MGS610 Knowledge Check 1

Question 1

What are the steps in the forensic process?

Accepted Answer

Collect, Examine, Analyze, Report

Question 2

When acquiring digital evidence, a key way we maintain integrity is by:

Accepted Answer

Comparing hash values

Question 3

Collecting only specific files from a disk, as opposed to the whole disk, is called a logical acquisition.

Accepted Answer

True

Question 4

The anti-forensic technique of _____ involves modifying system time to change the timestamps of files on a system.

Accepted Answer

Time Stomping

Question 5

The NTFS system maintains legacy compatibility with old Apple filesystems. This has lead to a vulnerability called _____

Accepted Answer

Alternative Data Streams

Question 6

Which of the following is not a key enabler of the forensic process?

Accepted Answer

Encryption

Question 7

Fragments of deleted files may be recovered (even if the file is partially overwritten) by examining ____

Accepted Answer

Slack space

Question 8

Which of the following is not a method of data acquisition?

Accepted Answer

Dynamic

Question 9

In Apple's File System (APFS), what is one of the key features that helps user privacy but can hurt investigations?

Accepted Answer

Automatically running the TRIM command on solid state drive memory cells

Question 10

Which of the following is not a forensic benefit of the journal file?

Accepted Answer

It keeps a record of "Most Recently Used" applications

Questions 10