Advanced Digital Forensics Flashcards
(29 cards)
What is the purpose of securing a digital crime scene?
To prevent tampering with evidence and preserve its integrity for investigation.
Name two things to check when securing a digital device at a crime scene.
Device ownership and whether it is connected to a network.
What is volatile data, and why is it important?
Data that disappears when power is lost; important because it must be collected immediately.
Give an example of volatile data.
RAM contents, running processes, open network connections.
What tool is used to capture volatile memory?
Belkasoft Live RAM Capturer.
What is Dead Acquisition?
Collecting data from a powered-off device, preserving the original data structure.
What is the Order of Volatility?
The priority order for collecting data based on how quickly it can be lost.
What is the primary goal of forensic data acquisition?
To make an exact bit-by-bit copy of evidence media without altering original data.
List three types of data acquisition methods.
Logical acquisition, Sparse acquisition, Bit-stream imaging.
What is Logical Acquisition?
Capturing specific files or file types of interest.
What is Sparse Acquisition?
Capturing both selected files and fragments of deleted files from unallocated space.
What is a Bit-stream Disk-to-Disk Copy?
Cloning one disk directly to another, preserving original data structure.
Name two hashing algorithms used for verifying digital evidence.
MD5, SHA-1.
What is a Write Blocker, and why is it used?
A device preventing any write commands to evidence media during acquisition.
What is the purpose of forensic imaging tools like AccessData FTK Imager?
To create forensic images of storage media for investigation.
What are the benefits of forensic readiness for an organization?
Faster investigations, lower costs, better defense against cybercrimes.
What are examples of Anti-Forensic Techniques?
Encryption, steganography, data wiping.
What is Steganography?
Hiding secret data within ordinary files like images or audio.
Name two steganography tools.
Steghide, OpenPuff.
What is the Sleuth Kit?
A set of forensic tools used to examine file systems and disk images.
What file systems are analyzed using Autopsy and Sleuth Kit?
NTFS, FAT, ExFAT, HFS+, ext3, ext4, UFS.
What is the importance of documenting the investigation process?
Ensures repeatability, preserves evidence authenticity, and supports court admissibility.
What does ‘Bagging and Tagging’ mean in forensics?
Labeling and securing physical evidence to maintain the chain of custody.
What is a Cluster in file systems?
The smallest logical storage unit composed of multiple sectors.
