Single-cycle carry out cmplte memory transaction in 1 clock cycle. Each sequential RAM access w/in pg tkes 2 clock cycle

Extended data out dynamic random access memory (EDO DRAM)

An expert may state an opinion and give the reasons for it without first testifying to the underlying facts or data.

Rule 705: Disclosing the facts or data underlying an expert

What terms relate to perjury?

Reputation Destroying, Felony, Career Ruining

Introduced by Microsoft in 1993 as a new file system to replace FAT.

New Technology File System (NTFS)

What are the types of evidence courts deal with?

Documentary, Testimonial, Real, Demonstrative

What makes ReFS or Resilient File System a more resilient file system?

proactive error correction, checksums for both metadata and file data

636 – LDAPS (LDAP over SSL/TLS)

Can be programmed only once. Data is not lost when power is removed.

Programmable read-only memory (PROM)

A witness who is qualf'd as an expert by knwldge, skill, experie, training, or ed. may testify in the form of an opinion

Rule 702: Defines what an expert is and what is an expert testimony

Latent evidence can take many forms ie

finger-prints left on a window, DNA evidence recovered from bloodstains, files on a hard drive

studbud

CSCI 6350 - Chapter 1

183 termsStudBud Administration2 plays

CSCI 6350 - Chapter 1 - Forensics

Flashcards183 cardsFPractice quizPHost liveL

Questions 183

Answers

1
Not volatile; it cannot be changed. used for instructions embe'd in chips & ctrls how cpu, option crds, peri etc operate
Programmable read-only memory (PROM)
Random access memory (RAM)
Read-only memory (ROM)
Erasable programmable read-only memory (EPROM)
2
File headers start at the last byte of a file.
False
True
3
Linux can also be used on Mac OS, from the _.
Terminal
Powershell
CLI
Shell prompt
4
A forensic analyst also examines _, which is data about info, such as disk partition structures and file tables.
files
pivot tables
metadata
backups
5
Data obscured thru encryption, steganography, compression, or proprietary formats can sometimes be converted.
False
True
6
evidence is data stored as written matter, on paper, or in electronic files.
Documentary
Real
Demonstrative
Testimonial
7
Clusters can be 1 to 128 sectors in size. Meaning 512 bytes up to _
50 kilobytes
256 kilobytes
128 kilobytes
64 kilobytes
8
The issue is that SSDs use flash memory (and related technology) with individual segments (as opposed to sectors).
False
True
9
Ex. laptop w/ suspect’s fingerprints on keyboard, a hard drive, a universal serial bus (USB) drive, & handwritten note
Demonstrative
Documentary
Real
Testimonial
10
Single-cycle carry out cmplte memory transaction in 1 clock cycle. Each sequential RAM access w/in pg tkes 2 clock cycle
Synchronous dynamic random access memory (SDRAM)
Asynchronous dynamic random access memory (ADRAM)
Extended data out dynamic random access memory (EDO DRAM)
Burst EDO (BEDO) DRAM
11
Popular; used primarily with Linux. Was the first file system to be included with the standard Linux kernel, v2.4.1
File Allocation Table (FAT)
ReiserFS
New Technology File System (NTFS)
ReFS or Resilient File System
12
An expert may state an opinion and give the reasons for it without first testifying to the underlying facts or data.
Rule 706: Court-appointed expert witness
Rule 703: Bases of an expert
Rule 705: Disclosing the facts or data underlying an expert
Rule 704: Opinion on ultimate issue
13
Secure communications and file transfer
53 – DNS (Domain Name Service)
25 – SMTP (Simple Mail Transfer Protocol)
22 – SSH and secure FTP
23 – Telnet
14
Suspects often store data where an investigator is unlikely to find it. They may hide data in reserved disk sectors
Data destruction
Data transformation
Data hiding
File system alteration
15
Ex. testimonial evid show fingerprints found on kybrd are those of a spec indiv/sys access ctrls sh who put photos dsktp
Documentary
Testimonial
Real
Demonstrative
16
What terms relate to perjury?
Reputation Destroying
Truth
Felony
Career Ruining
17
It is common to have the forensic lab be a locked room access given only to those who must enter. Need-to-know basis
False
True
18
evidence is information that forensic specialists use to support or interpret real or documentary evidence.
Real
Demonstrative
Testimonial
Documentary
19
Two types of journaling:
Logical
Metadata
Remote
Physical
20
With sector, newer systems often use a _ sector size.
4096-byte
512-byte
64-byte
128-byte
21
With SSDs, a technique called _ used to extend the life of the drive.
Low-level format
Wear leveling
Slack space
High-level format
22
Introduced by Microsoft in 1993 as a new file system to replace FAT.
New Technology File System (NTFS)
Apple File System (APFS)
ReFS or Resilient File System
File Allocation Table (FAT)
23
Used in Windows networks
137, 138, 139 – NetBIOS
179 – BGP
194 – IRC (Internet Relay Chat)
220 – IMAP
24
Border gateway protocol. Used by gateway routers exchanging routing data.
137, 138, 139 – NetBIOS
179 – BGP
194 – IRC (Internet Relay Chat)
220 – IMAP
25
What are the types of evidence courts deal with?
Documentary
Testimonial
Real
Demonstrative
26
What makes ReFS or Resilient File System a more resilient file system?
proactive error correction
default file system for Apple computers using Mac OS 10.13
checksums for both metadata and file data
developed at the University of California, Berkeley
27
Encrypted LDAP
23 – Telnet
636 – LDAPS (LDAP over SSL/TLS)
20, 21 – FTP (File Transfer Protocol)
465 – SMTP over SSL
28
Expert reports of 100, 200, or more pages are common. The largest seen was over 1500 pages long.
False
True
29
HDDs record data by _ _ material directionally to represent either a 0 or a 1 binary digit.
magnetizing ferromagnetic
copying ferromagnetic
mirroring ferromagnetic
digitizing ferromagnetic
30
The physical ports operate at OSI Layer _.
2, the Network Layer
1, the Physical Layer
7, the Application Layer
4, the Transport Layer
31
Becoming more common. Use microchips that retain data in non-volatile memory chips and contain no moving parts.
Integrated Drive Electronics (IDE)
Solid-state drives
Parallel Advanced Technology Attachment (PATA)
Small Computer System Interface (SCSI)
32
Can also be referred to as a computer’s physical address
specific card
vendor
physical port
IP address
33
SSDs have used NAND-based flash memory (NAND stands for “negated AND gate”), which retains memory even without power.
True
False
34
A forensic specialist must not adhere to stringent guidelines and avoid taking shortcuts.
True
False
35
This is the most important principle in any forensic effort, digital or nondigital.
Chain of Custody
Don’t Touch the Suspect Drive
Document Trail
Secure the Evidence
36
Encrypted email
465 – SMTP over SSL
20, 21 – FTP (File Transfer Protocol)
636 – LDAPS (LDAP over SSL/TLS)
23 – Telnet
37
Memory that cannot be changed
volatile memory
non-volatile memory
38
Can be programmed only once. Data is not lost when power is removed.
Programmable read-only memory (PROM)
Erasable programmable read-only memory (EPROM)
Random access memory (RAM)
Read-only memory (ROM)
39
Information processed & assembled so that it is relevant to an investigation & supports a specific finding/determination
Digital evidence
Chain of custody
Metadata
Storage
40
A witness who is qualf'd as an expert by knwldge, skill, experie, training, or ed. may testify in the form of an opinion
Rule 702: Defines what an expert is and what is an expert testimony
Rule 401: Test for relevant evidence
Rule 704: Opinion on ultimate issue
Rule 705: Disclosing the facts or data underlying an expert
41
As a forensic specialist, you will testify as an expert witness on the basis of scientific/technical knwldge you have
expert testimony
scientific testimony
technical testimony
witness testimony
42
Useful for some live network troubleshooting; not useful or trustworthy for forensic examination
ping
ipconfig—ifconfig
tracert—traceroute
ipconfig/all—ifconfig -a
43
Touch the system as little as possible. It is possible to make changes to the system in the process of examining it.
True
False
44
Forensic tools such as AccessData’s Forensic Toolkit, Guidance Software’s EnCase, or PassMark’s OSForensics can make
live copy
digital copy
immediate copy
forensic copy
45
Simple network management protocol
20, 21 – FTP (File Transfer Protocol)
161 – SNMP (and 162)
69 – TFTP
43 – WhoIS
46
In computer forensics, emphasis must be on the _ and _ of evidence
efficiency
integrity
security
latency
47
Latent evidence can take many forms ie
any evidence that is visible without any special processing
finger-prints left on a window
DNA evidence recovered from bloodstains
files on a hard drive
48
Older system; popular w/ Microsoft operating systems for many years. First used in Microsoft Standalone Disk BASIC.
Apple File System (APFS)
ReFS or Resilient File System
New Technology File System (NTFS)
File Allocation Table (FAT)
49
Courts deal with five types of evidence: Real, Documentary, Testimonial, Demonstrative, and Progressive
False
True
50
Continuity ctrl of evid that makes it possib to account for all that happ to evid btwn its orig collection & court appea
Digital forensics
Chain of custody
Digital evidence
Expert testimony
51
Basic unit of data storage on a hard disk, which is usually 512 bytes.
Drive geometry
Sector
Cluster
Kilobyte
52
Has an extensive collection of forensic, security, and hacking tools
Kali Linux
UNIX
Windows Registry
MacOS
53
Methods for disposing of data. ie simple-wiping the memory buffers used by a program or complex-overwriting data cluster
Data destruction
Data transformation
Obscured information
Anti-forensics
54
Examples are email messages, logs, databases, photographs, and telephone call- detail records.
Demonstrative
Testimonial
Documentary
Real
55
A logical grouping of sectors. Can be 1 to 128 sectors in size.
Kilobyte
Cluster
Drive geometry
Sector
56
Known as UNIX file system. Uses a bitmap to track free clusters, showing which clusters are available & which are not.
New Technology File System (NTFS)
Apple File System (APFS)
ReFS or Resilient File System
The Berkeley Fast File System
57
US-CERT, defines computer forensics as
Forensics deals primarily with the recovery and analysis of latent evidence
scintf.c knwldge for collecting, analyzing, & presenting evidence to courts
58
Gives the name of your computer, when your computer obtained its IP address, and more.
ipconfig/all—ifconfig -a
ping
ipconfig—ifconfig
tracert
59
The process of searching memory in real time, typically for working with compromised hosts or to identify system abuse.
Network forensics
Disk forensics
Internet forensics
Live system forensics
60
Any document, spreadsheet, picture, video, or even program is a file.
False
True
61
Evid is rlvnt if it hs tdncy to mke fact +/- prob thn it wld be w/o evidence (b) the fact is of consqe in dtrmng action
Rule 401: Test for relevant evidence
Rule 704: Opinion on ultimate issue
Rule 703: Bases of an expert
Rule 705: Disclosing the facts or data underlying an expert
62
Refers to the functional dimensions of a drive in terms of the number of heads, cylinders, and sectors per track.
Cluster
Kilobyte
Drive geometry
Sector
63
The data is there, but do you know what it means? Related to your scientific knowledge.
Analyzing
Presenting
Collecting
64
Study of the source and content of email as evidence.
Email forensics
Disk forensics
Network forensics
Internet forensics
65
This means that many forensic techniques you can use on Linux can also be used on Mac OS, from the shell prompt.
True
False
66
A formal document that lists what tests you conducted, what you found, and your conclusions. Also includes your CV
curriculum vitae (CV)
conclusion paper
expert testimony
expert report
67
Metadata also includes file creation, modification times, who authored a file, and when it was revised or updated.
False
True
68
How you collect the evidence determines if that evidence is admissible in a court.
True
False
69
An enhancement of IDE. It uses either a 40-pin (like IDE) or 80-pin connector.
Integrated Drive Electronics (IDE)
Parallel Advanced Technology Attachment (PATA)
Small Computer System Interface (SCSI)
Enhanced Integrated Drive Electronics (EIDE)
70
Platters are organized on a _ with a read/write head reading and writing data to and from the platters.
sockets
plates
spindle
platters
71
Older standard, was common on PCs for many years. Dealing with it if you encounter a 40-pin connector on the drive.
Small Computer System Interface (SCSI)
Parallel Advanced Technology Attachment (PATA)
Enhanced Integrated Drive Electronics (EIDE)
Integrated Drive Electronics (IDE)
72
Stores the programs and data you currently have open, but only for as long as the computer has power supplied to it
non-volatile memory
volatile memory
73
The appointment of neutral experts used to advise court; working for neither plaintiff/defendant; work for the court
Rule 703: Bases of an expert
Rule 705: Disclosing the facts or data underlying an expert
Rule 704: Opinion on ultimate issue
Rule 706: Court-appointed expert witness
74
Authentication in environments using Kerberos authentication
80 – HTTP (Hyper Text Transfer Protocol)
110 – POP3 (Post Office Protocol Version 3)
109 – POP 2
88 – Kerberos Authentication
75
IP addresses, sometimes called logical addresses, are assigned to a computer and can be easily changed.
True
False
76
This is an enhancement of SCSI. It supports up to 65,537 devices and does not require termination.
Small Computer System Interface (SCSI)
Serial SCSI
Solid-state drives
Parallel Advanced Technology Attachment (PATA)
77
Goal in computer forensics is to recover, analyze, & present computer-based material that it can be used as evidence in
probative value
Computer Forensics World
network server
a court of law
78
A command that queries a target IP address for information
20, 21 – FTP (File Transfer Protocol)
69 – TFTP
161 – SNMP (and 162)
43 – WhoIS
79
The space btwn the end of a file & end of cluster. This is space that can be used to hide data.
Software
Slack space
High-level format
Low-level format
80
Default for Apple computers using Mac OS 10.13. APFS supports encryption, snapshots, and other features. SSD is best/HD
File Allocation Table (FAT)
New Technology File System (NTFS)
Apple File System (APFS)
ReFS or Resilient File System
81
The Windows Registry is NOT essentially a repository of all settings, software, and parameters for Windows.
False
True
82
In a deposition the other side’s lawyer gets to ask questions, even ?s that would probably be disallowed by trial judge
True
False
83
First step in determining your system’s network configuration; to get information about your own system
ping
ipconfig/all—ifconfig -a
tracert
ipconfig—ifconfig
84
An opinion is not objectionable just because it embraces an ultimate issue. expert witness can offer opinion as ult. iss
Rule 705: Disclosing the facts or data underlying an expert
Rule 703: Bases of an expert
Rule 706: Court-appointed expert witness
Rule 704: Opinion on ultimate issue
85
The term used to emphasize the wide range of different devices that can be included relating to computer forensics
anti-forensics
computer forensics
forensics
digital forensics
86
The process of examining network traffic, including transaction logs and real-time monitoring using sniffers and tracing
Disk forensics
Internet forensics
Network forensics
Email forensics
87
In the Linux world, work done from the _ , called the _ in Linux, is far more important than it is in Windows.
prompt; shell
command line; shell
command line; prompt
desktop; homescreen
88
Old, est in 1986. Must have a terminator at the end of the chain of devices to work & are limited to 16 chained devices.
Small Computer System Interface (SCSI)
Parallel Advanced Technology Attachment (PATA)
Integrated Drive Electronics (IDE)
Enhanced Integrated Drive Electronics (EIDE)
89
Encrypted HTTP
445 Active Directory, SMB
389 – LDAP
443 – HTTPS
464 – Kerberos
90
The process of searching the contents of cell phones.
Cell-phone forensics
Disk forensics
Email forensics
Network forensics
91
The second three bytes of a MAC address identify the
IP address
specific card
physical port
vendor
92
The system logs a copy of every block about to be written to the storage device before it is written. Includes checksum
Metadata
Physical
Remote
Logical
93
_ is one of the most time-consuming parts of a forensic investigation, and it can be the most challenging.
Presenting
Collecting
Data Analysis
94
ROM is
volatile memory
non-volatile memory
95
For many years, _ was a complete OS. But with OS X, system is based on FreeBSD, a UNIX clone very similar to Linux.
Linux
UNIX
macOS
Windows OS
96
Data is not lost when power is removed. A technique for storing instructions on chips.
Random access memory (RAM)
Read-only memory (ROM)
Programmable read-only memory (PROM)
Erasable programmable read-only memory (EPROM)
97
Ex of DNS issues: changing mapping of website name to IP address permanently/temporarily redirect browsers incorrectly
False
True
98
The actions that perpetrators take to conceal their locations, activities, or identities are generally termed
Anti-forensics
Obscured information
Data transformation
Data destruction
99
When in doubt, err on the side of under-documentation. Its not possible to document too little info abt an investigation
True
False
100
Investigators must carefully show an unbroken _ to demonstrate that evidence has been protected from tampering.
Metadata
Chain of custody
Expert report
Digital link
101
A new file system from Microsoft. Available on Windows Server 2019, but not Windows 10. A more resilient file system.
File Allocation Table (FAT)
New Technology File System (NTFS)
Apple File System (APFS)
ReFS or Resilient File System
102
A MAC address is a 6-byte (or 48-bit) address used to identify a network interface card.
False
True
103
Use of analytical and investig techniques to identify, collect, examine, & preserve magnetically stored/encoded evidence
anti-forensics
forensics expert
forensics
computer forensics
104
Defines what an expert is and what expert testimony is
U.S. Federal Rule 702
U.S. Federal Rule 401
U.S. Federal Rule 705
U.S. Federal Rule 706
105
Not synchronized to the CPU clock.
Extended data out dynamic random access memory (EDO DRAM)
Burst EDO (BEDO) DRAM
Synchronous dynamic random access memory (SDRAM)
Asynchronous dynamic random access memory (ADRAM)
106
Also known as malware forensics, is the process of examining malicious computer code.
Disk forensics
Software forensics
Network forensics
Email forensics
107
What was formerly known as BackTrack in 2013?
Windows Registry
Kali Linux
MacOS
UNIX
108
Used in Windows networks
445 Active Directory, SMB
464 – Kerberos
443 – HTTPS
389 – LDAP
109
Displays web pages
88 – Kerberos Authentication
110 – POP3 (Post Office Protocol Version 3)
80 – HTTP (Hyper Text Transfer Protocol)
109 – POP 2
110
While IPv6 has been available for awhile, a majority of computers are still using IPv4, which provides a _ address
32-bit
128-bit
64-bit
256-bit
111
Physical ports are physical. You can touch them. Even a wireless physical port can be touched.
False
True
112
An expert may base an opinion on facts or data that the expert has been made aware of or personally observed.
Rule 706: Court-appointed expert witness
Rule 703: Bases of an expert
Rule 704: Opinion on ultimate issue
Rule 705: Disclosing the facts or data underlying an expert
113
Data has to be first & foremost relevant to a case, to be evidence.
True
False
114
Used to change passwords
443 – HTTPS
464 – Kerberos
445 Active Directory, SMB
389 – LDAP
115
Suspects may process info in a way that disguises its meaning. ie: use encryption to scramble a msg or steganography
Anti-forensics
Data destruction
Obscured information
Data transformation
116
RAM is
volatile memory
non-volatile memory
117
An example is a chart that explains a technical concept to the judge and jury.
Testimonial
Demonstrative
Real
Documentary
118
Replacement for EDO.
Synchronous dynamic random access memory (SDRAM)
Asynchronous dynamic random access memory (ADRAM)
Extended data out dynamic random access memory (EDO DRAM)
Burst EDO (BEDO) DRAM
119
Later development of SDRAM. DDR2, DDR3, and DDR4 are now available.
Double data rate (DDR) SDRAM
Synchronous dynamic random access memory (SDRAM)
Extended data out dynamic random access memory (EDO DRAM)
Asynchronous dynamic random access memory (ADRAM)
120
Each segment has a finite number of erase cycles before the segment is unreliable. Thus wear leveling
is sometimes referred to as a quick format
spreads out the use of the SSD to avoid this problem
is the space between the end of a file and the end of the cluster
means slack space is not particularly useful on SSDs
121
The extraction of data from electronic devices in a consistent, scientific manner is
anti-forensics
computer forensics
forensics
forensics expert
122
One legal principle that is key to forensics and is all too often overlooked in forensics books
the Privacy Act of 1974
the Daubert standard
the Communications Assistance to Law Enforcement Act of 1994
the Privacy Protection Act (PPA) of 1980
123
On HDDs, magnetic data is stored on
platters
sockets
plates
spindles
124
Places to look for forensic evidence on Windows OS
New software
Browser cookies and history
Windows Registry
index.dat file
125
What is the heart of Windows OS?
Linux
Control Panel
Mac OS
Windows Registry
126
This is an extension/enhancement of IDE.
Small Computer System Interface (SCSI)
Parallel Advanced Technology Attachment (PATA)
Integrated Drive Electronics (IDE)
Enhanced Integrated Drive Electronics (EIDE)
127
Old email protocol
110 – POP3 (Post Office Protocol Version 3)
88 – Kerberos Authentication
109 – POP 2
80 – HTTP (Hyper Text Transfer Protocol)
128
The process of the file sys keeping record of what file transactions take place so that if a HD crash, files recovered
Journaling
Globally unique identifier (GUID)
Record keeping
File headers
129
In completing an analysis, forensic specialists face variations in which of the following:
The complexity of the computer system
The size & character of crime scene (can cross U.S. foreign jurisdictions)
The volume of data to be analyzed
The size of the caseload and resource limitations
130
SDRAM and, more specifically, DDR3 and DDR4, are the most common forms of RAM found in PCs and laptops.
True
False
131
The process of setting up an empty file system on the disk and installing a boot sector; aka a quick format.
High-level format
Low-level format
Slack space
Software
132
The two most basic forms of Presenting are the expert report and expert testimony.
False
True
133
The units of information transfer are 1 and 0 bits grouped into fixed-length units called Layer _ frames.
4
1
7
6
134
Once you have finished your investigation, done your analysis, obeyed all rules & guidelines, you still have the _ step.
Analyzing
Collecting
Presenting
135
Investigators must _ documentary evidence—that is, demonstrate that it’s genuine and was not created after the fact.
repeat
authenticate
translate
modify
136
It is solving a complex puzzle—putting together the data you have and finding out what sort of picture is revealed.
Analyzing
Collecting
Presenting
137
All the raw information is, in and of itself, evidence.
False
True
138
Email protocol
179 – BGP
194 – IRC (Internet Relay Chat)
220 – IMAP
137, 138, 139 – NetBIOS
139
Used to remotely log onto a system. Use a command prompt/shell to execute commands on that sys. Popular w/network admins
23 – Telnet
25 – SMTP (Simple Mail Transfer Protocol)
53 – DNS (Domain Name Service)
22 – SSH and secure FTP
140
evidence is information that helps explain other evidence—any other evidence
Testimonial
Documentary
Demonstrative
Real
141
Any device that can store data is potentially the subject of computer forensics.
False
True
142
Any scientific evidence presented in a trial has to have been reviewed and tested by the relevant scientific community
the Privacy Act of 1974
the Privacy Protection Act (PPA) of 1980
the Daubert standard
the Communications Assistance to Law Enforcement Act of 1994
143
UDP-based file transfer
69 – TFTP
20, 21 – FTP (File Transfer Protocol)
161 – SNMP (and 162)
43 – WhoIS
144
This form is how the instructions in your computer’s basic input/output system (BIOS) are stored.
Programmable read-only memory (PROM)
Erasable programmable read-only memory (EPROM)
Read-only memory (ROM)
Electronically erasable programmable read-only memory (EEPROM)
145
“the use of science and technology to investigate and establish facts in criminal or civil courts of law.”
forensics
anti-forensics
computer forensics
forensics expert
146
You should make a _ of the system to avoid making undesirable changes while examining. Make a copy and analyze the copy.
immediate copy
live copy
forensic copy
digital copy
147
Journaling file systms are not fault tolerant bc the file sys logs all changes to files, directories, or file structures
False
True
148
Linux is a _ clone, developed originally by Linus Torvalds.
Kali Linux
MacOS
UNIX
Windows Registry
149
A MAC address is not supposed to be unique, can be tied to multiple physical ports, & can be duplicated/reused.
True
False
150
Used for transferring files between computers. Port _ is for data, and port _ for control.
43 – WhoIS
20, 21 – FTP (File Transfer Protocol)
161 – SNMP (and 162)
69 – TFTP
151
An evolution of the EDO, can process four memory addresses in one burst.
Synchronous dynamic random access memory (SDRAM)
Burst EDO (BEDO) DRAM
Extended data out dynamic random access memory (EDO DRAM)
Asynchronous dynamic random access memory (ADRAM)
152
Easy to write to and read from. Very volatile; as soon as power is discontinued, the data is gone.
Programmable read-only memory (PROM)
Read-only memory (ROM)
Random access memory (RAM)
Erasable programmable read-only memory (EPROM)
153
evidence is a physical object that someone can touch, hold, or directly observe.
Testimonial
Demonstrative
Documentary
Real
154
Lightweight directory access protocol
445 Active Directory, SMB
389 – LDAP
443 – HTTPS
464 – Kerberos
155
Process acquiring & analyzing info stored on physical storage media, ie computer HDs, smartphones, GPS, removable media
Internet forensics
Disk forensics
Network forensics
Email forensics
156
Sectors are in turn organized by
rails
tracks
tunnels
size
157
USFR702 “A witness who is qualified as an expert by knowledge, skill, experience, training, or education may testify..if
expert has reliably applied principles & methods to facts of the case
the testimony is based on sufficient facts or data
expert’s sci,tech, other speclz'd kwldge help trier of fact undrstd eviden.
the testimony is the product of reliable principles and methods
158
Used for sending email
23 – Telnet
25 – SMTP (Simple Mail Transfer Protocol)
53 – DNS (Domain Name Service)
22 – SSH and secure FTP
159
Evidence that included memory-resident data and computer files.
Demonstrative
Testimonial
Documentary
Real
160
Before you can do any forensic analysis or examination, you have to _ the evidence.
present
collect
analyze
161
Computers store discrete sets of related information in _.
files
books
code
sectors
162
The process of piecing together where and when a user has been on the internet.
Network forensics
Internet forensics
Email forensics
Disk forensics
163
Most likely to find today. commonly found in workstations and many servers. Has no jumpers to set the drive.
Serial Advanced Technology Attachment (SATA)
Solid-state drives
Small Computer System Interface (SCSI)
Parallel Advanced Technology Attachment (PATA)
164
The process of using scientific knowledge for collecting, analyzing, and presenting evidence to the courts
anti-forensics
forensics
forensics expert
computer forensics
165
Why was DNS created?
to remotely log onto a system
to allow internet users to type a name instead of an IP address
to interact directly with live evidence
to retrieve email
166
The first file system created specifically for Linux. There have been many versions of EXT; the current version is 4.
New Technology File System (NTFS)
File Allocation Table (FAT)
ReFS or Resilient File System
Extended file system
167
may be scrambled by encryption, hidden using steganographic software, compressed, or in a proprietary format.
Data transformation
Data destruction
Anti-forensics
Obscured information
168
Computer forensics begins with a thorough understanding of _. Then you need to understand the _ running on that device
computer hardware; firewalls
basic concepts; firewalls
computer hardware; operating system
operating system; networks
169
Only changes to file metadata are stored in the journal.
Remote
Metadata
Physical
Logical
170
Two scenarios in which you will give an expert testimony
pre-investigation
briefing
deposition
trial
171
Inadmissible facts/data..can be shared helping jury evaluate opinion substantially & outweighs their prejudicial effect
expert witness
relevant evidence
ultimate issue
probative value
172
Used in chat rooms
179 – BGP
137, 138, 139 – NetBIOS
220 – IMAP
194 – IRC (Internet Relay Chat)
173
All except for SSDs, refer to how the HD connects to the mtherbrd & transfers data, & don't define how info stord on dsk
True
False
174
Creates a structure of sectors, tracks, and clusters.
Low-level format
Slack space
Software
High-level format
175
If you know the computer hardware and OS, you should also understand the basics of
computer networks
firewalls
AI
operating system
176
The first three bytes of a MAC address identify the
IP address
specific card
vendor
physical port
177
US-CERT, FBI, U.S. Secret Service, & Cornell University Law School are not reputable sources that can support findings
False
True
178
Testimony taken from a witness/party to a case before a trial, is less formal, & typically held in an attorney’s office
briefing
trial
deposition
pre-investigation
179
Suspects often corrupt data structures and files that organize data, such as a Windows NT File System (NTFS) volume.
Data hiding
File system alteration
Data destruction
Data transformation
180
Used to send a test/echo packet to a machine to find out if the machine is reachable & how long the packet transit takes
tracert
ping
ipconfig/all—ifconfig -a
ipconfig—ifconfig
181
Translates URLs into web addresses
25 – SMTP (Simple Mail Transfer Protocol)
22 – SSH and secure FTP
53 – DNS (Domain Name Service)
23 – Telnet
182
Used to retrieve email
109 – POP 2
88 – Kerberos Authentication
80 – HTTP (Hyper Text Transfer Protocol)
110 – POP3 (Post Office Protocol Version 3)
183
The min size a file can use is two clusters. If the file is less than size of a cluster, the remaining space is unused.
True
False

CSCI 6350 - Chapter 1 Flashcards | StudBud