ISTC2071 – Computer Forensics Chapter 9 Study Guide

What does scope creep typically do?

Increases the time and resources needed to extract, analyze, and present data

What should be created in order to begin a digital forensics case?

An investigation plan

In addition to search warrants, what defines the scope of civil and criminal cases?

Subpoenas

Which program has an indexed version of the NIST NSRL of MD5 hashes that can be imported to enhance searching for and eliminating known OS and application
files?

Autopsy

Because digital forensics tools have limitations in performing hashing, what tools should be used to ensure data integrity?

Hexadecimal editors

Which AccessData feature compares known file hash values to files on your evidence drive or image files to see whether they contain suspicious data?

KFF

Which activity involves changing or manipulating a file to conceal information?

Data hiding

Which Windows disk partition utility can be used to hide partitions?

diskpart

The data-hiding technique involving marking bad clusters is more commonly used with what type of file system?

FAT

Which term comes from the Greek word for "hidden writing"?

Steganography

When both the original file with no hidden message and the converted file with the hidden message are available, what analysis method is recommended by Johnson
and Jajodia?

Known cover attack

What technology is designed to recover encrypted data if users forget their passphrases or if the user key is corrupted after a system failure?

Key escrow

Which program incorporates an advanced encryption technique that can be used to hide data?

BestCrypt

Which type of recovery is becoming more common in digital forensic analysis?

Password

What type of attacks use every possible letter, number, and character found on a keyboard when cracking a password?

Brute-force

Many password-protected OSs and applications store passwords in the form of
which type of hash values?

MD5

Which action alters hash values, making cracking passwords more difficult?

Salting passwords

What limits the data that can be sought in a criminal investigation?

The search warrant

Which data-hiding technique changes data from readable code to data that looks like binary executable code?

Bit-shifting

Which hashing algorithm is provided by WinHex?

SHA-1