University:
Eastern Kentucky University
Course:
CSC 189 | Computing Concepts and Programming
Academic year:

2023
Views:

189

Pages:

2
Author:

blakestar2o1o

Guide to Computer Forensics and Investigations Ch. 9 Solutions-1 Chapter 9 Solutions Review Questions 1. Which of the following represents known files you can eliminate from an investigation? (Choose all that apply.) b. Files associated with an application c. System files the OS uses 2. For which of the following reasons should you wipe a target drive? 3. The Known File Filter (KFF) can be used for which of the following purposes? (Choose all that apply.) d. Both a and b a. Filter known program files from view. c. Compare hash values of known files to evidence files. 4. Password recovery is included in all forensics tools. True or False? 5. After you shift a file’s bits, the hash value remains the same. True or False? 6. Which forensic image file format creates or incorporates a validation hash value in the image file? (Choose all that apply) False False a. Expert Witness b. SMART c. AFF 7. ___________________ happens when an investigation goes beyond the bounds of its original description. 8. Suppose you’re investigating an e-mail harassment case. Generally, is collecting evidence for this type of case easier for an internal corporate investigation or a criminal investigation? Scope creep c. Internal corporate investigation because corporate investigators typically have ready access to company records 9. You’re using Disk Management to view primary and extended partitions on a suspect’s drive. The program reports the extended partition’s total size as larger than the sum of the sizes of logical partitions in this extended partition. What might you infer from this information? b. There’s a hidden partition. 10. Commercial encryption programs often rely on _____________________ technology to recover files if a password or passphrase is lost. key escrow 11. Steganography is used for which of the following purposes? b. Hiding data Guide to Computer Forensics and Investigations Ch. 9 Solutions-2 12. The National Software Reference Library provides what type of resource for digital forensics examiners? b. A list of MD5 and SHA1 hash values for all known OSs and applications 13. In steganalysis, cover-media is which of the following? c. The file a steganography tool uses to host a hidden message, such as a JPEG or an MP3 file 14. Rainbow tables serve what purpose for digital forensics examinations? a. Rainbow tables contain computed hashes of possible passwords that some password-recovery programs can use to crack passwords. 15. The likelihood that a brute-force attack can succeed in cracking a password depends heavily on the password length. True or False? True 16. If an application uses salting when creating passwords, what concerns should a forensics examiner have when attempting to recover passwords? b. Salting can make password recovery extremely difficult and time consuming. 17. Block-wise sector analysis has which of the following benefits for forensics examiners? d. Provides a method for hashing sectors of a known good file that can be used to search for data remnants on a suspect’s drive