Digital Forensics Quiz 10

Can determine if a network is truly under attack/a user has installed an untested patch/program

• Broadcast forensics

• Computer forensics

• Network forensics

• Traffic forensics

__hide the most valuable data at the innermost part of the network

• Layered network defense strategies

• Firewalls

• NAT

• Protocols

__forensics is the systematic tracking of incoming & outgoing traffic on your network

• Network

• Computer

• Criminal

• Server

__can be used to create a bootable forensic CD & perform a live acquisition

• DTDD

• Inquisitor

• Helix

• Neon

Helix operates in 2 modes:Windows Live(GUI or command line) &__

• command Windows

• command Linux

• remote GUI

• bootable Linux

A common way of examining network traffic is by running the__program

• Netdump

• Slackdump

• Coredump

• Tcpdump

__is a suite of tools created by Sysinternals

• PsTools

• EnCase

• R-Tools

• Knoppix

The PSTools__kills processes by name or process ID

• PsKill

• PsExec

• PsList

• PsShutdown

Popular network intrusion detection system that performs packet capture & analysis in real time

• Ethereal

• Snort

• Tcpdump

• john

__is the US DOD computer forensics lab's version of the dd command that comes with Knoppix-STD

• john

• chntpw

• memfetch

• dcfldd