Computer Forensics and Investigations Ch.1

Guide to Computer Forensics and Investigations Ch. 1 Solutions-1 Chapter 1 Review Questions 1. Digital forensics and data recovery refer to the same activities. True or False? False 2. Police in the United States must use procedures that adhere to which of the following? 3. The triad of computing security includes which of the following? 4. What’s the purpose of maintaining a network of digital forensics specialists? b. Fourth Amendment c. Vulnerability/threat assessment, intrusion detection and incident response, and digital investigation To develop a list of colleagues who specialize in areas different from your own specialties in case you need help on an investigation. 5. Policies can address rules for which of the following? 6. List two items that should appear on a warning banner. d. Any of the above Statements that the organization has the right to monitor what users do, that their e-mail is not personal, and so on 7. Under normal circumstances, a private-sector investigator is considered an agent of law enforcement. True or False? 8. List two types of digital investigations typically conducted in a business environment. 9. What is professional conduct, and why is it important? False Fraud, embezzlement, insider trading, espionage, and e-mail harassment Professional conduct includes ethics, morals, and standards of behavior. It affects a professional’s credibility. 10. What’s the purpose of an affidavit? To provide facts in support of evidence of a crime to submit to a judge when requesting a search warrant 11. What are the necessary components of a search warrant? A search warrant must specify who, what, when, and where—that is, specifics on place, time, items being searched for, and so forth—and include any supporting materials (affidavits and exhibits, for example). In addition, a search warrant must be signed by an impartial judicial officer. In many cases, a search warrant can limit the scope of what can be seized. 12. What are some ways to determine the resources needed for an investigation? Determine the OS of the suspect computer and list the software needed for the examination. 13. List three items that should be on an evidence custody form. Answers include case number, name of the investigator assigned to the case, nature of the case, location where evidence was obtained, description of the evidence, and so on. Guide to Computer Forensics and Investigations Ch. 1 Solutions-2 14. Why should you do a standard risk assessment to prepare for an investigation? To list problems that might happen when conducting an investigation, which can help in planning your case 15. You should always prove the allegations made by the person who hired you. True or False? False 16. For digital evidence, an evidence bag is typically made of antistatic material. True or False? True 17. Why should evidence media be write-protected? To make sure data isn’t altered 18. List three items that should be in your case report. Answers can include an explanation of basic computer and network processes, a narrative of what steps you took, a description of your findings, and log files generated from your analysis tools. 19. Why should you critique your case after it’s finished? To improve your work 20. What do you call a list of people who have had physical possession of the evidence? Chain of custody 21. Data collected before an attorney issues a memo for an attorney-client privilege case is protected under the confidential work product rule. True or False? False. All data collected before an attorney issues notice of attorney-client privilege is subject to discovery by opposing counsel. Guide to Computer Forensics and Investigations Ch. 3 Solutions-1 3 Solutions Review Questions 1. What’s the main goal of a static acquisition? Preservation of digital evidence 2. Name the three formats for digital forensics data acquisitions. Raw format, proprietary formats, and Advanced Forensic Format (AFF) 3. What are two advantages and disadvantages of the raw format? Advantages: faster data transfer speeds, ignores minor data errors, and most forensics analysis tools can read it. Disadvantages: requires equal or greater target disk space, doesn’t contain hash values in the raw file (metadata), might have to run a separate hash program to validate raw format data, and might not collect marginal (bad) blocks. 4. List two features common with proprietary format acquisition files. Can compress or not compress the acquisition data; can segment acquisition output files into smaller volumes, allowing them to be archived to CD or DVD; case metadata can be added to the acquisition file, eliminating the need to keep track of any additional validation documentation or files 5. Of all the proprietary formats, which one is the unofficial standard? Expert Witness, used by Guidance Software EnCase 6. Name two commercial tools that can make a forensic sector-by-sector duplicate of a drive to a larger drive. EnCase and X-Ways Forensics 7. What does a logical acquisition collect for an investigation? only specific files of interest to the case 8. What does a sparse acquisition collect for an investigation? fragments of unallocated data in addition to the logical allocated data 9. What should you consider when determining which data acquisition method to use? Size of the source drive, whether the source drive is retained as evidence, how long the acquisition will take, and where the disk evidence is located 10. Why is it a good practice to make two images of a suspect drive in a critical investigation? To ensure at least one good copy of the forensically collected data in case of any failures 11. When you perform an acquisition at a remote location, what should you consider to prepare for this task? Determine whether there’s enough electrical power and lighting, and check the temperature and humidity at the location. 12. With newer Linux kernel distributions, what happens if you connect a hot-swappable device, such a USB drive, containing evidence? Newer Linux distributions automatically mount the USB device, which could alter data on it. 1 Guide to Computer Forensics and Investigations Ch. 3 Solutions-2 13. In Linux, the fdisk -l command lists the suspect drive as /dev/hda1. Is the following dcfldd command correct? dcfldd if=image_file.img of=/dev/hda1 No. This command reads the image_file.img file and writes it to the evidence drive’s /dev/hda1 partition. The correct command is dcfldd if=/dev/hda1 of=image_file.img. 14. What’s the most critical aspect of digital evidence? validation 15. What’s a hashing algorithm? A program designed to create a binary or hexadecimal number that represents the uniqueness of a data set, file, or entire disk 16. In the Linux dcfldd command, which three options are used for validating data? hash, hashlog, and vf 17. What’s the maximum file size when writing data to a FAT32 drive? 2 GB (a limitation of FAT file systems) 18. What are two concerns when acquiring data from a RAID server? Amount of data storage needed, type of RAID server (0, 1, 5, and so on), whether the acquisition tool can handle RAID acquisitions, whether the analysis tool can handle RAID data, and whether the analysis tool can split RAID data into separate disk drives, making it easier to distribute large data sets 19. With remote acquisitions, what problems should you be aware of? (Choose all that apply.) a. Data transfer speeds b. Access permissions over the network c. Antivirus, antispyware, and firewall programs 20. Which forensics tools can connect to a suspect’s remote computer and run surreptitiously? EnCase Enterprise and ProDiscover Incident Response 21. EnCase, FTK, SMART, and iLookIX treat the image file as though it were the original disk. True or False? True 22. FTK Imager can acquire data in a drive’s host protected area. True or False? False 2