

Keep it off and acquire it using forensic tools

Why might an examiner choose E01 instead of Raw/dd?

E01 supports metadata and compression

File slack is the unused space between the end of a file and the end of its _____

Final allocated cluster

Clusters are managed by ____, while sectors are presented by the ____.

File System; storage device

What is the difference between a partition and a volume?

Partition = disk region; Volume = usable logical storage

What is the difference between an actuator arm and a read/write head in an HDD?

Arm position the head; head reads/writes data

If only the end of a file is overwritten, some of the file may still be recoverable.

True

Deleted-data recovered from an HDD is generally trickier than from an SSD.

False