INTRODUCTION – Digital Forensics

FORENSIC COURSE OVERVIEW KNOWLEDGE CHECK

1. Digital forensics can be defined as the application of science to the identification, collection, examination, and analysis of what?

2. According to NIST, the four (4) steps of the forensic process include which? (Select 4)

THE FORENSICS PROCESS KNOWLEDGE CHECK

1. According to NIST, a forensic analysis should include four elements, Places, Items, Events and what?

2. True or False. Digital forensics report must contain details of every test conducted, the methods and tools used, and the results.

3. Which section of a digital forensics report would contain a list of the steps you have taken to insure the integrity of the evidence?

4. Network activity, Application usage, Logs and Keystroke monitoring are all sources of what?

5. What are the three (3) main hurdles that must be overcome when examining data? (Select 3)

FORENSIC DATA KNOWLEDGE CHECK

1. True or False. Only data files can be effectively analyzed during a forensic analysis.

2. Most data files are smaller than the number of blocks allocated to their storage by the file system, the unused spaces is known as what?

3. What does file metadata known as “MAC” data stand for in the context of a forensic analysis?

4. Open files are considered which data type?

5. True or False. When collecting forensic data from a running system, you should always attempt to collect volatile data first.

6. Which operating system has a “Target Disk Mode” that allows a forensic investigator to easily make a copy of the target hard drive?

7. Which three (3) of the following are application components? (Select 3)

8. Which of these applications would likely be of the most interest in a forensic analysis?

9. What useful foresnsic data can be extracted from the Application layer of the TCP/IP protocol stack?

10. Which device would you inspect if you were looking for failed attempts to penetrate your company’s network?

DIGITAL FORENSICS ASSESSMENT

1. Digital forensics is commonly applied to which of the following activities?

2. NIST includes which three (3) as steps in collecting data? (Select 3)

3. What is the primary purpose of maintaining a chain of custody?

4. True or False. Digital forensics had been used to solve a number of high-profile violent crimes.

5. True or False. Digital forensics report is a summary of your findings. If your case goes to trial, your testimony can, and usually does, involve far more detail than is in the report.

6. Which section of a digital forensics report would include using the best practices of taking lots of screenshots, use built-in logging options of your digital forensics tools, and exporting key data items into a .csv or .txt file?

7. Which types of files are appropriate subjects for forensic analysis?

8. Deleting a file results in what action by most operating systems?

9. Forensic analysis should always be conducted on a copy of the original data. What type of copying is appropriate for getting data from a live system that cannot be taken offline?

10. How does a forensic analysis use hash sets acquired from NIST’s Software Reference Library project?

11. Which three (3) of the following data types are considered non-volatile? (Select 3)

12. Configuration files are considered which data type?

13. True or False. When collecting forensic data from a running system, you should always attempt to collect non-volatile data first.

14. Which three (3) of the following are application components? (Select 3)

15. Which of these applications would likely be of the least interest in a forensic analysis?

16. The Internet layer of the TCP/IP stack, also known as the Network layer in the OSI model, contains which two (2) protocols that are very useful to a forensic investigation? (Select 2)

17. Which device would you inspect if you were looking for event data correlated across a number of different network devices?

18. Which of these sources might require a court order in order to obtain the data for forensic analysis?

CONCLUSION – Digital Forensics