What is a Cyber Attack or Incident?

Play an AI-generated podcast conversation about this lesson

What is the primary intention of a cyber-attack?

To improve computer system security

To facilitate data sharing

To gain unauthorized access to a computer system (correct)

To enhance user experience

What is the term used to describe the core principles of information security?

Data Security Triangle

Security Breach Protocol

CIA Triad (correct)

Information Protection Framework

Which type of cybercrime targets individuals?

Individual Cybercrimes (correct)

Cyber warfare

Property Cybercrimes

Organization Cybercrimes

What is an example of a computer security incident?

Theft of personal information Signup and view all the answers

What should be done with suspicious events?

View them as potential incidents until proven otherwise Signup and view all the answers

What is the main target of Organization Cybercrimes?

Organizations Signup and view all the answers

What is the most common type of cybercrime attack?

Ransomware Attack Signup and view all the answers

What is the term for unauthorized access to private computers or networks?

Hacking Signup and view all the answers

What is the goal of cyberstalking?

To control and intimidate Signup and view all the answers

What is software piracy an example of?

Illegal use or copy of paid software Signup and view all the answers

What is the primary use of the 'Dark Web'?

To buy and sell illegal goods Signup and view all the answers

What is the purpose of digital forensics?

To identify and analyze cybercrime attacks Signup and view all the answers

What is cyber extortion?

Demand for money by cybercriminals Signup and view all the answers

What is the term for the violation of intellectual-property rights?

Intellectual-property Infringements Signup and view all the answers

What is the purpose of online recruitment fraud?

To obtain financial benefits from applicants Signup and view all the answers

What is the main aspect of digital evidence in digital forensics?

It's a component of criminal activities Signup and view all the answers

What is the main goal of incident response?

To minimize the effects of an attack and contain damage Signup and view all the answers

What is DFIR in the context of cybersecurity?

The process of collecting and analyzing electronic evidence Signup and view all the answers

What type of data do analysts typically collect during an investigation?

Disk images, memory images, and application data Signup and view all the answers

Why is it important to encrypt incident response data?

To keep it safe and protected Signup and view all the answers

What is the purpose of a write blocker in incident response?

To enable data to be acquired from a hard disk without modifying the disk’s data Signup and view all the answers

What is disk imaging in the context of incident response?

The imaging of a storage medium using forensic software or hardware Signup and view all the answers

What is the purpose of a forensic examination suite in incident response?

To perform a detailed analysis of disk images and memory images Signup and view all the answers

What is the main benefit of using virtual environments in incident response?

To keep the original data safe Signup and view all the answers

What is the purpose of a boot disk in incident response?

To create a bootable environment for forensic analysis Signup and view all the answers

What is the goal of log analysis in incident response?

To identify and analyze logs from various systems and applications Signup and view all the answers

What type of data is stored in a raw image file format?

All data from the original medium Signup and view all the answers

What is the purpose of AccessData FTK Imager?

To create accurate copies of the original evidence Signup and view all the answers

What are the two leading hash functions used by FTK Imager?

MD5 and SHA-1 Signup and view all the answers

What is the importance of RAM dump in digital forensics investigation?

To preserve volatile data Signup and view all the answers

What is the characteristic of RAM in digital forensics?

Volatile Signup and view all the answers

What is the purpose of a Digital Forensics Lab (DFL)?

To examine computer systems Signup and view all the answers

What are the two domains of computer forensics labs?

Active-system analysis and static media examination Signup and view all the answers

What is the benefit of analyzing RAM dumps in digital forensics?

To access dynamic and live information Signup and view all the answers

What is the significance of RAM in uncovering hidden or encrypted data?

It can reveal information about active malware Signup and view all the answers

What is the difference between active-system analysis and static media examination?

Active-system analysis deals with forensic information and static media examination focuses on removable storage media Signup and view all the answers

What is the primary purpose of gathering facts and additional information about an incident?

To establish a context for the incident Signup and view all the answers

Why is it important to know the time zone of an incident?

To ensure accurate analysis of incident data Signup and view all the answers

What is the purpose of an Incident Summary Checklist?

To provide a brief overview of the incident Signup and view all the answers

What is included in the Incident Detection Checklist?

Individual system details and primary function Signup and view all the answers

What is the purpose of preserving a copy of the malware?

To analyze its network and host indicators Signup and view all the answers

What are the criteria for digital evidence to be classified as genuine and trustworthy?

Admissible, Authentic, Complete, Reliable, and Believable Signup and view all the answers

What is the first step of analyzing digital evidence?

Determining what data needs to be analyzed Signup and view all the answers

What is the purpose of examining the condition of the computer when it was seized?

To gather evidence for the investigation Signup and view all the answers

What is included in the Network Details Checklist?

List of external malicious IP addresses and domain names Signup and view all the answers

What is the purpose of inventorying the hardware on the suspect's computer?

To identify potential sources of digital evidence Signup and view all the answers

What is the first step in handling digital evidence?

Examine the data from the root directory Signup and view all the answers

What is the purpose of anti-static shielding bags in digital forensics?

To protect electronic items from damage due to electrostatic discharge Signup and view all the answers

What is the term used to describe hiding sensitive information within an ordinary file or message?

Steganography Signup and view all the answers

What is one of the methods used to detect steganography?

Stegdetect Signup and view all the answers

What type of data do DF examiners need to extract from a computer?

A variety of data, including emails, office documents, pictures, and more Signup and view all the answers

What is the purpose of Windows Event Logs in forensic analysis?

To provide information to administrators and users Signup and view all the answers

What is one of the channels in Windows Event Logs?

Application Signup and view all the answers

Why do investigators create a digital 'image' of the victim's hard drive?

To explore and test hypotheses without worrying about changing evidence Signup and view all the answers

What type of events are captured in the Security log?

Login attempts, elevated privileges, and more Signup and view all the answers

What is one of the methods hackers use to conceal their activities?

Steganography Signup and view all the answers

What is the purpose of configuring adequate logging on Windows systems?

To support effective incident response using Incident Response tools Signup and view all the answers

What is the format in which event logs are stored?

XML Signup and view all the answers

What is the purpose of cryptographic hash values in digital forensics?

To verify the drive's authenticity Signup and view all the answers

What is the name of the forensic tool that helps investigators quickly search, identify, and prioritize potential evidence?

EnCase Signup and view all the answers

What is the main feature of EnCase that allows for customizable report templates?

Reporting Signup and view all the answers

What type of data can be extracted from mobile devices using mobile digital forensics software?

Call logs, photos, messages, browsers history, geolocation data, and more Signup and view all the answers

What is the primary goal of DF examiners when conducting mobile forensics?

To gather all passcodes, passwords, or patterns of the exhibit Signup and view all the answers

What is the purpose of the Setup log?

To capture incidents of installation or upgrading of the Windows operating system Signup and view all the answers

What is the most common method of data extraction that allows access to live and deleted data, operating system files, and areas of the device that are not normally accessible to the user?

Physical Extraction Signup and view all the answers

What is the name of the folder where event logs are stored?

System32/winevt/Logs Signup and view all the answers

What is the main benefit of using a SIEM or log aggregator?

To support effective incident response Signup and view all the answers

What type of extraction retrieves the device's file system and interprets the data during the processing stage?

File System Dump (FSD) Signup and view all the answers

What is the limitation of logical extraction?

It cannot be performed on locked or password-protected devices Signup and view all the answers

What is the method of data extraction that involves accessing the device and recording data displayed on the screen with photographs or video, or by transcribing its data?

Manual Extraction Signup and view all the answers

What is the method of data extraction that requires the stripping down of the device to its logical board and soldering a certain cable to a certain connection on the board?

JTAG Extraction Signup and view all the answers

What is the limitation of chip-off method?

It damages the device and it cannot be used anymore Signup and view all the answers

What type of data can be acquired through logical extraction?

Call and text logs, contact lists, and passwords Signup and view all the answers

What is the purpose of bootloaders in mobile devices?

To allow the insertion of a small piece of code into the RAM during start-up Signup and view all the answers

What is the advantage of physical extraction over logical extraction?

It can be performed on locked or password-protected devices Signup and view all the answers

What is the limitation of forensic software?

It does not support certain models of mobile devices Signup and view all the answers

A cyber-attack is defined as any attempt to gain unauthorized access to a computer system with the intent to cause damage.

True Signup and view all the answers

Cyber-attacks aim to only disrupt or destroy computer systems.

False Signup and view all the answers

A cyber incident refers to any event that compromises the confidentiality, integrity, or availability of data or information.

True Signup and view all the answers

Individual Cybercrimes target organizations.

False Signup and view all the answers

Property Cybercrimes target individuals' personal information.

False Signup and view all the answers

Suspicious events should be ignored until proven otherwise.

False Signup and view all the answers

FTK Imager is a closed-source software used for creating accurate copies of the original evidence.

False Signup and view all the answers

Raw image file formats store only a part of the data from the original medium.

False Signup and view all the answers

FTK Imager can create forensic images of only local hard drives and floppy disks.

False Signup and view all the answers

Incident response is a disorganized approach to identify an attack, minimize its effects, and remediate the cause.

False Signup and view all the answers

RAM dump is a process of capturing the contents of a computer's storage device.

False Signup and view all the answers

DFIR specialists gather and inspect information to determine who attacked them, how they got in, and what tools were used to compromise their systems.

True Signup and view all the answers

RAM is a non-volatile form of memory that holds data permanently.

False Signup and view all the answers

Organizations do not need to provide proper training and create documentation for their IR process.

False Signup and view all the answers

Hash reports are used to compare the integrity of the original evidence with the copied evidence.

True Signup and view all the answers

Disk images are a bit-for-bit copy of a digital storage device, usually of a hard drive or hard disk.

True Signup and view all the answers

Digital Forensics Lab (DFL) is used for storing digital evidence.

False Signup and view all the answers

Memory images contain a wealth of information often available on the hard drive.

False Signup and view all the answers

Active-system analysis deals with forensic information stored in non-volatile memory.

False Signup and view all the answers

The most effective way to protect IR data is to encrypt it.

True Signup and view all the answers

FTK Imager can create forensic images in only one format.

False Signup and view all the answers

Write blockers allow write commands to be executed on the hard disk during the imaging process.

False Signup and view all the answers

RAM dump is not essential for digital forensics investigation because it does not hold any valuable information.

False Signup and view all the answers

IR teams use commercial software only for their investigation.

False Signup and view all the answers

Disk imaging can be performed using hardware only.

False Signup and view all the answers

Hash verification is not an important feature of imaging software.

False Signup and view all the answers

Phishing is a type of cybercrime that targets users and trick them by sending fake messages and emails to get sensitive information.

True Signup and view all the answers

Ransomware Attack is a type of cybercrime that prevents users from accessing their personal data on the system by decrypting them.

False Signup and view all the answers

Identity Theft is a type of cybercrime that occurs when a cybercriminal uses their own personal data to commit a fraud or a crime.

False Signup and view all the answers

Cyber Bullying is also known as offline or internet bullying.

False Signup and view all the answers

Software Piracy is the legal use or copy of paid software with violation of copyrights or license restrictions.

False Signup and view all the answers

Digital forensic is a branch of science that focuses on identifying, acquiring, processing, analyzing, and reporting on data stored electronically.

True Signup and view all the answers

Cyber Extortion is the demand for money by cybercriminals to give back some unimportant data they've stolen.

False Signup and view all the answers

Online Recruitment Fraud is a type of cybercrime that releases fake job opportunities for the purpose of obtaining a financial benefit from applicants or even making use of their personal data.

True Signup and view all the answers

Internet Fraud is a type of cybercrime that makes use of the telephone, and it can be considered a general term that groups all the crimes that happen over the telephone.

False Signup and view all the answers

Digital evidence is a component of criminal activities and digital forensics that is not crucial for law enforcement investigations.

False Signup and view all the answers

An IP address is more helpful if you know the time zone it belongs to.

False Signup and view all the answers

It is not necessary to gather facts and additional information about the incident.

False Signup and view all the answers

The Incident Detection Checklist includes individual system details.

True Signup and view all the answers

A copy of the malware should not be preserved during the investigation.

False Signup and view all the answers

The Incident Summary Checklist includes the type of affected resources.

True Signup and view all the answers

Network monitoring is not necessary during the investigation.

False Signup and view all the answers

The primary function of the system is not important during the investigation.

False Signup and view all the answers

The time zone of the incident is not important during the investigation.

False Signup and view all the answers

The Malware Details Checklist includes the list of systems where the malware was found.

True Signup and view all the answers

The Incident Summary Checklist includes the contact information of the person who detected the incident.

True Signup and view all the answers

Digital evidence should be stored in an unsecured location to allow for easy access.

False Signup and view all the answers

Steganography is a technique used to detect hidden information in files.

False Signup and view all the answers

Windows Event Logs are structured in three channels.

False Signup and view all the answers

DF examiners need to extract only emails and office documents from a computer.

False Signup and view all the answers

Anti-static shielding bags are used to destroy electronic evidence.

False Signup and view all the answers

Investigators should leave digital evidence unattended during an investigation.

False Signup and view all the answers

The primary purpose of digital forensics is to delete data from a computer.

False Signup and view all the answers

Cryptographic hash values are used to tamper with digital evidence.

False Signup and view all the answers

Stegdetect is a tool used to create steganography.

False Signup and view all the answers

Digital evidence should be labeled and sealed with a generic container.

False Signup and view all the answers

Windows Security Event logs contain information about login attempts, elevated privileges, and more.

True Signup and view all the answers

Error, audit success and failure logs are not important in terms of forensic investigations.

False Signup and view all the answers

Logical extraction involves retrieving raw binary data from the media storage of the device.

False Signup and view all the answers

SIEM or log aggregator is not necessary for effective incident response.

False Signup and view all the answers

A physical extraction can retrieve deleted data, operating system files, and areas of the device that are not normally accessible to the user.

True Signup and view all the answers

Event logs are stored in TXT format at System32/winevt/Logs folder.

False Signup and view all the answers

Deleted files can be recovered through logical extraction.

False Signup and view all the answers

JTAG and Chip-Off methods can be used to extract data from damaged or locked mobile devices.

True Signup and view all the answers

EnCase Forensic helps investigators quickly search, identify, and prioritize potential evidence across computers, laptops, and mobile devices.

True Signup and view all the answers

Manual extraction involves accessing the device and recording data displayed on the screen with photographs or video.

True Signup and view all the answers

DF examiners do not need to extract all passcodes, passwords, or patterns of the exhibit before conducting the work.

False Signup and view all the answers

Mobile digital forensics software can extract data from call logs, photos, and browsers history.

True Signup and view all the answers

File System Dump (FSD) retrieves raw binary data from the media storage of the device.

False Signup and view all the answers

Almost all extraction methods do not require phones to be unlocked.

False Signup and view all the answers

Bootloaders are used to bypass system locks and passcodes for many devices.

True Signup and view all the answers

Windows Event Forwarding is enabled by default on all Windows systems.

False Signup and view all the answers

Chip-Off method does not damage the device.

False Signup and view all the answers

Windows Event logs are categorized into four levels: information, warning, error, and critical.

False Signup and view all the answers

Devices operating on Android version 7.0 onwards are encrypted by default.

True Signup and view all the answers

Physical extraction can be performed on locked or password-protected devices.

True Signup and view all the answers

A cyber-attack aims to only disable or disrupt computer systems.

False Signup and view all the answers

Suspicious events should be viewed as potential incidents until proven otherwise.

True Signup and view all the answers

Property Cybercrimes target individuals.

False Signup and view all the answers

Cyber-attacks aim to alter, block, delete, manipulate, or steal the data held within computer systems.

True Signup and view all the answers

Individual Cybercrimes target only organizations.

False Signup and view all the answers

A cyber incident refers to any event that compromises the confidentiality, integrity, or availability of data or information.

True Signup and view all the answers

Phishing is a type of social engineering attack that targets systems and trick them by sending fake messages and emails to get sensitive information.

False Signup and view all the answers

Identity theft occurs when a cybercriminal uses another person's personal data with their permission to commit a fraud or a crime.

False Signup and view all the answers

Ransomware Attack is a type of cybercrime that makes use of the internet.

False Signup and view all the answers

Cyber bullying is a type of cybercrime that targets systems.

False Signup and view all the answers

Software piracy is the legal use or copy of paid software with violation of copyrights or license restrictions.

False Signup and view all the answers

Digital forensics is a branch of science that focuses on identifying, acquiring, processing, analyzing, and reporting on data stored electronically.

True Signup and view all the answers

Cyber extortion is the demand for money by cybercriminals to give back some important data they've stolen or stop doing malicious activities.

True Signup and view all the answers

Online drug trafficking is a type of cybercrime that is not commonly sold and traded online.

False Signup and view all the answers

Intellectual-property Infringements is the violation or breach of any protected intellectual-property rights such as copyrights and industrial design.

True Signup and view all the answers

Cybercrime includes cyber-terrorism.

True Signup and view all the answers

Incident response is a coordinated and structured approach to respond to incidents.

True Signup and view all the answers

DFIR specialists do not gather and inspect information to determine how to close security gaps.

False Signup and view all the answers

Memory images contain a wealth of information often available on the hard drive.

False Signup and view all the answers

Write blockers are devices that allow both read and write commands to be executed on the hard disk.

False Signup and view all the answers

IR teams use only commercial software for their investigation.

False Signup and view all the answers

Disk imaging can be performed using only hardware solutions.

False Signup and view all the answers

The primary goal of incident response is to identify an attack and ignore its effects.

False Signup and view all the answers

Organizations are not required to provide proper training and create documentation for their IR process.

False Signup and view all the answers

Encrypting incident response data is not necessary.

False Signup and view all the answers

IR teams can interface properly with specialized forensics tools using any type of laptop.

False Signup and view all the answers

Gathering facts and additional information about the incident is not necessary to establish a context.

False Signup and view all the answers

The IP address of the system is not important during the investigation.

False Signup and view all the answers

The incident summary checklist includes the date and time the incident was reported and the nature of the incident.

True Signup and view all the answers

The system's make and model is not important during the investigation.

False Signup and view all the answers

Network monitoring is not necessary during the investigation.

False Signup and view all the answers

The primary function of the system is important during the investigation.

True Signup and view all the answers

The malware details checklist includes the date and time of the detection and the name of the malicious file.

True Signup and view all the answers

The incident detection checklist includes individual system details and network details.

True Signup and view all the answers

Digital evidence is not classified as genuine and trustworthy if it meets certain criteria.

False Signup and view all the answers

The basic steps for computer forensics include inspecting the computer viruses and inventorying the hardware on the suspect's computer.

True Signup and view all the answers

FTK Imager is an open-source software used for creating disk images.

True Signup and view all the answers

RAW is not a format used for storing data in a raw file.

False Signup and view all the answers

RAM dump is not a vital step in preserving volatile data for forensic examination.

False Signup and view all the answers

FTK Imager cannot create forensic images in E01 format.

False Signup and view all the answers

Digital Forensics Lab (DFL) is not a tightly controlled area for various levels of computer examination.

False Signup and view all the answers

Active-system analysis deals with static media examination.

False Signup and view all the answers

Error-Checks is not a feature found in Expert Witness Format (EWF).

False Signup and view all the answers

FTK Imager uses only Secure Hash Algorithm (SHA-1) for generating hash reports.

False Signup and view all the answers

FTK Imager can only create forensic images of local hard drives.

False Signup and view all the answers

RAM is a non-volatile form of memory that holds data permanently.

False Signup and view all the answers

Steganography involves encrypting sensitive information within an ordinary file or message.

False Signup and view all the answers

Investigators should ensure physical security of the digital evidence to prevent it from being lost or compromised.

True Signup and view all the answers

Digital evidence can be stored in a secure location and accessed later.

True Signup and view all the answers

Anti-static shielding bags are used to destroy electronic evidence.

False Signup and view all the answers

The imaging process generates cryptographic hash values to verify the drive's authenticity.

True Signup and view all the answers

Emails are not typically extracted during digital forensic analysis.

False Signup and view all the answers

Windows Event Logs are structured in four channels: Application, System, Security, and Setup.

False Signup and view all the answers

Steganography can be used to hide text, video, images, or audio data.

True Signup and view all the answers

The primary purpose of the Windows Event Logs is to provide information to administrators and users.

True Signup and view all the answers

Digital forensic examiners typically begin by creating a physical copy of the victim's hard drive.

False Signup and view all the answers

Windows Event Logs are structured in five categories/levels.

True Signup and view all the answers

EnCase Forensic is a tool used to analyze evidence from computers and mobile devices.

True Signup and view all the answers

Security logs contain login attempts, elevated privileges, and more.

True Signup and view all the answers

Event logs are stored in CSV format at System32/winevt/Logs folder.

False Signup and view all the answers

Configuring adequate logging on Windows systems is a critical step towards effective incident response.

True Signup and view all the answers

Mobile digital forensics software can only extract data from call logs and photos.

False Signup and view all the answers

DF examiners do not need to extract all passcodes, passwords, or patterns of the exhibit prior to conducting the work.

False Signup and view all the answers

The primary goal of DF examiners is to delete data from a computer.

False Signup and view all the answers

Incident response is a disorganized approach to identify an attack, minimize its effects, and remediate the cause.

False Signup and view all the answers

Windows Event Forwarding is enabled by default on all Windows systems.

False Signup and view all the answers

Logical extraction can recover deleted files.

False Signup and view all the answers

Physical extraction retrieves the device's file system and interprets the data during the processing stage.

False Signup and view all the answers

JTAG extraction is used to extract data from damaged or locked mobile devices.

True Signup and view all the answers

Manual extraction involves accessing the device and recording data displayed on the screen with photographs or video.

True Signup and view all the answers

Chip-Off extraction does not damage the device.

False Signup and view all the answers

File System Dump (FSD) is a type of physical extraction.

False Signup and view all the answers

Bootloaders are used to bypass system locks and passcodes for many devices.

True Signup and view all the answers

_logical extraction can be performed on locked or password-protected devices.

False Signup and view all the answers

A physical extraction can retrieve only live data.

False Signup and view all the answers

Manual extraction is used when forensic software does not support the model of certain unique mobile devices.

True Signup and view all the answers

A cyber-attack is defined as any attempt to gain unauthorized access to a computer, computing system or computer ______ with the intent to cause damage.

network Signup and view all the answers

Cyber-attacks aim to disable, disrupt, destroy, or control computer systems or “device”, or to alter, block, delete, manipulate, or steal the data held within these ______.

systems Signup and view all the answers

A cyber incident refers to any event that compromises the confidentiality, integrity, or availability of data or ______ – core principles of information security.

information Signup and view all the answers

Common examples of computer security incidents are: - Data theft such as personal ______, email, and documents.

information Signup and view all the answers

Cyber-attacks aim to disable, disrupt, destroy, or control computer systems or “device”, or to alter, block, delete, manipulate, or steal the data held within these systems, in another word, a cyber incident refers to any event that compromises the ______, integrity, or availability of data or information – core principles of information security.

confidentiality Signup and view all the answers

The main categories of cybercrimes are: 1.Individual Cybercrimes, 2.Organization Cybercrimes, 3.______ Cybercrimes, and 4.

Property Signup and view all the answers

Incident response (IR) is a _____________ approach to go from incident detection to resolution.

coordinated and structured Signup and view all the answers

DFIR is a term used to refer to the process of collecting, preserving, and analyzing _____________ evidence in cyber security incidents.

electronic Signup and view all the answers

Disk images may also be taken from other storage mediums, such as _____________ drives.

USB Signup and view all the answers

The most effective way to keep information about the case safe and protected is to _____________ the data.

encrypt Signup and view all the answers

A write blocker is a device that enables data to be acquired from a hard disk without modifying the disk's _____________.

data Signup and view all the answers

The imaging software can include features such as recognition of hidden _____________.

areas Signup and view all the answers

IR teams use virtual environments to make the analysis on the working _____________.

copies Signup and view all the answers

Boot Disks Operating Systems (OS) are used as _____________ tools in IR investigation.

software Signup and view all the answers

The imaging of a storage medium can be performed using forensic _____________ or hardware.

software Signup and view all the answers

Incident response is the effort to quickly identify an attack, minimize its effects, contain _____________, and remediate the cause.

damage Signup and view all the answers

Phishing is a type of ______ engineering attack that targets users and trick them by sending fake messages and emails to get sensitive information.

social Signup and view all the answers

Identity theft occurs when a cybercriminal uses another person's ______ data like credit card numbers or personal pictures without their permission to commit a fraud or a crime.

personal Signup and view all the answers

Ransomware attack is a type of cybercrime that targets users and trick them by sending fake messages and emails to get ______ information.

sensitive Signup and view all the answers

Cyber bullying is a type of cybercrime that makes use of the internet, and it can be considered a general term that groups all the ______ that happen over the internet.

crimes Signup and view all the answers

Cyberstalking can be defined as unwanted ______ content from someone targeting other individuals online with the aim of controlling and intimidating.

persistent Signup and view all the answers

Software piracy is the illegal use or copy of ______ software with violation of copyrights or license restrictions.

paid Signup and view all the answers

Social media frauds are the use of social media ______ accounts to perform any kind of harmful activities.

fake Signup and view all the answers

Online drug trafficking is the illegal sale and trade of ______ drugs over the internet.

illegal Signup and view all the answers

Electronic money laundering is based on unknown companies or online business that makes ______ payment methods and credit card transactions.

approvable Signup and view all the answers

Cyber extremism is the demand for money by cybercriminals to give back some important data they've stolen or stop doing ______ activities.

malicious Signup and view all the answers

Image file formats include raw or ______.

dd Signup and view all the answers

Expert Witness Format (EWF) and Advanced Forensic Format (AFF) are ______ formats.

image Signup and view all the answers

FTK Imager is a ______ software that is used for creating accurate copies of the original evidence.

open-source Signup and view all the answers

FTK Imager can create forensic images of local hard drives, floppy disks, Zip disks, CDs, and ______.

DVDs Signup and view all the answers

HASH REPORTS in FTK Imager generate hash reports for regular files and disk images using ______ hash functions.

two leading Signup and view all the answers

RAM dump is the process of capturing the contents of a computer's ______.

memory Signup and view all the answers

RAM is a ______ form of memory that holds data temporarily while a computer is powered on.

volatile Signup and view all the answers

Digital Forensics Lab (DFL) is divided into two domains: active-system analysis and ______ media examination.

static Signup and view all the answers

Static media examinations focus on removable flash drives, external and internal hard disks, and other types of ______ media.

storage Signup and view all the answers

DF examiners usually divide computer forensics labs into two domains: active-system analysis and ______ media examination.

static Signup and view all the answers

Without ______ it is easy to jump to wrong conclusions.

context Signup and view all the answers

The date and the time the incident was ______ is important information.

reported Signup and view all the answers

Investigators should ensure the physical security of the digital evidence so it doesn't get ____________ or compromised.

lost Signup and view all the answers

To handle digital evidence, it must be uniquely ____________ and sealed with a proper container.

labeled Signup and view all the answers

Security logs contain incidents related to ______ events according to the auditing policy of the Windows operating system.

security Signup and view all the answers

A list of malwares detected, from the time of your investigation back to the ______.

beginning Signup and view all the answers

Anti-static shielding bags are used to store, transport, and protect evidence from ____________ damage.

electrostatic Signup and view all the answers

The critical information stored on the ______ is important to know.

system Signup and view all the answers

Setup log captures incidents of ______ or upgrading of the Windows operating system.

installation Signup and view all the answers

System log contains ______ generated by the Windows operating system.

messages Signup and view all the answers

Whether the incident is currently ______ is important to know.

ongoing Signup and view all the answers

The imaging process generates ____________ hash values to verify the drive's authenticity.

cryptographic Signup and view all the answers

Steganography involves hiding sensitive information within an ordinary, non-secret file or ____________.

message Signup and view all the answers

The primary function of the ______ is important to know.

system Signup and view all the answers

Event logs are stored in ______ format at System32/winevt/Logs folder.

XML Signup and view all the answers

Hackers can use steganography to hide data files or malware in otherwise ____________ documents.

innocent Signup and view all the answers

EnCase Forensic helps investigators quickly search, identify, and prioritize potential ______ across computers, laptops, and mobile devices.

evidence Signup and view all the answers

The type of affected ______ is important to know.

resources Signup and view all the answers

New Supported Files in EnCase Forensic include.EXT4, HSFX, Microsoft Office ______ and iOS Physical Images.

2010 Signup and view all the answers

Digital Forensic examiners need to extract ____________ from a computer, including emails and office documents.

data Signup and view all the answers

The incident detection checklist includes individual ______ details.

system Signup and view all the answers

Windows Event Logs are structured in five ____________ (information, warning, error, critical, and success/failure audit).

levels Signup and view all the answers

The primary function of the ______ log is to capture incidents of installation or upgrading of the Windows operating system.

Setup Signup and view all the answers

The first step of analyzing the evidence is to determine what ______ needs to be analyzed.

data Signup and view all the answers

Windows Event Logs are structured in five ____________ (Application, etc.).

channels Signup and view all the answers

DF examiners try their best to extract ______ for the case.

evidence Signup and view all the answers

Digital evidence to be classified as genuine and trustworthy should meet the following criteria: ______ in court.

Admissible Signup and view all the answers

Almost all extraction methods require phones to be ______.

unlocked Signup and view all the answers

The primary purpose of digital forensics is to analyze digital evidence and provide useful information to ____________ and users.

administrators Signup and view all the answers

The aim of DF examiners is to gather all ______, passwords or patterns of the exhibit, prior to conducting the work.

passcodes Signup and view all the answers

The File System Dump (FSD) is a hybrid of _____________ Extraction and Logical Extraction.

Physical Signup and view all the answers

The ______ method accesses the device and records of the data displayed on the screen with photographs or video.

Manual Signup and view all the answers

A physical extraction can retrieve deleted data, operating system files, and areas of the device that are not normally accessible to the ______.

user Signup and view all the answers

The JTAG and Chip-Off methods can be used to extract the data from mobile devices that are ______ or locked with a password.

damaged Signup and view all the answers

The primary goal of the DF Examiner is to retrieve information from the _____________ device.

mobile Signup and view all the answers

Logical extraction involves receiving information from the mobile device and allowing the device to present the data for ______.

analysis Signup and view all the answers

After the information has been extracted from the device, the SIM card and Micro SD are analyzed ______.

separately Signup and view all the answers

Live data which can be acquired through logical extraction include call and text logs, contact lists, and ______ to active social media.

passwords Signup and view all the answers

The ______ method typically allows the DF examiner to access live and deleted data, operating system files and areas of the device that are not normally accessible to the user.

Physical Signup and view all the answers

Devices operating on Android version 7.0 onwards are ______ by default.

encrypted Signup and view all the answers

Match the following cybercrime categories with their descriptions:

<h1>Individual Cybercrimes = Targeting individuals, including phishing, spoofing, spam, and cyberstalking. Organization Cybercrimes = Targeting organizations, including malware attacks and denial of service attacks. Property Cybercrimes = Targeting property, including credit cards and intellectual property rights.</h1> Signup and view all the answers

Match the following concepts with their definitions in cyber security:

CIA triad = Core principles of information security, including confidentiality, integrity, and availability. Incident = Any event that compromises the confidentiality, integrity, or availability of data or information. Cyber-attack = Any attempt to gain unauthorized access to a computer or network. Malware = Software designed to harm or exploit a computer system. Signup and view all the answers

Match the following types of cybercrimes with their targets:

Phishing = Users, to trick them into revealing sensitive information. Organization Cybercrimes = Organizations, to disrupt their operations. Property Cybercrimes = Property, such as credit cards or intellectual property. Cyberstalking = Individuals, to harass or intimidate them online. Signup and view all the answers

Match the following concepts with their descriptions in cyber security:

Data theft = Theft of personal information, email, or documents. Unauthorized access = Unauthorized access to computer resources or systems. Malware = Presence of remote access tools or spyware. Suspicious events = Events that should be viewed as potential incidents until proven otherwise. Signup and view all the answers

Match the following cybercrime categories with their examples:

<h1>Individual Cybercrimes = Phishing, spoofing, spam, and cyberstalking. Organization Cybercrimes = Malware attacks and denial of service attacks. Property Cybercrimes = Theft of funds, credit cards, or intellectual property.</h1> Signup and view all the answers

Match the following concepts with their descriptions in cyber security:

Incident response = A organized approach to identify an attack, minimize its effects, and remediate the cause. Cyber-attack = An attempt to disable, disrupt, destroy, or control computer systems. Data theft = Theft of personal information, email, or documents. Cyber incident = An event that compromises the confidentiality, integrity, or availability of data or information. Signup and view all the answers

Match the following types of cybercrime with their descriptions:

Phishing and Scam = Tricking users to get sensitive information or downloading malware Identity Theft = Using another person's personal data to commit fraud or a crime Ransomware Attack = Encrypting personal data and asking for a ransom to access it Hacking/Misusing Computer Networks = Unauthorized access to private computers or networks Signup and view all the answers

Match the following incident response concepts with their definitions:

Incident Response (IR) = Coordinated and structured approach to go from incident detection to resolution DFIR = Process of collecting, preserving, and analyzing electronic evidence in cyber security incidents Disk imaging = Imaging of a storage medium using forensic software or hardware Write blocker = Device that enables data to be acquired from a hard disk without modifying the disk’s data Signup and view all the answers

Match the following types of cybercrime with their descriptions:

Cyber Bullying = Sending or sharing harmful content to embarrass someone Cyber Stalking = Unwanted persistent content to control and intimidate others Software Piracy = Illegal use or copy of paid software with violation of copyrights Social Media Frauds = Using fake social media accounts to perform harmful activities Signup and view all the answers

Match the following types of cybercrime with their descriptions:

Online Drug Trafficking = Selling and trading illegal drugs online Electronic Money Laundering = Making approvable payment methods with incomplete payment information Cyber Extortion = Demanding money to give back stolen data or stop malicious activities Intellectual-property Infringements = Violating protected intellectual-property rights Signup and view all the answers

Match the following digital forensics data with their descriptions:

Disk images = Bit-for-bit copy of a digital storage device, usually of a hard drive or hard disk Memory images = Computer’s RAM, which can be recorded by special software Application data = Host logs, network device logs, and software-specific logs Signup and view all the answers

Match the following types of digital forensics with their descriptions:

Cloud Forensics = Focusing on data stored electronically in the cloud Computer Forensics = Focusing on data stored electronically in computers Mobile Forensics = Focusing on data stored electronically in mobile devices Network Forensics = Focusing on data stored electronically in networks Signup and view all the answers

Match the following hardware tools with their uses in IR investigation:

Forensics in the Field = Laptop to perform forensic work and interface with specialized tools Disk duplication and imaging systems = Create copies of the data and keep original data safe Write blockers = Acquire data from a hard disk without modifying the disk’s data Digital cameras = Document the evidence Signup and view all the answers

Match the following software tools with their uses in IR investigation:

Boot Disks = Operating Systems (OS) for disk imaging Disk Imaging Tools = Imaging of a storage medium using forensic software or hardware Memory Capture and Analysis = Capture and analyze computer’s RAM Log Analysis Tools = Analyze logs from various devices and systems Signup and view all the answers

Match the following cybercrime with its primary usage:

Phishing and Scam = Social engineering attack Ransomware Attack = The most common type of attack Hacking/Misusing Computer Networks = Unauthorized access to private computers or networks Society Cybercrimes = Cyber-terrorism Signup and view all the answers

Match the following concepts with their importance in IR investigation:

Encryption = Keep information about the case safe and protected Hash verification = Verify the integrity of the data during the imaging process Time zone = Important to consider during the investigation System function = Important to know during the investigation Signup and view all the answers

Match the following types of cybercrime with their descriptions:

Online Recruitment Fraud = Fake job opportunities to obtain financial benefit or personal data Cyber Extortion = Demanding money to give back stolen data or stop malicious activities Intellectual-property Infringements = Violating protected intellectual-property rights Electronic Money Laundering = Making approvable payment methods with incomplete payment information Signup and view all the answers

Match the following digital forensic terms with their descriptions:

Digital Forensics = Identifying, acquiring, processing, analyzing, and reporting on electronic data Digital Evidence = A component of criminal activities and digital forensics Cloud Forensics = Focusing on data stored electronically in the cloud Cybercrime = A type of crime that involves computers or networks Signup and view all the answers

Match the following resources with their uses in IR investigation:

Virtual environments = Make analysis on the working copies of the data Shared forensics equipment = Various tools for data acquisition and analysis Case-Opening Tools = Open and analyze the case Hard drives for evidence storage = Store evidence data Signup and view all the answers

Match the following types of cybercrime with their descriptions:

Social Media Frauds = Using fake social media accounts to perform harmful activities Online Drug Trafficking = Selling and trading illegal drugs online Cyber Bullying = Sending or sharing harmful content to embarrass someone Cyber Stalking = Unwanted persistent content to control and intimidate others Signup and view all the answers

Match the following concepts with their descriptions in IR investigation:

Cyber security incidents = Attacks, unauthorized access, or other security breaches Incident resolution = Effort to quickly identify an attack, minimize its effects, and remediate the cause IR team = Team or department responsible for carrying out incident response practices DFIR specialists = Specialists who gather and inspect information to determine the cause of an incident Signup and view all the answers

Match the following types of cybercrime with their descriptions:

Software Piracy = Illegal use or copy of paid software with violation of copyrights Intellectual-property Infringements = Violating protected intellectual-property rights Cyber Extortion = Demanding money to give back stolen data or stop malicious activities Ransomware Attack = Encrypting personal data and asking for a ransom to access it Signup and view all the answers

Match the following data with their uses in IR investigation:

User logs = Information about user activity Web server access logs = Information about web server access Firewall logs = Information about network traffic and security VPN audit logs = Information about VPN access and security Signup and view all the answers

Match the following types of cybercrime with their descriptions:

Hacking/Misusing Computer Networks = Unauthorized access to private computers or networks Identity Theft = Using another person's personal data to commit fraud or a crime Cybercrime = A type of crime that involves computers or networks Society Cybercrimes = Cyber-terrorism Signup and view all the answers

Match the following concepts with their importance in DFIR investigation:

Data protection = Keep information about the case safe and protected Data analysis = Analyze data to determine the cause of an incident Data collection = Collect data from various sources Data storage = Store evidence data securely Signup and view all the answers

Match the following concepts with their uses in incident response:

IR process = Structured approach to incident detection, response, and resolution Training and documentation = Important for IR team to know the process and procedures Hardware and software solutions = Tools used to perform IR tasks Investigation = Process of gathering and analyzing evidence Signup and view all the answers

Match the following incident response checks with their corresponding descriptions:

Incident Summary Checklist = Gathers information about the incident Incident Detection Checklist = Examines the system's details and the nature of the incident Network Details Checklist = Provides information about the external malicious IP addresses and network configurations Malware Details Checklist = Details about the malware's detection and analysis Signup and view all the answers

Match the following with their primary purposes in incident response:

Incident Summary = To provide overall context about the incident System Administrator = To manage the system's resources and access Network Monitoring = To detect and track malicious activity on the network Data Preservation = To store evidence securely for further analysis Signup and view all the answers

Match the following types of incident response checks with the information they collect:

Incident Detection = Time of incident detection and the person who detected it Network Details = List of external malicious IP addresses and domain names Malware Details = Name of the malicious file and its directory System Details = System's make, model, and primary function Signup and view all the answers

Match the following factors with their roles in incident response:

Nature of the Case = Determines the scope of the investigation Amount of Data Collected = Influences the analysis and evidence collection Search Warrant and Court Orders = Provides legal authority for evidence collection Policies = Guides the incident response process Signup and view all the answers

Match the following with their roles in computer forensics:

DF Examiner = Analyzes the evidence and provides reports System Administrator = Manages the system's resources and access Investigator = Collects and analyzes evidence IR Team = Responds to and resolves incidents Signup and view all the answers

Match the following with their characteristics in digital forensics:

Authentic = Ensures the evidence is genuine Complete = Includes all relevant data Reliable = Proven to be accurate and trustworthy Believable = Supported by credible evidence Signup and view all the answers

Match the following with their roles in digital forensics:

FTK Imager = Creates forensic images of local hard drives and other storage devices DFL = Analyzes digital evidence and provides reports Disk Imaging = Creates a bit-for-bit copy of a digital storage device RAM Dump = Captures the contents of a computer's RAM Signup and view all the answers

Match the following with their purposes in incident response:

Incident Response = To respond to and resolve incidents effectively Evidence Collection = To gather facts and data for analysis Incident Detection = To identify potential incidents and prevent further damage System Analysis = To understand the system's behavior and performance Signup and view all the answers

Match the following with their roles in incident response:

IR Team = Responds to and resolves incidents System Administrator = Manages the system's resources and access DF Examiner = Analyzes the evidence and provides reports Investigator = Collects and analyzes evidence Signup and view all the answers

Match the following with their importance in incident response:

Context = Helps to understand the incident's scope and impact Data Preservation = Ensures the integrity of the evidence System Analysis = Provides insights into the system's behavior and performance Incident Detection = Identifies potential incidents and prevents further damage Signup and view all the answers

Match the following disk imaging formats with their features:

RAW = Stores all data from the original medium EWF = Contains features like Compression of data and Error-Checks AFF = Can be used for creating perfect copies of the original evidence DD = Stores all data from the original medium Signup and view all the answers

Match the following FTK Imager features with their descriptions:

HASH REPORTS = Generate hash reports for regular files and disk images RAM CAPTURE = Allows you to perform memory capture or registry capture on a live device DISK IMAGING = Create perfect copies of the original evidence without making any changes to original evidence CASE METADATA = Contains information about running processes, active network connections, open files, encryption keys, and passwords Signup and view all the answers

Match the following RAM dump features with their descriptions:

Volatile nature = Holds data temporarily while a computer is powered on Dynamic and live information = Contains real-time information about running processes, active network connections, open files, encryption keys, and passwords Uncovering hidden data = Reveals information about active malware, hidden processes, encrypted data in memory, or remnants of deleted files Preserves data after shutdown = Capturing a RAM dump becomes essential to preserve valuable evidence Signup and view all the answers

Match the following computer forensics lab domains with their descriptions:

Active-system analysis = Deals with forensic information, user activity and log reports based off an actively running operating system Static media examination = Focuses on removable flash drives, external and internal hard disks, and other types of storage media that persists after a computer is shut down Digital Forensics Lab = A tightly controlled area for various levels of computer examination DFIR = Divides computer forensics labs into two domains: active-system analysis and static media examination Signup and view all the answers

Match the following tools with their descriptions:

FTK Imager = An open-source software used for creating accurate copies of the original evidence without making any changes to original evidence Magnet Ram Capturer = A tool used for RAM capture or registry capture on a live device Volatility Framework = An open-source framework used for RAM dump analysis EnCase Forensic = A tool used for searching, identifying, and prioritizing potential evidence across computers, laptops, and mobile devices Signup and view all the answers

Match the following disk imaging features with their descriptions:

Compression of data = Reduces the size of the image file Encryption of data = Secures the image file with a password or encryption key Error-Checks = Verifies the integrity of the image file Splitting the image in chunks = Divides the image file into smaller manageable chunks Signup and view all the answers

Match the following digital forensics concepts with their descriptions:

Tolerance of hardware errors = Allows for the creation of accurate copies of the original evidence despite hardware errors Hash sums = Verifies the integrity of the image file Case Metadata = Contains information about the case evidence Disk Imaging = Creates a perfect copy of the original evidence without making any changes to original evidence Signup and view all the answers

Match the following digital forensics tools with their uses:

FTK Imager = Used for creating forensic images of local hard drives, floppy disks, Zip disks, CDs, and DVDs Magnet Ram Capturer = Used for RAM capture or registry capture on a live device Volatility Framework = Used for RAM dump analysis EnCase Forensic = Used for searching, identifying, and prioritizing potential evidence across computers, laptops, and mobile devices Signup and view all the answers

Match the following digital forensics features with their descriptions:

HASH REPORTS = Generate hash reports for regular files and disk images RAM CAPTURE = Allows you to perform memory capture or registry capture on a live device CASE METADATA = Contains information about the case evidence DISK IMAGING = Creates a perfect copy of the original evidence without making any changes to original evidence Signup and view all the answers

Match the following digital forensics concepts with their descriptions:

Volatile memory = Holds data temporarily while a computer is powered on Dynamic and live information = Contains real-time information about running processes, active network connections, open files, encryption keys, and passwords RAM dump = Captures the contents of a computer's memory Disk imaging = Creates a perfect copy of the original evidence without making any changes to original evidence Signup and view all the answers

Match the following Windows event logs with their descriptions:

Security = contains incidents related to security events Setup = captures incidents of installation or upgrading of the Windows operating system System = contains messages generated by the Windows operating system Forwarded Events = contains events which are forwarded by other computers Signup and view all the answers

Match the following steps with the guidelines for handling digital evidence:

Label and seal = Uniquely label and seal the evidence with a proper container Document = Details of the device including type, serial number, and manufacture Not left unattended = Keep the evidence away from any source of contamination Preservation = Keep the original evidence safe Signup and view all the answers

Match the following steganography techniques with their descriptions:

Embedding text in a picture = Hiding sensitive information within an image file Backward masking a message in an audio file = Concealing information in an audio file Concealing information in metadata = Hiding data in file headers or metadata Hiding an image in a video = Concealing data in a video file Signup and view all the answers

Match the following log levels with their descriptions:

Error = important in terms of forensic investigations Audit Success = important in terms of forensic investigations Audit Failure = important in terms of forensic investigations Information = provides insight about the incidents occurred on the system Signup and view all the answers

Match the following incident response tools with their descriptions:

Splunk = is a critical step toward ensuring that your environment can support effective incident response LogRhythm = is a critical step toward ensuring that your environment can support effective incident response Varonis = is a critical step toward ensuring that your environment can support effective incident response EnCase = helps investigators quickly search, identify, and prioritize potential evidence Signup and view all the answers

Match the following forensic tools with their purposes:

Stegdetect = Detecting steganography in digital files Xsteg = Identifying hidden information in files StegAlyzerAS = Analyzing digital files for steganography StegSpy = Detecting and extracting hidden data Signup and view all the answers

Match the following EnCase features with their descriptions:

Acquisition = includes Smartphone and Tablet support Processing = automate common tasks associated with preparing evidence for investigation Deep Forensic Analysis = includes new supported files and encryption support Reporting = includes customizable templates and easy export options Signup and view all the answers

Match the following data types with their extraction methods:

Emails = Extracting emails from digital devices Internet Browsers = Analyzing browser history and cache Pictures and Videos = Extracting multimedia files using hash comparison Software = Analyzing installed software and applications Signup and view all the answers

Match the following Windows Event Logs channels with their descriptions:

Application = Contains information logged by applications on the system System = Stores system-level events and errors Security = Logs security-related events and activities Setup = Tracks system setup and configuration events Signup and view all the answers

Match the following mobile digital forensics software features with their descriptions:

Call logs = can extract data Photos = can extract data Browsers history = can extract data Deleted files = can extract data Signup and view all the answers

Match the following digital forensic tools with their descriptions:

EnCase Forensic = Helps investigators quickly search and identify potential evidence FTK Imager = Creates accurate copies of the original evidence StegAlyzerAS = Analyzes digital files for steganography StegSpy = Detects and extracts hidden data Signup and view all the answers

Match the following digital forensics examiners' goals with their descriptions:

Extract all passcodes = prior to conducting the work Extract all passwords = prior to conducting the work Extract all patterns = prior to conducting the work Gather all evidence = prior to conducting the work Signup and view all the answers

Match the following Windows event logs storage locations with their descriptions:

System32/winevt/Logs = stores event logs in XML format System32/Logs = stores event logs in XML format System/Winevt/Logs = stores event logs in XML format Winevt/Logs = stores event logs in XML format Signup and view all the answers

Match the following digital forensic concepts with their descriptions:

Anti-static shielding bags = Protects electronic items from damage during transportation and storage Physical extraction = Retrieves the device's file system and interprets the data during processing Logical extraction = Recovers deleted files and data Disk images = A bit-for-bit copy of a digital storage device Signup and view all the answers

Match the following incident response steps with their descriptions:

Gathering facts = Collecting information about the incident Log analysis = Analyzing logs to identify incident details Network monitoring = Monitoring network traffic for suspicious activity Incident detection = Identifying and reporting suspicious events Signup and view all the answers

Match the following incident response activities with their descriptions:

Configuring adequate logging = is a critical step toward ensuring that your environment can support effective incident response Aggregating logs = is a critical step toward ensuring that your environment can support effective incident response Analyzing logs = is a critical step toward ensuring that your environment can support effective incident response Responding to incidents = is a critical step toward ensuring that your environment can support effective incident response Signup and view all the answers

Match the following EnCase Forensic features with their descriptions:

Tagging = creates custom tags and applies to any file Unified Search = searches across the entire case from one easy to use interface Index = includes hash records and enables easy export of files Reporting = includes customizable templates and easy export options Signup and view all the answers

Match the following cybercrime types with their descriptions:

Cyber extortion = Demanding money or favors in exchange for not causing harm Cyber bullying = Targeting individuals or systems with harmful activities Social media fraud = Using social media to commit fraud or harm Property Cybercrimes = Targeting individuals' personal information Signup and view all the answers

Match the following log aggregator tools with their descriptions:

SIEM = is a critical step toward ensuring that your environment can support effective incident response ManageEngine = is a critical step toward ensuring that your environment can support effective incident response IBMQRadar = is a critical step toward ensuring that your environment can support effective incident response SolarWinds = is a critical step toward ensuring that your environment can support effective incident response Signup and view all the answers

Match the following digital forensic techniques with their descriptions:

JTAG and Chip-Off = Extracting data from damaged or locked mobile devices Memory imaging = Capturing a snapshot of a device's memory Steganography = Hiding sensitive information within ordinary files Hash reports = Verifying the integrity of digital evidence Signup and view all the answers

Match the following mobile device data extraction methods with their descriptions:

Logical Extraction = Receiving information from the mobile device and allowing it to present the data for analysis. File System Dump (FSD) = A hybrid of Physical Extraction and Logical Extraction, retrieving the device's file system and interpreting the data during processing. Physical Extraction = Acquiring raw binary data from the media storage of the device and analyzing it later. Manual Extraction = Accessing the device and recording data displayed on the screen with photographs or video. Signup and view all the answers

Match the following data types with the methods that can extract them:

Live Data = Logical Extraction Deleted Files = Physical Extraction Databases holding deleted messages = File System Dump (FSD) Raw Binary Data = JTAG / Chip-Off / Rooting / Jail Breaking Signup and view all the answers

Match the following limitations with the data extraction methods:

Cannot recover deleted files = Logical Extraction Does not retrieve all deleted data = File System Dump (FSD) Requires high technical skill = JTAG / Chip-Off / Rooting / Jail Breaking Limited by device model or recent launch = Manual Extraction Signup and view all the answers

Match the following data extraction methods with their benefits:

Logical Extraction = Allows access to live data only Physical Extraction = Allows access to live and deleted data, operating system files, and areas not normally accessible to the user. File System Dump (FSD) = Retrieves databases holding deleted messages and may not be accessible during a physical extraction JTAG / Chip-Off / Rooting / Jail Breaking = Allows extraction of raw binary data from damaged or locked devices Signup and view all the answers

Match the following data extraction methods with the devices they are suitable for:

Logical Extraction = All mobile devices Physical Extraction = Most mobile devices, except those with encryption File System Dump (FSD) = Most mobile devices, except those with encryption JTAG / Chip-Off / Rooting / Jail Breaking = Damaged or locked devices, and IOT devices Signup and view all the answers

Match the following data extraction methods with the level of technical skill required:

Logical Extraction = Low technical skill Physical Extraction = Moderate technical skill File System Dump (FSD) = Moderate technical skill JTAG / Chip-Off / Rooting / Jail Breaking = High technical skill Signup and view all the answers

Match the following data extraction methods with the type of data retrieved:

Logical Extraction = Live data only Physical Extraction = Live and deleted data, operating system files, and areas not normally accessible to the user File System Dump (FSD) = Databases holding deleted messages and live data Manual Extraction = Data displayed on the screen Signup and view all the answers

Match the following data extraction methods with the limitations of forensic software:

Logical Extraction = Cannot recover deleted files Physical Extraction = Cannot access devices with encryption File System Dump (FSD) = Does not retrieve all deleted data Manual Extraction = Limited by device model or recent launch Signup and view all the answers

Match the following data extraction methods with the risks involved:

Logical Extraction = No risk of data loss Physical Extraction = No risk of data loss File System Dump (FSD) = No risk of data loss Chip-Off = Device will be damaged and can no longer be used Signup and view all the answers

Match the following data extraction methods with the level of data analysis required:

Logical Extraction = Minimal analysis required Physical Extraction = Moderate analysis required File System Dump (FSD) = Moderate analysis required JTAG / Chip-Off / Rooting / Jail Breaking = High analysis required Signup and view all the answers

What is a Cyber Attack or Incident?

Choose a study mode

Podcast

Questions and Answers

What is the primary intention of a cyber-attack?

What is the term used to describe the core principles of information security?

Which type of cybercrime targets individuals?

What is an example of a computer security incident?

What should be done with suspicious events?

What is the main target of Organization Cybercrimes?

What is the most common type of cybercrime attack?

What is the term for unauthorized access to private computers or networks?

What is the goal of cyberstalking?

What is software piracy an example of?

What is the primary use of the 'Dark Web'?

What is the purpose of digital forensics?

What is cyber extortion?

What is the term for the violation of intellectual-property rights?

What is the purpose of online recruitment fraud?

What is the main aspect of digital evidence in digital forensics?

What is the main goal of incident response?

What is DFIR in the context of cybersecurity?

What type of data do analysts typically collect during an investigation?

Why is it important to encrypt incident response data?

What is the purpose of a write blocker in incident response?

What is disk imaging in the context of incident response?

What is the purpose of a forensic examination suite in incident response?

What is the main benefit of using virtual environments in incident response?

What is the purpose of a boot disk in incident response?

What is the goal of log analysis in incident response?

What type of data is stored in a raw image file format?

What is the purpose of AccessData FTK Imager?

What are the two leading hash functions used by FTK Imager?

What is the importance of RAM dump in digital forensics investigation?

What is the characteristic of RAM in digital forensics?

What is the purpose of a Digital Forensics Lab (DFL)?

What are the two domains of computer forensics labs?

What is the benefit of analyzing RAM dumps in digital forensics?

What is the significance of RAM in uncovering hidden or encrypted data?

What is the difference between active-system analysis and static media examination?

What is the primary purpose of gathering facts and additional information about an incident?

Why is it important to know the time zone of an incident?

What is the purpose of an Incident Summary Checklist?

What is included in the Incident Detection Checklist?

What is the purpose of preserving a copy of the malware?

What are the criteria for digital evidence to be classified as genuine and trustworthy?

What is the first step of analyzing digital evidence?

What is the purpose of examining the condition of the computer when it was seized?

What is included in the Network Details Checklist?

What is the purpose of inventorying the hardware on the suspect's computer?

What is the first step in handling digital evidence?

What is the purpose of anti-static shielding bags in digital forensics?

What is the term used to describe hiding sensitive information within an ordinary file or message?

What is one of the methods used to detect steganography?

What type of data do DF examiners need to extract from a computer?

What is the purpose of Windows Event Logs in forensic analysis?

What is one of the channels in Windows Event Logs?

Why do investigators create a digital 'image' of the victim's hard drive?

What type of events are captured in the Security log?

What is one of the methods hackers use to conceal their activities?

What is the purpose of configuring adequate logging on Windows systems?

What is the format in which event logs are stored?

What is the purpose of cryptographic hash values in digital forensics?

What is the name of the forensic tool that helps investigators quickly search, identify, and prioritize potential evidence?

What is the main feature of EnCase that allows for customizable report templates?

What type of data can be extracted from mobile devices using mobile digital forensics software?

What is the primary goal of DF examiners when conducting mobile forensics?

What is the purpose of the Setup log?

What is the most common method of data extraction that allows access to live and deleted data, operating system files, and areas of the device that are not normally accessible to the user?

What is the name of the folder where event logs are stored?

What is the main benefit of using a SIEM or log aggregator?

What type of extraction retrieves the device's file system and interprets the data during the processing stage?

What is the limitation of logical extraction?

What is the method of data extraction that involves accessing the device and recording data displayed on the screen with photographs or video, or by transcribing its data?

What is the method of data extraction that requires the stripping down of the device to its logical board and soldering a certain cable to a certain connection on the board?

What is the limitation of chip-off method?

What type of data can be acquired through logical extraction?

What is the purpose of bootloaders in mobile devices?

What is the advantage of physical extraction over logical extraction?

What is the limitation of forensic software?