5.5 Summarize basic concepts of forensics.

Question 1

What is the order of volatility?

Answer 1

1. CPU Cache
2. ARP/Routing Tables
3. RAM
4. SWAP/Temp files
5. Hard Drive 6. Archival Media (CD/DVD/Print outs)

Question 2

Chain of Custody

Answer 2

A document that indicates various details about evidence across its lifecycle.

Question 3

Legal Hold

Answer 3

A notice to a data custodian that specific data or information must be preserved.

Question 4

Data Acquisition

Answer 4

The process and procedures by which data relevant to a criminal action is discovered and collected.

Question 5

Capture System Image

Answer 5

• Taking a snapshot of the current state of the computer that contains all current settings and data
• Must take the order volatility in to account
• Use a write blocker to prevent changing evidence
• Take hashes before and after making a bit-for-bit copy.

Question 6

Network Traffic And Logs

Answer 6

Sources of evidence can include network traffic and network device logs

Question 7

Capture Video

Answer 7

Collect and video from surveillance cameras.

Question 8

Record Time Offset

Answer 8

Ensuring that you take note of the time difference between the device clock and the standard.

Question 9

Take Hashes

Answer 9

Take hashes before collecting any digital evidence.

Take hashes after coping any digital evidence

Question 10

Screenshots

Answer 10

Take photographs of screens rather that trusting the native software.

Question 11

Witness Interviews

Answer 11

Its important to interview all those with knowledge of what occurred
This allows you to build a chronological order of events.

Question 12

An organization has been sent a lawyer’s letter demanding that they retain specific records, logs, and other files pertaining to suspected illegal activity. What has jus been done?
A. Financial Audit
B. Forensics
C. Big Data request
D. Legal Hold

Answer 12

D. Legal Hold

Question 13

In the initial stages of an investigation, Matt, the security administrator, was provided the hard drives in question from the incident manager. Which of the following incident response procedures would he need to perform in order to begin the analysis? (Select TWO).
A. Take hashes
B. Begin the chain of custody paperwork
C. Take screen shots
D. Capture the system image
E. Decompile suspicious files

Answer 13

A. Take hashes

D. Capture the system image

Question 14

Evidence is inadmissible in court if which of the following is violated or mismanaged?
A. Chain of custody
B. Service-level agreement
C. Privacy policy
D. Change management

Answer 14

A. Chain of custody