Digital Forensics Flashcard

Front

Will changing the file's name affect the file's MD five hash value?

Back

No

Front

A file path specifies a unique location in a file system.

Back

True

Front

Encrypted data can be recovered using which of the following methods? All these can work, Trying every possible encryption key, Obtaining the passphrase used to protect the encryption key, Recovering plaintext versions of data from unallocated and slack space

Back

All these can work

Front

The decision to seize an entire computer versus create a forensic duplicate of the internal hard drive will be influenced by the role of the computer.

Back

True

Front

To insure the integrity of the exam, all forensic examinations should be performed on the original digital evidence.

Back

False

Front

Where does Windows store the time zone offset?

Back

Registry

Front

Unallocated space is?

Back

The space on a disk that is not assigned to files

Front

What is a write-blocker used for in digital forensics?

Back

To prevent accidental modification of evidence

Front

How can you verify that your image is unchanged? Options: MD5, CRC, SHA-2, SHA-1

Back

All these are correct

Front

Is the information stored on a computer's ram chip accessible after a proper shutdown?

Back

No