stud
bud
Sign up
Log in
Home
Library
Explore
SAT
More
DFIR Mods 4 & 5 Flashcards | StudBud
Explore
/
DFIR Mods 4 & 5
DFIR Mods 4 & 5
24 terms
·
StudBud Administration
·
29 plays
Imported from external platform
Flashcards
24 cards
F
Practice quiz
P
Host live
L
Questions
24
Answers
1
Browser cache artifacts include:
Cookies
Browsed URLS
User Accounts
All of the above
2
Which of the following is a Recoverable Artifact?
Browser History
All of the Above
Master File Table
Registry Entries
3
Hashing can be used to verify the integrity of a drive copy.
False
True
4
Prefetch was designed to speed-up the loading of commonly used applications.
False
True
5
What is a useful piece of process information that is volatile?
All of the Above
Remote Connections
Security Event Logs
Registry Settings
6
Sometimes only partial image captures are possible.
False
True
7
Volatile memory is saved to disk when you do this?
Lock Screen
Shutdown
Hibernation
Alt+F4
8
It is not possible to do a drive capture over the network.
True
False
9
Sterilized Media is recommended for data acquisition.
True
False
10
What will display recent user activity?
All of the Above
Most Recently Used (MRU)
Jump List
RunMRU
11
Which of the following is a live Linux distribution dedicated to cloning drives?
FTK Imager
Clonezilla
Autopsy
CAINE
12
Which of the following is a valid capture format?
RAW
All of the above
dd
ISO
13
What is a forensic artifact?
Dinosaur bones and ancient relics
Files to which data is written to and can be later recovered
RAM
A SIEM solution
14
Which of the following is a memory dumping tool?
FTK Imager
VMDK
GREP
DD
15
Browser Caches contain browsed URLs only
False
True
16
DNS Cache is erased when the browser history is erased.
True
False
17
WinPrefetchView is a tool to read browser artifacts.
True
False
18
PowerShell history is a volatile memory artifact.
True
False
19
Which of the following is a tool used for Drive Cloning?
DD
HxD
Volatility
FastDump
20
Which of the following is software that can both clone a disk and dump memory?
DD
FTK Imager
EWF
NMAP
21
Volatility is drive cloning software
False
True
22
There is no way to recover browser activity.
True
False
23
Which of the following is a Memory Dump format?
RAW
ISO
PDF
TXT
24
What is the main purpose of Live Forensics?
Capturing volatile data that will be lost once the system is powered down
Playing with fire is fun
You can use the system in question to do your analysis
Getting things done fast is the most important when dealing with forensics
