Advanced digital forensics practice Flashcards
(19 cards)
What is forensic data carving
Identifying and recovering hidden or deleted files from digital media based on analysis of file formats
Where might a file be hidden
Lost clusters
Unallocated clusters
Slack space
List data hiding techniques
File manipulation
-file names
-hidden property
Disk manipulation
-hidden partitions
-bad clusters
Encryption
-Bit shifting
-Steganography
How do you hide partitions
Delete references to partition
-recreate links for access
Use disk-partitioning utilities
Account for all disk space when analysing a disk
How do you mark bad clusters
Place sensitive information on free space
Use disk editor to mark that space
How is the logical size of a file determined
By the files actual size
Measured in bytes
How is the physical size of a file determined
Number of sectors allocated to the file
Clustered into 4s, each cluster is 2048 bytes
What is bit shifting
An old technique used to shift patterns to alter byte values of data to make files look like executable code
How should you obtain the password needed to examine an encrypted file
Key escrow
Cracking password
-expert, powerful computers
Persuade suspect to reveal password
Dictionary attack
Brute force attack
Guess based on suspect profile
What could be contained by a graphics file
Digital photographs
3D images
Scanned replicas of printed pictures
What is data compression
Coding data from a larger to smaller form
What is lossless compression
Reduces file size without removing data
What is lossy compression
Permanently discards bits of information
How do you locate and recover graphics files
OS tools
-time consuming
-results difficult to verify
Computer forensics tools
-image headers
-reconstruct fragmented image files
How do you identify graphics file fragments
Carving/salvaging
-Recovers all file fragments
Computer forensics tools
-carve from slack/free space
-helps identify image file fragments and put them together
How do you reconstruct file fragments
Locate and export all clusters of fragmented file
Determine starting and ending clusters of each group of clusters
Copy each group of clusters to a recovery file in the proper sequence
Rebuild file header so file is readable in a graphics viewer
How does stenography hide data in image files
Insertion
-hidden data not displayed when host file is viewed
-can only hide a certain amount of data
Describe program execution artifact investigations
Identify when certain programs were executed/used, how often they were used and who accessed them
Can help determine information about deleted and uninstalled programs
Proof of existing data in a location that is no longer available and the last time program was launched
