Digital Investigation

1.

A better way to ignore known files is to compare the __________of every file in a forensic duplication with a known set of hashes and ignore any matches.

• MD5 hashes

• Active hashes

• Forensic hashes

• Cryptography

Use______________ to create a partition for the destination drive.

• Win_XP

• Fdisk

• Duplicate disk

• Forensic duplications

1.      In forensics, each piece of hardware must be                           with make model, serial number, evidence tag number, etc.

• Put in closet

• Documented

• Signed

• Shared

1.      One very well known software used for forensic analysis is                              .

• IBM

• Google

• Encase

• Forensic-ripper

The evidence custodian should,

• Give the evidence to the secretary

• Place evidence in the storage place

• Keep logs of who has the evidence, when was it check out, etc.

• Use the evidence for personal use.

1.      when  working on computer forensics always work from                          of the evidence and never from the original to prevent damage to the evidence.

• A.     Original hard drive

• Live computer

• Remote desktop

• An image

1.                                             preserving evidence means that that the information contained on the drive down to the last bit never changes during seizing, analysis and storage.

• Mentally

• Logically

• Physically

• Carefully

_____________________ are devices that allow acquisition of information on a drive without creating the possibility of accidentally damaging the drive contents

• Data blockers

• Write blockers

• Read blockers

• Metadata blockers

1.                                      is used to identify relevant files and fragments of relevant files.

• string searching

• cryptographic files

• relevant data

• undeleted files

When trying to recover deleted files make sure the forensic duplication is so that it is not modified during our analysis.

• On correct disk

• Read-only

• Write-only

• Locked