CO2517 Digital Evidence 2023 Part 1

Which of these is NOT part of the IR Preparation stage?

• Determining

• Preparing documentation

• IR policies

• Retention of evidence

Answer explanation

Retention of evidence − evidence collected typically has to be stored for a certain period and part of the post-incident activities.

An event is ​ (a)   in a computer system.

Whilst a incident is ​ ​ (b)   for organisation or individuals.

• an observable occurence
• an negatively event with a potential impact

Reorder these stages of the Incident Response Lifecycle

• Containment, Eradication& Recovery

• Preparation

• Post-Incident Activity

• Detection & Analysis

Which of these are NOT in the IR Preparation

• Segmentation

• Risk analysis

• Determining how Indicents are reported.

• Preparing an IR team

Answer explanation

Segmentation – more advanced than isolation by using a honeynet and allow the attacker to continue to receive filtered output to deceive him/her into thinking the attack is progressing successfully. This part of the Incident Containment phase.

Which of these is NOT part of the IR Detection & Analysis stage?

• Recordings

• Recovery Procedures

• Incident Indicator Validation

• Incident Indicator Definitions

Answer explanation

Definition of what would confirm the incident would be in the preparation phase.

​ (a)   could use a honeynet to allow attack to receive filled output and part of th (b)   phase.

• Segmentation
• Containment
• Analysis
• Preparation
• IR Planning
• IR

Answer explanation

Segmentation – more advanced than isolation by using a honeynet and allow the attacker to continue to receive filtered output to deceive him/her into thinking the attack is progressing successfully.

Which of these activities are NOT part of the Post-Incident phase.

• retention of evidence

• risk assessment

• collected metrics

• lessons learned

Match the following

• Professional forensic software by Guidance Software, which includes an acquisition tool.

• DD

• A free Windows based utility for imaging and browsing data.

• OOV

• The volatility of data.

• FTK

• Linux-based 'live CD' tool for accssing HDD data.

• LinEN

• Linux command line tool to copy data from set locations.

• Encase

Match the following

• Ensures that only authorized parties can view the information

• Confidentiality

• Ensures that information is correct and there is no unauthorized modification

• Integrity

• Ensures that information is available to authorized parties

• Availability

Match the following

• an intentional or unintentional act that causes damage/compromise information or systems

• Exploit

• an action that has the potential to adversely affect operations and assets.

• Attack

• a single instance of an information asset suffering damage or destruction.

• Threat

• the technique used to compromise a system and take advantage of a vulnerability.

• Loss