Unit 11 Topic E Forensics

The digital forensic process has five basic stages:

Identification, Preservation, Collection, Analysis and what else?

• Reporting

• Diagnosis

• Reduction

• Ignoring

Which stage of the digital forensic process?

An in-depth systematic search of evidence relating to the incident being investigated.

• Identification

• Preservation

• Collection

• Analysis

Which type of digital forensics is the monitoring, capture, storing and analysis of network activities or events in order to discover the source of security attacks, intrusions or other problem incidents

• Network Forensics

• Computer Forensics

• Mobile Device Forensics

• Digital Image Forensics

Which type of digital forensics is the extraction and analysis of digitally acquired photographic images to validate their authenticity by recovering the metadata of the image file to ascertain its history.

• Network Forensics

• Computer Forensics

• Mobile Device Forensics

• Digital Image Forensics

Which of the following forensics tools can be classified as a computer forensics category?

• Disk and data capture tools

• File viewers

• Registry analysis tools

• Packet inspection tool

What should not be done during a computer forensic investigation?

• Modify date/time stamps of files

• Take copy of hard drive

• Identify and recover all files

• Access hidden and protected files

Which of the following are reasons for a computer forensics investigation?

• Intellectual Property theft

• Fraud investigations

• Inappropriate email and Internet use in the workplace

• Burglary attempt

A generic Network forensic examination includes the following steps:

Identification, preservation, collection, examination, analysis, presentation and what else?

• Incident Response

• Network shutdown

• Employee interrogation

• Application installation tracking

What might make it difficult for the Network investigator to find the origin of the attacker's address?

• Attack via remote proxy server

• Addresses provided using IPv6

• Port scanning blocker

• Data is encrypted

What type of forensics involves the capture, recording and analysis of network packets in order to determine the source of network security attacks?

• Network forensics

• Email forensics

• Web forensics

• Database forensics