DF Ch4 Quiz

How is data stored in a forensics acquisition tool?

As an image file

What are the two main categories of digital evidence storage formats?

Open-source and proprietary formats

What is an example of an open-source storage format?

Advanced Forensics Format (AFF)

What are three advantages of the Raw Format?

Fast data transfers, ignores minor data read errors on source drive, and most computer forensics tools can read it

What are two disadvantages of the Raw Format?

Requires as much storage as the original disk or data, and some tools might not collect marginal (bad) sectors

What are the six design goals of Advanced Forensic Format (AFF)?

Provides compressed/uncompressed image files, no size restriction for disk-to-image files, space for metadata, simple design with extensibility, open source for multiple platforms/OSs, and internal consistency checks for self-authentication

What file extension is used for AFF segmented image files?

.afd

What file extension is used for AFF metadata?

.afm

What is the definition of metadata?

Data about data (provides info that describes, explains, or gives context to other data)

What is a key characteristic of proprietary formats regarding forensics tools?

Most forensics tools have their own formats for collecting evidence

What three features are offered by proprietary formats?

Option to compress or not compress image files, capability to split an image into smaller segmented files, and integration of metadata into the image file

What are two disadvantages of proprietary formats?

Inability to share an image between different tools, and file size limitation for each segmented volume

What four elements should be included in a general acquisition action plan?

Resources required, outline showing execution, preservation of evidence, and security of evidence before/during/after acquisition

What should you review before arriving to perform an acquisition?

Any available technical specification about a disk drive's data storage media

What are the two types of digital acquisitions?

Static acquisitions and live acquisitions

What dictates whether an acquisition is static or live?

The state of the computer (off = static, on = live)

What two acquisition types can be performed on both static and live systems?

Logical acquisition and sparse acquisition

What are the four data collection methods for static and live acquisitions?

Physical disk-to-image file, physical disk-to-disk copy, partition-to-partition copy, and partition-to-data file (simple file/folder copy)

What determines the best acquisition method to use?

The circumstances of the investigation

What is the most common and flexible data collection method?

Creating a physical disk-to-image file

Why does creating a physical disk-to-image file offer the most flexibility?

You can make more than one copy, copies are bit-for-bit replications of original drive, and it is compatible with many commercial tools

When might you have to create a disk-to-disk copy?

When a disk-to-image copy is not possible

What tools are used for disk-to-disk copies on Windows and Linux?

EnCase and X-Ways Forensics for Windows, Guymager for Linux

Which acquisition methods should you consider if time is limited?

Logical acquisition or sparse acquisition

What is a logical acquisition?

Captures only specific files of interest to the case; does not grab unallocated data

What is a sparse acquisition?

Collects fragments of unallocated (deleted) data

When should you use a sparse acquisition?

Only when you don't need to examine the entire drive

What is the difference between deleted memory and unallocated memory?

Deleted memory refers to space previously occupied by a file marked available by the OS; unallocated memory is storage space not assigned to a partition or file system

Where do deleted memory and unallocated memory exist?

Deleted exists inside a formatted partition; unallocated exists outside

What four factors should you consider when deciding which acquisition method to use?

Size of source (suspect) disk, whether you can retain source disk as evidence, available time, and location of evidence

What three primary hardware speed factors affect acquisition transfer times?

Source drive data transfer read speed, controller interface speed (SATA/USB), and target drive data transfer write speed

What other system variables influence acquisition times?

CPU speed, number of motherboard data transfer threads, and quality/reliability of connecting cables

What is a crucial contingency step for image acquisitions?

Create a duplicate copy of your evidence image file (make at least two images)

How should you create the second image of digital evidence?

Use different tools or techniques

What is the Host Protected Area (HPA)?

An area of a disk drive reserved for booting utilities and diagnostic programs that some tools fail to copy

Which Windows feature makes static acquisitions more difficult?

BitLocker (whole disk encryption)

What advantage do Windows and Linux acquisition tools offer?

Convenience in acquiring evidence from suspect drives, especially when used with hot-swappable devices

How must acquired data be protected during acquisition?

With a well-tested write-blocking hardware device or software application

What is a notable caveat regarding write-blocking devices globally?

Some countries have not accepted the use of write-blocking devices for data acquisitions

How are digital forensics Linux ISO images specially configured?

Contain additional utilities not in normal distributions, and configured not to mount or to mount as read-only

How can you learn available options for shell mounting in Linux?

Type mount --help at the shell prompt

What does "mount" mean in operating systems?

To attach a disk, drive, or file system so the OS can read and write data on it

Can Linux copy data from a physical device without mounting it?

Yes, Linux can copy data from a physical device without having to mount it

Name four well-designed Linux Live CDs for digital forensics.

CAINE, Kali Linux, Knoppix, and SANS Investigative Forensic Toolkit (SIFT)

How do you test a newly created Linux Live CD/DVD or USB drive?

Check workstation BIOS for boot order, insert media, and reboot to load Linux into memory

What should you do if you encounter GUI display problems with Linux Live?

Try another computer with a different video card

What is Mini-WinFE?

A bootable tool to build a Windows forensic boot CD/DVD/USB where connected drives are mounted read-only and Registry files can be accessed

What step must be done before booting a suspect's computer with Mini-WinFE?

Connect your target drive (like a larger USB drive)

How does Mini-WinFE handle the target USB drive after booting?

Lists connected drives and alters the target USB drive to read-write mode for acquisition programs

What ISO configurations and architectures does Kali Linux support?

Ranges from Light (856 MB) to full-featured; supports 32-bit, 64-bit, ARM, Mobile, Apple M1, and virtual machines

What is Kali Linux designed for and what key forensics tool does it contain?

Penetration testing and network security assessment; contains the Linux version of Autopsy

What menu option appears when Kali Live starts up?

A boot menu that includes a forensic mode option

What does "Live" mean when referring to Kali Live?

Booting the system from an external USB

What functions can Exterro's FTK Imager perform?

Bit-by-bit acquisition of media devices or copying selected files/folders

How does FTK Imager verify evidence integrity during acquisition?

Calculates MD-5 and SHA-1 hashes of original source drive and verifies image files match

What hardware is required for FTK Imager to perform static acquisitions?

A hardware write-blocker

What three preparation steps are required for a target drive?

Use new or freshly wiped/formatted drives, record drive info (serial #, manufacturer, size, label), and secure the prepared target drive

What two commands can be used to wipe data from partitions and drives?

format with /p:nth switch, and diskpart with clean all function

What eight details should be recorded in a target drive journal?

Media type, manufacturer/model/serial #, size, purpose, partition count & file system format, forensic boot media, and disposition

Why is understanding the boot sequence critical for forensics?

To avoid contamination of data on a suspect's system by knowing how to modify CMOS, BIOS, EFI, and UEFI settings

What information is stored in CMOS when computer power is off?

System configuration and date/time information

How do you access a computer's CMOS setup screen?

Watch for key prompt during boot up; use screen to change boot sequence

XCOPY /a switch function

Copies only files that have the archive attribute set on

XCOPY /d:date switch function

Copies only files last updated on and after the specified date

XCOPY /e switch function

If errors are encountered, it continues to copy data

XCOPY /f switch function

Lists file name source and its destination name

XCOPY /h switch function

Copies all files that have the hidden attribute set

XCOPY /s switch function

Copies all folders containing data and ignores empty folders

XCOPY /u switch function

Updates existing files from source in destination folders

ROBOCOPY /bytes switch function

Displays the number of bytes copied

ROBOCOPY /ia:[RASHCNETO] switch function

Copies only files with specific attribute set (e.g., r for read-only, c for compressed)

ROBOCOPY /fp switch function

Displays the full pathname of files

ROBOCOPY /v switch function

Creates a verbose output showing files that have been skipped

ROBOCOPY /r:n switch function

Retries n number of times if a file is locked by another user

ROBOCOPY /tee switch function

Creates a status report sent to both console and log file

ROBOCOPY /w:n switch function

Waits n seconds before retrying locked files (default is 30 seconds)

ROBOCOPY /xa:[RASHCNETO] switch function

Excludes files with specific attributes set

ROBOCOPY /xc switch function

Excludes files that have changed

ROBOCOPY /xd <directory> switch function

Excludes specific paths

ROBOCOPY /xf <filename> switch function

Excludes specific files and paths

What utility type is required to validate digital evidence data acquisitions?

A hashing algorithm utility (e.g., CRC-32, MD5, SHA-1 to SHA-512)

What Linux tools perform hashing, raw bit-stream copying, and segmented forensic acquisitions?

md5sum/sha1sum for hashing, dd for bit-stream copies, dcfldd for raw forensic binary files, and dc3dd for enhanced features

How does PowerShell 2.0 validate files and what hashing algorithms are supported?

get-filehash command; supports MD5, SHA-1, SHA-256, SHA-384, and SHA-512

How are SSD storage mechanisms different from magnetic media, and how does TRIM affect validation?

SSDs use NAND flash memory; erasing unallocated space alters hash values, so TRIM should be disabled before securing SSDs

What do mismatched hashes between original and copied data usually indicate, and what is MTTF?

Indicates faulty media; MTTF (Mean Time To Failure) is the expected operating hours before failure

Compare DOS comp, fc, PowerShell compare-object, and Linux diff commands.

comp compares files; fc has more features; PowerShell compare-object combined with get-content matches DOS; Linux diff offers unique comparison features

What are the key features and trade-offs of RAID 0, 1, 2, 3, and 5?

RAID 0 = speed/size (no redundancy); RAID 1 = mirroring; RAID 2 = bit-level write/integrity; RAID 3 = data striping + dedicated parity (3+ disks); RAID 5 = distributed parity

What considerations and tools are involved when acquiring RAID disks?

Consider size, RAID type, drive count, tool compatibility; tools include Runtime Software and R-Tools Technologies (use logical/sparse acquisition for large systems)

Summary of ASR Data SMART, IxImager, OSFClone, DiskExplorer, ForensicSoft SAFE, and X-Ways Imager.

ASR Data SMART = Linux bad-sector tool; IxImager = works with ILookIX; OSFClone = bootable raw/AFF tool; DiskExplorer = FAT/NTFS shareware; ForensicSoft SAFE = bootable Windows CD/USB; X-Ways Imager = forensic acquisition app