Review Questions - SYS701 - 15 - Digital Forensics

Felix wants to make an exact copy of a drive using a Linux command-line tool as part of a forensic acquisition process. What command should he use?

Greg is preparing a forensic report and needs to describe the tools that were used. What should he report about the tools in addition to their names?

Gabby is preparing chain-of-custody documentation and identifies a gap in hand-off documentation for an original source forensic drive. What issue should she expect to encounter due to this gap?

Mike's organization has recently moved to a SaaS cloud service and needs to collect forensic data from the cloud service. What process can Mike use to gather the information he needs?

Charles wants to obtain a forensic copy of a running virtual machine. What technique should he use to capture the image?

Melissa wants to capture network traffic for forensic purposes. What tool should she use to capture it?

Frank is concerned about the admissibility of his forensic data. Which of the following is not an element he should be concerned about?

What is the document that tracks the custody or control of a piece of evidence called?

Isaac is performing a forensic analysis on two systems that were compromised in the same event in the same facility. As he performs his analysis, he notices that the event appears to have happened almost exactly one hour earlier on one system than the other. What is the most likely issue he has encountered?

What legal concept determines the law enforcement agency or agencies that will be involved in a case based on location?

Michael wants to acquire the firmware from a running device for analysis. What method is most likely to succeed?

Charles needs to know about actions an individual performed on a PC. What is the best starting point to help him identify those actions?

Maria has acquired a disk image from a hard drive using dd, and she wants to ensure that her process is forensically sound. What should her next step be after completing the copy?

Alex has been handed a flash media device that was quick-formatted and has been asked to recover the data. What data will remain on the drive?

Naomi is preparing to migrate her organization to a cloud service and wants to ensure that she has the appropriate contractual language in place. Which of the following is not a common item she should include?

Alaina wants to maintain chain-of-custody documentation and has created a form. Which of the following is not a common element on a chain-of-custody form?

Henry is following the EDRM model and is preparing to review data. What two key tasks occur during this stage?

Theresa's organization has received a legal hold notice for their files and documents. Which of the following is not an action she needs to take?

Gurvinder wants to follow the order of volatility to guide his forensic data acquisition. Which of the following is the least volatile?

What is the key difference between hashing and checksums?

What is 'dd'?

Tool Reporting

Chain-of-Custody Gap Implication

Cloud Forensic Data Collection

Forensic Copy of a VM

Network Traffic Capture Tool

Chain of Custody

Time Zone Issue

Jurisdiction

Acquiring Firmware from Running Device

Best Starting Point for PC Actions

Verify Forensic Soundness

Quick-Formatted Drive Data

Hashing vs. Checksums

Data Review Key Tasks

Least Volatile Data

Uncommon Cloud Contract Item

Uncommon Chain-of-Custody Element

Action to NOT take after Legal Hold Notice

Element NOT of Concern for Forensic Data Admissibility