Chapter 9 Computer Forensics Analysis and Validation

Chapter 9: Computer Forensics Analysis and Validation 1. ____ increases the time and resources needed to extract,analyze,and present evidence. a. Investigation plan c. Litigation path b. Scope creep d. Court order for discovery 2. You begin any computer forensics case by creating a(n) ____. a. investigation plan c. evidence custody form b. risk assessment report d. investigation report 3. In civil and criminal cases, the scope is often defined by search warrants or ____, which specify what data you can recover. a. risk assessment reports c. scope creeps b. investigation plans d. subpoenas 4. There are ____ searching options for keywords which FTK offers. a. 2 c. 4 b. 3 d. 5 5. ____ Search can locate items such as text hidden in unallocated space that might not turn up in an indexed search. a. Online c. Active b. Inline d. Live 6. The ____ search feature allows you to look for words with extensions such as “ing,”“ed,” and so forth. a. fuzzy c. permutation b. stemming d. similar-sounding 7. In FTK ____ search mode, you can also look for files that were accessed or changed during a certain time period. a. live c. active b. indexed d. inline 8. FTK and other computer forensics programs use ____ to tag and document digital evidence. a. tracers c. bookmarks b. hyperlinks d. indents 9. Getting a hash value with a ____ is much faster and easier than with a(n) ____. a. high-level language, assembler b. HTML editor, hexadecimal editor c. computer forensics tool, hexadecimal editor d. hexadecimal editor, computer forensics tool 10. Access Data ____ compares known file hash values to files on your evidence drive or image files to see whether they contain suspicious data. a. KFF c. NTI b. PKFT d. NSRL 11. Data ____ involves changing or manipulating a file to conceal information. a. recovery c. integrity b. creep d. hiding 12. One way to hide partitions is to create a partition on a disk, and then use a disk editor such as ____ to manually delete any reference to it. a. Norton DiskEdit c. System Commander b. PartitionMagic d. LILO 13. Marking bad clusters data-hiding technique is more common with ____ file systems. a. NTFS c. HFS b. FAT d. Ext2fs 14. The term ____ comes from the Greek word for“hidden writing.” a. creep c. escrow b. steganography d. hashing 15. ____ is defined as the art and science of hiding messages in such a way that only the intended recipient knows the message is there. a. Bit shifting c. Marking bad clusters b. Encryption d. Steganography 16. Many commercial encryption programs use a technology called ____, which is designed to recover encrypted data if users forget their passphrases or if the user key is corrupted after a system data failure. a. steganography c. password backup b. key escrow d. key splitting 17. People who want to hide data can also use advanced encryption programs, such as PGP or ____. a. NTI c. FTK b. BestCrypt d. PRTK 18. ____ Recovery is a fairly easy task in computer forensic analysis. a. Data c. Password b. Partition d. Image 19. ____ attacks use every possible letter, number, and character found on a keyboard when cracking a password. a. Brute-force c. Profile b. Dictionary d. Statistics 20. ____ are handy when you need to image the drive of a computer far away from your location or when you don’t want a suspect to be aware of an ongoing investigation. a. Scope creeps c. Password recovery tools b. Remote acquisitions d. Key escrow utilities 21. ____ is a remote access program for communication between two computers. The connection is established by using the DiskExplorer program (FAT or NTFS) corresponding to the suspect (remote) computer’s file system. a. HDHOST c. DiskEdit b. DiskHost d. HostEditor