Digital Forensics Quiz

Digital Forensics

• Volatile data refers to information that is lost when the system is powered down, such as the state of network connections and swap files.

Digital Evidence

• Digital evidence is information that has been processed and assembled to support a specific finding or determination in an investigation.

Swap Files

• Windows uses a swap file, also known as a pagefile, as a "scratch pad" to write data when additional RAM is needed.

Phishing

• Phishing is a type of attack where an attacker sends a fake email or message to trick the victim into revealing sensitive information.
• Phishing attacks are often motivated by financial gain.

Cyberterrorism

• Cyberterrorism is a type of cybercrime that is investigated by federal law enforcement agencies.
• Cyberterrorism attacks are motivated by ideological or political goals, rather than financial gain.

Live System Forensics

• Live system forensics is the process of searching memory in real-time, typically to identify system abuse or to work with compromised hosts.

Information Lifespan

• The lifespan of information refers to how long it remains valid and can be used as evidence.

Volatile Data

• Volatile data changes rapidly and may be lost when the machine that holds it is powered down.
• Examples of volatile data include the state of network connections, swap files, and running processes.

Digital Forensic Investigation

• The order of volatility in digital forensic investigations is:
  1. Volatile data
  2. File system data
  3. System state backup
  4. The registry
  5. Internet traces
• Forensic investigators should collect evidence in the order of volatility to preserve the most fragile data first.

Expert Witness

• An expert witness is a specialist who provides testimony in court to explain technical concepts.
• Expert witnesses may use high-tech computer animations to explain complex technical concepts.

Evidence Handling

• Forensic investigators have three basic tasks related to handling evidence:
  1. Find evidence
  2. Preserve evidence
  3. Analyze evidence
• The chain of custody is a record of the handling and storage of evidence, including who had access to it and when.

Network Forensics

• Network forensics is the process of examining data traffic, including transaction logs and real-time monitoring using sniffers and tracing.

Rules of Evidence

• The rules of evidence govern whether, when, how, and why proof of a legal case can be presented in court.

Forensic Research

• The Digital Forensic Research Workshop (DFRWS) is a nonprofit organization that aims to enhance the sharing of knowledge and ideas about digital forensics research.

Identity Theft

• Identity theft is a type of fraud where criminals steal personal data to impersonate victims.

Computer Forensics

• Computer forensics is the process of examining digital data to gather evidence and support investigations.

Digital Forensic Analysis

• Digital forensic analysis involves the examination of digital data to identify evidence, reconstruct events, and support investigations.
• Digital forensic analysts should develop a plan of action that covers how to gather evidence and which tools are most appropriate for a specific investigation.

Locard's Principle

• Locard's Principle holds that you cannot interact in an environment without altering it in some way, without leaving some trace.

Chain of Custody

• The chain of custody is a record of the handling and storage of evidence, including who had access to it and when.
• The chain of custody is used to establish the authenticity and integrity of evidence.