Forensics Chapter Quizzes - Midterms

Question 1

True or False? A cryptographic hash is reversible.

Accepted Answer

FALSE

Question 2

True or False? Real evidence is any physical object, like a laptop with fingerprints.

Accepted Answer

TRUE

Question 3

In Windows, what does the file allocation table (FAT) store?

Accepted Answer

The mapping between files and their cluster location on the hard drive

Question 4

As a cybercriminal, if you use ciphertexts to learn about the plaintext, which cryptographic attack are you using?

Accepted Answer

Ciphertext-only

Question 5

______ is the basic repair tool in Windows.

Accepted Answer

Chkdsk

Question 6

Which process involves analyzing data traffic and logs using sniffers?

Accepted Answer

Network forensics

Question 7

End users generally cannot repair most physical damage to storage media, such as a hard disk.

Accepted Answer

True

Question 8

True or False? All modern block-cipher algorithms use both substitution and transposition.

Accepted Answer

TRUE

Question 9

True or False? Steganography hides information within a file to keep it secret if intercepted.

Accepted Answer

TRUE

Question 10

What is the definition of "Kasiski examination"?

Accepted Answer

Method of attacking polyalphabetic substitution ciphers, ie Vigenère cipher

Question 11

Which of the following is not true of computer forensics?

Accepted Answer

The emphasis is on the volume of evidence.

Question 12

True or False? "Chosen plaintext attack" and "ciphertext-only" are two cryptanalysis methods for cracking encryption.

Accepted Answer

FALSE

Question 13

True or False? Damage to how data is stored on a disk, such as file system corruption, refers to physical damage.

Accepted Answer

False

Question 14

What type of evidence is Ed using by showing a computer animation in court?

Accepted Answer

Demonstrative

Question 15

True or False? A collision occurs when two different inputs to the same hashing algorithm produce the same

Accepted Answer

TRUE

Question 16

What concept requires scientific evidence to be tested and accepted by experts?

Accepted Answer

The Daubert Standard

Question 17

True or False? Police usually need a warrant or consent to search a phone.

Accepted Answer

TRUE

Question 18

__ is the basic repair tool in Mac OS.

Accepted Answer

Disk Utility

Question 19

Journaling file systems, such as NTFS 5.0 and Ext3, help to reduce the incidence of physical damage to a hard disk.

Accepted Answer

False

Question 20

What ensures evidence is tracked and unchanged from collection to court?

Accepted Answer

The chain of custody

Question 21

When two files claim to share the same allocation unit (or cluster), one of the files is almost certain to lose data.

Accepted Answer

True

Question 22

T/F? Logical damage to a file system may prevent the host operating system from mounting or using the file system

Accepted Answer

True

Question 23

The ________ and the ________ are the two NTFS files of most interest to forensics efforts.

Accepted Answer

Master File Table (MFT), cluster bitmap

Question 24

What is the definition of "stream cipher"?

Accepted Answer

Cryptography that encrypts the data as a stream, one bit at a time

Question 25

_ is a computer's physical address.

Accepted Answer

A MAC address

Question 26

True or False? Investigators must authenticate documentary evidence.

Accepted Answer

TRUE

Question 27

_ is an asymmetric cryptographic protocol that allows two parties to establish a shared key over an insecure channel.

Accepted Answer

RSA

Question 28

In FAT and NTFS file systems, a __________ is used to map files to specific clusters where they are stored on the disk

Accepted Answer

table

Question 29

Which of the following is not true of file carving?

Accepted Answer

You can perform file carving on the NTFS & FAT32 files sys.s but not Ext4.

Question 30

T/F? An inode is a data structure in Windows NTFS file sys that stores all info a/b a file except its name & actual data

Accepted Answer

False

Question 31

What is the definition of "transposition" in terms of cryptography?

Accepted Answer

The swapping of blocks of ciphertext

Question 32

True or False? To avoid changing a computer system while examining it, make a forensic copy and work with that copy.

Accepted Answer

TRUE

Question 33

Kerckhoffs' principle states that the security of a cryptographic algorithm depends only on the secrecy of:

Accepted Answer

the key

Question 34

_ is a data structure in the Linux file system that stores all the info about a file except its name & actual data.

Accepted Answer

inode

Question 35

Which of the following is the best definition of "forensics"?

Accepted Answer

Sci & tech to investigate & establish facts in criminal/civil court of law

Question 36

Which process involves searching memory in real time to find system abuse?

Accepted Answer

Live system forensics

Question 37

True or False? Least significant bit (LSB) is a common steganography method.

Accepted Answer

TRUE

Question 38

True or False? Disk forensics involves recovering data and identifying its creator.

Accepted Answer

TRUE

Question 39

What standard tracks who handled evidence from seizure to court?

Accepted Answer

Chain of custody

Question 40

You can perform file carving on a PDF file but not on image files.

Accepted Answer

False

Question 41

What’s the key advantage when recovering specific deleted files?

Accepted Answer

Time; files deleted relatively recently are more likely to be recovered

Question 42

True or False? A warrant is not needed when evidence is in plain sight.

Accepted Answer

TRUE

Question 43

As a forensic examiner, if the disk’s structure is damaged & won’t boot, is zero-knowledge analysis the right next step?

Accepted Answer

Yes. It rebuilds the file system from scratch for data recovery.

Question 44

True or False? An expert witness testifies based on specialized knowledge, not personal experience.

Accepted Answer

TRUE

Question 45

is the preferred file system of Windows 2000 and later operating systems.

Accepted Answer

NTFS

Question 46

True or False? The Windows NTFS file system views a cluster as entirely utilized if even one bit is used.

Accepted Answer

True

Question 47

True or False? When a file on a Windows disk is deleted, the data is removed from the disk.

Accepted Answer

True

Question 48

True or False? Data Encryption Standard (DES) is a stream cipher.

Accepted Answer

FALSE

Question 49

Although the Data Encryption Standard (DES) algorithm is sound, it is no longer considered secure because:

Accepted Answer

of its small key size.

Question 50

True or False? In Windows, files that are moved to the Recycle Bin are permanently deleted.

Accepted Answer

False

Question 51

True or False? Turning off a computer while it is booting or shutting down can lead to logical damage of its file system

Accepted Answer

True

Question 52

True or False? The term "expert report" refers to testimony taken from a witness or party to a case before a trial.

Accepted Answer

FALSE

Question 53

True or False? Raw information is always considered to be evidence.

Accepted Answer

FALSE

Question 54

What type of evidence is Tonya preparing with photos and message printouts?

Accepted Answer

Documentary evidence

Question 55

True or False? Two ways to present evidence in a forensic case are the expert report and expert testimony.

Accepted Answer

TRUE

Forensics Chapter Quizzes - Midterms

Questions 55

Forensics Chapter Quizzes - Midterms

Questions 55