Evaluating Digital Forensic Tool Needs

Forensics software tools are grouped into GUI and command-line applications

• True

• False

According to ISO standard 27037, which of the following is an important factor in data acquisition?

• The DEFR’s competency

• The DEFR’s skills in using the command line

• Conditions at the acquisition setting

An encrypted drive is one reason to choose a logical acquisition.

• True

• False

Hashing, filtering, and file header analysis make up which function of computer forensics tools?

• Validation and verification

• Acquisition

• Extraction

• Reconstruction

Hardware acquisition tools typically have built-in software for data analysis.

• True

• False

Which of the following purposes is the reconstruction function NOT needed for

• Re-create a suspect drive to show what happened

• Create a copy of a drive for other investigators.

• Recover file headers.

• Re-create a drive compromised by malware.

Decompressing, carving, decrypting, and bookmarking are examples of subfunctions of the extraction function

• True

• False

Hash values are used for which of the following purposes

• Determining file size

• Reconstructing file fragments

• Validating that the original data hasn’t changed

The verification function does which of the following?

• Proves that a tool performs as intended

• Creates segmented files

• Proves that two sets of data are identical via hash values

• Verifies hex editors

A live acquisition can be replicated

• True

• False