University:
Eastern Kentucky University
Course:
CSC 189 | Computing Concepts and Programming
Academic year:

2023
Views:

321

Pages:

2
Author:

Marin Mason

Guide to Computer Forensics and Investigations Ch. 6 Solutions-1 Chapter 6 Solutions Review Questions 1. Forensics software tools are grouped into _________ and _______________ applications. GUI, command-line 2. According to ISO standard 27037, which of the following is an important factor in data acquisition? (Choose all that apply.) a. The DEFR’s competency c. Use of validated tools 3. An encrypted drive is one reason to choose a logical acquisition. True or False? True 4. Hashing, filtering, and file header analysis make up which function of computer forensics tools? a. Validation and verification 5. Hardware acquisition tools typically have built-in software for data analysis. True or False? False; most are used only for acquisition. 6. The reconstruction function is needed for which of the following purposes? (Choose all that apply.) a. Re-create a suspect drive to show what happened. b. Create a copy of a drive for other investigators. d. Re-create a drive compromised by malware. 7. List three subfunctions of the extraction function. Answers can include data viewing, keyword searching, decompressing, carving, decrypting, and bookmarking. 8. Data can’t be written to disk with a command-line tool. True or False? False 9. Hash values are used for which of the following purposes? (Choose all that apply.) b. Filtering known good files from potentially suspicious data Guide to Computer Forensics and Investigations Ch. 6 Solutions-2 d. Validating that the original data hasn’t changed 10. In testing tools, the term “reproducible results” means that if you work in the same lab on the same machine, you generate the same results. True or False? False 11. The verification function does which of the following? c. Proves that two sets of data are identical via hash values 12. What’s the advantage of a write-blocking device that connects to a computer through a FireWire or USB controller? It enables you to remove and reconnect drives without having to shut down your workstation, which saves time in processing the evidence drive. 13. Building a forensic workstation is more expensive than purchasing one. True or False? False 14. A live acquisition can be replicated. True or False? False 15. Which of the following is true of most drive-imaging tools? (Choose all that apply.) b. They ensure that the original drive doesn’t become corrupt and damage the digital evidence. c. They create a copy of the original drive. 16. The standards for testing forensics tools are based on which criteria? c. ISO 17025 17. A log report in forensics tools does which of the following? c. Records an investigator’s actions in examining a case 18. When validating the results of a forensics analysis, you should do which of the following? (Choose all that apply.) a. Calculate the hash value with two different tools. b. Use a different tool to compare the results of evidence you find. 19. The primary hashing algorithm the NSRL project uses is SHA-1. True or False? True