Software forensic tools are grouped into command-line applications and gui applications.

Software forensics tool are grouped into command-line applications and GUI applications t/f

true

Making a logical acquisition of a drive with whole disk encryption can result in unreadable files t/f

false

Physically copying the entire drive is the only type of data-copying method used in software acquisition t/f

false

ISO standard 23037 states that the most important factors in data acquisition are the DEFR's competency and the use of validated tools t/f

true

All forensics acquisition tools have a method for verification of the data-copying process that compares the original drive with the image t/f

true

What tool below was written for ms-dos and was commonly used for manual digital investigations? a. SMART b. Norton DiskEdit c. ByteBack d. DataLifter

b

In general, what would a lightweight forensics workstation consist of? a. a tablet with peripherals and forensics apps b. a laptop computer built into a carrying case with a small election of peripheral options c. a laptop computer with almost as many bays and peripherals as a tower d. a tower with several bays and many peripheral devices

b

In what mode do most software write-blockers run? a. RW mode b. Ala mode c. Shell mode d. GUI mode

c

Reconstructing fragments of files that have been deleted from a suspect drive, is know as ??? in North America a. carving b. scraping c salvaging d. sculpting

a

The ProDiscover utility makes use of the proprietary ??? file format a. .img b. .pro c. .iso d. .eve

d

What is the purpose of the reconstruction function in a forensics investigation? a. re-create a suspect's drive to show what happened during a crime or incident b. prove that two sets of data are identical c. copy all information from a suspect's drive, including information that may have been hidden d. generate reports or logs that detail the processes undertaken by a forensics investigator

a

Which of the following options is not a subfunction of extraction? a. logical data copy b. decrypting c. bookmarking d. carving

a

In what temporary location below might passwords be stored? a. system32.dll b. CD-ROM drive c. sindows registry d. pagefile.sys

d

The ??? Linux live CD includes tools such as Autopsy and Sleuth Kit, ophcrack, dcfldd, memfetch, and mboxgrep, and utilizes a kde interface a. kali b. arch c. Ubuntu d. helix3

a

What option below is an example of a platform specific encryption tool? a. GnuPG b. TrueCrypt c. BitLocker d. Pretty Good Privacy (PGP)

c

What hex value is the standard indicator for jpeg graphics files? a. FF D8 b. FF D9 c. F8 D8 d. AB CD

a

passwords are typically stored as one-way ??? rather than in plaintext a. hex values b. variables c. hashes d. stack spaces

c

What program serves as the GUI front end for accessing sleuth kit's tools? a. detectiveGUI b. autopsy c. kde d. smart

b

Which of the following is stated within the ISO 27037 standard? a. hardware acquisition tools can only use CRC-32 hashing b digital evidence first responders should use validated tools c. software forensics tools must provide a GUI interface d. software forensics tools must use the windows OS

b

The physical data copy subfunction exists under the ??? function a. reporting b. validation / verification c. extraction d. acquisition

d

A keyword search is part of the analysis process within what forensic function? a. reporting b. reconstruction c. extraction d. acquisition

c

What algorithm is used to decompress windows files? a. Fibonacci b. zopfli c. Shannon-fano d. Lempel-ziv

d

What is the goal of the NSRL project, created by NIST? a. collect know hash values for commercial software and OS files using SHA hashes b. search for collisions in hash values, and contribute to fixing hashing programs c. create hash values for illegal files and distribute the information to law enforcement d. collect known hash values for commercial software and OS files using MD5 hashes

a

When performing disk acquisition, the raw data format is typically created with the UNIX/Linux ??? command a. format b. tar c. dump d. dd

d

??? proves that two sets of data are identical by calculating hash values or using another similar method a. verification b. validation c. integration d. compliation

a