Forensics Lab Practise
95 Questions
0 Views

Choose a study mode

Play Quiz
Study Flashcards
Spaced Repetition
Chat to lesson

Podcast

Play an AI-generated podcast conversation about this lesson

Questions and Answers

What is the maximum number of primary partitions supported by the MBR system?

  • 8
  • 2
  • 4 (correct)
  • 16

    • In the context of secondary storage media, what is the purpose of partitioning a hard drive?

  • Allocating sectors and clusters to files or partitions (correct)
  • Handling hard drive formatting
  • Creating a master boot record
  • Overwriting existing data

    • Which system has a storage limit that can handle disks larger than 2TB?

  • GUID Partition Table (GPT) (correct)
  • Legacy System (MBR)
  • UEFI Specification
  • BIOS-based systems

    • What is the significance of understanding the physical size of storage media in forensic examination?

    <p>To consider potential data recovery</p> Signup and view all the answers

    What property must a hash algorithm have to be considered secure?

    <p>Collision resistance</p> Signup and view all the answers

    What is the main purpose of hashing in data security?

    <p>Ensuring data integrity and security</p> Signup and view all the answers

    What is the role of acquired computer memory in forensic examination?

    <p>Storing detailed information related to the computer's recent activities</p> Signup and view all the answers

    Why is RAM considered a good evidence source in forensic examination?

    <p>It is harder for a suspect to deny responsibility for the information found</p> Signup and view all the answers

    In little-endian order of storage, where is the least significant byte of a word stored?

    <p>At the smallest memory address</p> Signup and view all the answers

    Which operating system architecture typically runs on little-endian systems?

    <p>Windows</p> Signup and view all the answers

    Which CPU architecture is widely used in smartphones, tablets, and personal computers and can operate in both big-endian and little-endian mode?

    <p>ARM</p> Signup and view all the answers

    Which forensic tool can be used to extract and analyze Windows registry hives?

    <p>Exterro/FTK Reg Viewer</p> Signup and view all the answers

    Which part of the Windows registry contains user-specific information such as browser settings and application data?

    <p>NTUSER.dat Hive (HKEY_CURRENT_USER)</p> Signup and view all the answers

    Which cryptographic technique involves the use of same key to transform data into ciphertext and vice-versa?

    <p>Symmetric Encryption</p> Signup and view all the answers

    What does hashing employ one-way functions for?

    <p>To produce hash values from plaintext</p> Signup and view all the answers

    What is important about a hash function's property of being one-way?

    <p>It makes it impossible to derive plain text from ciphertext</p> Signup and view all the answers

    Which HW architecture pairs both use big-endian architecture?

    <p>SPARC, PowerPC</p> Signup and view all the answers

    What kind of network byte order is commonly used in TCP/IP networks?

    <p>Big-endian</p> Signup and view all the answers

    What does the 'trim' technology do, particularly in SSDs?

    <p>It overwrites unallocated clusters,enhancing data deletion and allowing faster direct write operations in the future.</p> Signup and view all the answers

    Where is the Master File Table (MFT) located?

    <p>In the partition boot sector</p> Signup and view all the answers

    What happens when a file is deleted?

    <p>Its MFT record is removed, but the data in the clusters remains until overwritten</p> Signup and view all the answers

    What does big-endian format refer to in terms of data ordering?

    <p>The most significant byte of a word is stored at the smallest memory address</p> Signup and view all the answers

    What defines resident files in NTFS?

    <p>Files contained directly in the Master File Table (MFT)</p> Signup and view all the answers

    What distinguishes non-resident files in NTFS from resident files?

    <p>Non-resident files are stored in allocated clusters and their addresses are mentioned in the MFT</p> Signup and view all the answers

    What is significant about compound files when it comes to forensic examination?

    <p>They cannot be fully examined when they are in their 'packed' state</p> Signup and view all the answers

    What does the hexadecimal representation of data signify?

    <p>Data represented in groups of bits for storage on storage media</p> Signup and view all the answers

    Which is true for the GUID partitioning when it comes to compatibility?

    <p>It works with UEFI-based systems and has limited compatibility with older BIOS systems</p> Signup and view all the answers

    What makes hard drives potentially recoverable even after being reformatted?

    <p>Only the partition table is removed, leaving data recoverable until overwritten</p> Signup and view all the answers

    What type of information does EXIF data NOT provide for forensic examiners?

    <p>File last access and last modification details</p> Signup and view all the answers

    What type of information is included in file system metadata?

    <p>File creation date and last modification details</p> Signup and view all the answers

    What type of event is tracked by Event ID 4624?

    <p>User logons</p> Signup and view all the answers

    Where can log files from applications be found for forensic examination?

    <p>ProgramData folder</p> Signup and view all the answers

    What type of information can log files from applications provide for forensic examination?

    <p>User activities, messages and history</p> Signup and view all the answers

    Which event tracks time changes and describes the name of the user account that changed the time settings?

    <p>Event ID 4116</p> Signup and view all the answers

    Where are the log files located for Event Viewer on a computer used for analysis?

    <p>[SystemRoot]\Windows\System32\winevt\Logs</p> Signup and view all the answers

    Where can USB device connection events be found apart from registry and event logs?

    <p>[SystemRoot]\Windows\INF</p> Signup and view all the answers

    What is the purpose of examining the Windows registry key called 'MountedDevices'?

    <p>To reveal information about any connected USB devices</p> Signup and view all the answers

    Which folder contains the log file setupapi.dev.log?

    <p>[SystemRoot]\Windows\INF</p> Signup and view all the answers

    What type of event does Event ID 4634 track?

    <p>User logoffs</p> Signup and view all the answers

    In which folder can log files from applications (that do not use the Windows event management system) be found?

    <p>[SystemRoot]\users\[user profile name]\AppData</p> Signup and view all the answers

    Where is the prefetch data stored?

    <p>C:/Windows/Prefetch</p> Signup and view all the answers

    Which tool is often used for inspecting Windows shellbags?

    <p>Shellbags explorer by Eric Zimmerman</p> Signup and view all the answers

    What do .lnk files contain details about?

    <p>Location of the target file and time of access</p> Signup and view all the answers

    What can MRU keys provide insights into?

    <p>User activities and events on the computer</p> Signup and view all the answers

    Where are shellbags stored?

    <p>/AppData/Local/Microsoft/Windows</p> Signup and view all the answers

    Which area does prefetching aim to enhance?

    <p>Application performance</p> Signup and view all the answers

    What purpose do Prefetch files serve from a forensics perspective?

    <p>Identifying how many times an executable was run and when it was last run.</p> Signup and view all the answers

    What can shellbags serve as evidence of?

    <p>Deleted folders and network shares information</p> Signup and view all the answers

    Besides criminal forensics, where can shellbags be useful?

    <p>Intrusion detection and revealing user account compromise</p> Signup and view all the answers

    What is the significance of .lnk files in forensic analysis?

    <p>Providing details about the location of the target file and time of access</p> Signup and view all the answers

    What kind of information does the 'Software\Microsoft\Windows\CurrentVersion\Explorer\Map Network Drive MRU' key track?

    <p>Most recent network drives that were mapped</p> Signup and view all the answers

    What does the 'Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSavePidlMRU' key record?

    <p>Recently opened files using file explorer</p> Signup and view all the answers

    What type of data does the 'Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedPidlMRU' key track?

    <p>Recently used applications and folder paths used by these applications to open files</p> Signup and view all the answers

    What type of data does the 'Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU' key track?

    <p>Most recent stuff typed into the 'Run' dialogue</p> Signup and view all the answers

    What is the primary functionality of Thumbcache in Windows folders?

    <p>Stores thumbnails of pictures to enable quicker previewing of images</p> Signup and view all the answers

    What happens to Thumbcache entries when the actual images are deleted from the system?

    <p>They are not deleted</p> Signup and view all the answers

    'MRUList' and 'MRUListEx' in MRU keys describe what aspect of the events?

    <p>The order in which the events first occurred</p> Signup and view all the answers

    How are events recorded in 'MRUListEx' keys different from those in regular 'MRUList' keys?

    <p>They use hexadecimal data format and store numbers in DWORD format</p> Signup and view all the answers

    What is the purpose of hashing in forensic examination?

    <p>To validate data integrity</p> Signup and view all the answers

    What is the main focus of decryption attacks in forensic examination?

    <p>Targeting encryption or hashing algorithms' weaknesses</p> Signup and view all the answers

    What is the purpose of creating a text index in digital forensics?

    <p>To allow for efficient searching using keywords or regular expressions</p> Signup and view all the answers

    What is the primary advantage of live searches in digital forensics?

    <p>They provide flexibility without constraints by a precomputed index</p> Signup and view all the answers

    What is the main challenge associated with index searches in digital forensics?

    <p>It may be challenging to find strings containing signs not considered letters during indexing</p> Signup and view all the answers

    What role does the indexing and searching techniques play in digital forensic investigations?

    <p>They facilitate rapid keyword searches and utility in password cracking</p> Signup and view all the answers

    What is the purpose of IOMMU and VT-d technologies?

    <p>To isolate virtual machines for better security and device control</p> Signup and view all the answers

    How do cold boot attacks differ from other memory collection techniques?

    <p>They offer the potential to obtain the full contents of memory but require restarting the victim computer</p> Signup and view all the answers

    What is the physical property of RAM modules that allows data remanence in cold boot attacks?

    <p>Their ability to retain data even after power is turned off</p> Signup and view all the answers

    What is the function of the Inception FPGA?

    <p>To emulate hardware for DMA attacks</p> Signup and view all the answers

    What are the limitations of most DMA attacks?

    <p>Inability to access modern computers with larger memory capacities</p> Signup and view all the answers

    What does cooling RAM modules achieve in cold boot attacks?

    <p>It slows down the degradation of data held in memory cells</p> Signup and view all the answers

    What is the purpose of GPUs in password cracking?

    <p>To quickly compare a large number of password candidates against a given hash</p> Signup and view all the answers

    What is the purpose of Uncovering Patterns and Behaviors in Password Creation?

    <p>To categorize passwords based on strategies used for their creation, enabling easier guessing</p> Signup and view all the answers

    What is the significance of Collecting Volatile Memory (RAM) Dumps?

    <p>It provides access to encryption keys and decrypted data for forensic analysis</p> Signup and view all the answers

    What is the goal of DMA Attacks?

    <p>To gain Read/Write access to the computer's RAM using interfaces like Firewire and Thunderbolt</p> Signup and view all the answers

    What is file carving in the context of computer forensics?

    <p>The process of extracting data from storage media without relying on the file system used in the creation of the file</p> Signup and view all the answers

    What do JPEG files start with and end with, based on their file type characteristics?

    <p>Start with binary value Oxffd8 and end with binary value Oxffd9</p> Signup and view all the answers

    What are the key components of a JPEG file's structure?

    <p>Sequence of data chunks and marker value in big endian byte format</p> Signup and view all the answers

    What does the term 'JPEG' stand for?

    <p>Joint Photographic Experts Group</p> Signup and view all the answers

    What is the primary purpose of the BMP file format?

    <p>To store images on Windows operating systems</p> Signup and view all the answers

    Which version of the GIF format supports features like background transparency and delay times?

    <p>GIF 89a</p> Signup and view all the answers

    What do PNG files support in terms of color and transparency?

    <p>24-bit true color with transparency in both normal and alpha channels</p> Signup and view all the answers

    What is the main advantage of PDF files in terms of device independence?

    <p>They enable users to view, save, and print documents across different platforms and operating systems</p> Signup and view all the answers

    Where does the hex value of a GIF image file start?

    <p>'47 49 46'</p> Signup and view all the answers

    What type of compression does JPEG use?

    <p>Lossy compression for digital images</p> Signup and view all the answers

    What is the purpose of the RGBQUAD array in BMP files?

    <p>To support bitmaps with 24 color bits</p> Signup and view all the answers

    What do GIF files contain?

    <p>'Header', 'image data', 'optional metadata', and 'footer'</p> Signup and view all the answers

    What does PNG stand for?

    <p>Portable Network Graphics</p> Signup and view all the answers

    Which organization created the JPEG standard?

    <p>Joint Photographic Experts Group</p> Signup and view all the answers

    What do BMP files always have as the first characters in a hexadecimal representation?

    <p>'42 4d'</p> Signup and view all the answers

    What hexadecimal values represent the signature for a PDF file?

    <p>25 50 44 46</p> Signup and view all the answers

    What does the xref table in a PDF file allow?

    <p>Random access to objects</p> Signup and view all the answers

    What is the signature format for old MS Office document formats (1997-2003)?

    <p>D0 CF 11 E0 A1 B1 1A E1</p> Signup and view all the answers

    What is the structure of the new MS Office document formats (2007-present)?

    <p>ZIP-compressed XML files</p> Signup and view all the answers

    What does the hex signature starting with 50 4B 03 04 indicate in MS Office document formats?

    <p>ZIP file format</p> Signup and view all the answers

    What does the old MS Office Excel Spreadsheet format (.xls) have in common with Word Document (.doc) and PowerPoint Presentation (.ppt) formats?

    <p>Similar hex signature D0 CF 11 E0 A1 B1 1A E1</p> Signup and view all the answers

    Study Notes

    Partitioning and Storage Systems

    • MBR system supports a maximum of four primary partitions.
    • Partitioning a hard drive enables better organization, data management, and partition separation for different operating systems or data types.
    • GPT system can handle disks larger than 2TB.
    • Understanding the physical size of storage media is vital for forensic examination as it influences data integrity, retrieval, and potential evidence.

    Cryptography and Hashing

    • A secure hash algorithm must exhibit pre-image resistance, meaning it's infeasible to reverse the hash to find the original input.
    • Hashing serves to ensure data integrity and create fixed-size representation of variable-length input.
    • In forensic examination, acquired computer memory provides critical evidence, including data that has not yet been written to disk.

    RAM and Evidence

    • RAM is a reliable evidence source as it can contain user activities, transient data, and information not saved on disk.
    • In little-endian order, the least significant byte of a word is stored at the lowest memory address.

    System Architecture

    • x86 architecture typically runs on little-endian systems.
    • ARM architecture operates in both big-endian and little-endian modes, widely used across smartphones, tablets, and personal computers.

    Forensic Tools and Windows Registry

    • Registry analysis tools are utilized to extract and inspect Windows registry hives.
    • The 'Software' hive contains user-specific information such as browser settings and application data.
    • Symmetric cryptography uses the same key for encryption and decryption of data.
    • Hashing functions employ one-way algorithms, ensuring data cannot be reverted.

    File Systems and Storage Techniques

    • Resident files in NTFS are stored within the Master File Table (MFT), while non-resident files point to disk blocks for storage.
    • Compound files can be significant in forensic examination as they encapsulate multiple data types in a single file.
    • Hexadecimal representation of data is crucial in digital forensics for interpreting binary information.

    File Recovery and Evidence

    • GUID partitioning supports compatibility across various operating systems.
    • Hard drives may be recoverable even after reformatting due to residual data left on the disk.
    • EXIF data does not include information on the actual content of files, focusing instead on metadata relating to image files.

    Log Files and Events

    • Event ID 4624 tracks successful user logins.
    • Application log files store information valuable for forensic analysis and can be found within the Event Viewer.
    • Event ID 4634 monitors user logoff activities.
    • The 'MountedDevices' registry key helps examine USB device connectivity.

    Prefetching and Shellbags

    • Prefetch technology in Windows enhances system performance by storing data for quick access.
    • Shellbags serve as evidence by tracking folder access and modifications in user navigation.
    • .lnk files detail shortcuts to files and programs, aiding in understanding user interaction with the system.

    MRU Lists and Key Tracking

    • MRUList and MRUListEx in MRU keys catalog the most recently used items, assisting in user behavior analysis.
    • Hashing plays a role in forensic examination by confirming data integrity and detecting unauthorized changes.

    Digital Forensics Techniques

    • IOMMU and VT-d technologies ensure effective memory management and security in virtualized environments.
    • Cold boot attacks exploit data remanence in frozen RAM to recover sensitive information.
    • File carving retrieves files based on their structure without relying on file system metadata.

    Graphical File Formats and Signatures

    • JPEG files begin with hex values 0xFF D8 and end with 0xFF D9, compressed using lossy techniques.
    • PNG format supports transparency and is designed for high-quality images and graphics.
    • PDF offers device-independent file presentation, enhancing cross-platform usability.
    • Old MS Office document formats share similar hex signatures with Excel, Word, and PowerPoint, indicating competitive compatibility.

    Conclusion

    • Understanding various storage techniques, file properties, and forensic methodologies is essential for effective data recovery and legal evidence gathering.
    • Knowledge of data structures and signatures assists forensic analysts in identifying and interpreting file types and their origins.

    Studying That Suits You

    Use AI to generate personalized quizzes and flashcards to suit your learning preferences.

    Quiz Team

    More Like This

    Use Quizgecko on...
    Browser
    Open
    Browser
    Browser