ONE 6th FORM Forensic Computing

The digital forensic process has five basic stages:

Identification, Preservation, Collection, Analysis and what else?

• Reporting

• Diagnosis

• Reduction

• Ignoring

Which stage of the digital forensic process?

An in-depth systematic search of evidence relating to the incident being investigated.

• Identification

• Preservation

• Collection

• Analysis

Which type of digital forensics is the monitoring, capture, storing and analysis of network activities or events in order to discover the source of security attacks, intrusions or other problem incidents

• Network Forensics

• Computer Forensics

• Mobile Device Forensics

• Digital Image Forensics

What should not be done during a computer forensic investigation?

• Modify date/time stamps of files

• Take copy of hard drive

• Identify and recover all files

• Access hidden and protected files

Which of the following are reasons for a computer forensics investigation?

• Intellectual Property theft

• Fraud investigations

• Inappropriate email and Internet use in the workplace

• Burglary attempt

A generic Network forensic examination includes the following steps:

Identification, preservation, collection, examination, analysis, presentation and what else?

• Incident Response

• Network shutdown

• Employee interrogation

• Application installation tracking

What might make it difficult for the Network investigator to find the origin of the attacker's address?

• Attack via remote proxy server

• Addresses provided using IPv6

• Port scanning blocker

• Data is encrypted

What type of forensics involves the capture, recording and analysis of network packets in order to determine the source of network security attacks?

• Network forensics

• Email forensics

• Web forensics

• Database forensics

What is computer forensics?

• It is an attempt to expose, alter, destabilize, destroy, remove to gain unauthorized access or use an asset.

• It is the discipline that combines the elements of law and computer science to collect and analyze data from computer Systems, network, Wireless communications and storage devices in a way that is admisible as evidence in a court of law.

1. A _______ has occurred, collecting all relevant evidence is of the utmost importance in answering the questions described above.

• file headers.

• forensic investigator.

• cyber attack.