Digital Forensics Flashcards
(27 cards)
What is Digital Forensics?
The process of applying computer science to investigate cybercrime by identifying and extracting digital evidence.
What is Cybercrime?
Crime involving the use of a computer system or network.
What is Cyber-dependent crime?
Crime carried out solely using technology, e.g., hacking.
What is Cyber-enabled crime?
Traditional crimes enhanced by technology, e.g., fraud or theft.
What are the three phases of forensic investigation?
Pre-investigation, Investigation, Post-investigation.
What is Steganography?
The art of hiding information within other non-secret text or data.
How is Steganography different from Cryptography?
Cryptography obscures meaning; steganography hides the existence of the message.
What is the Chain of Custody?
The documented process that tracks the collection, transfer, and storage of evidence.
What are Volatile Data examples?
Data lost after shutdown: RAM contents, running processes.
What are Non-volatile Data examples?
Data retained after shutdown: files on hard disks, system logs.
What is a Write Blocker?
A tool that allows read-only access to storage media to prevent modification.
What is a Hash Value?
A numeric value that uniquely identifies data, ensuring evidence integrity.
What are Live and Dead Acquisition?
Live: collecting data from a running system; Dead: collecting from a powered-off system.
What is Bit-stream Imaging?
A bit-by-bit copy of an entire storage device.
What is Slack Space?
Unused space within a disk cluster after a file is stored.
What is a Lost Cluster?
A cluster marked used but not linked to any file.
What is the File Allocation Table (FAT)?
A file system used with DOS and early Windows versions.
What is NTFS?
New Technology File System, standard for modern Windows systems.
Name a forensic imaging tool.
AccessData FTK Imager.
What are the ACPO Principles?
Guidelines ensuring proper handling of digital evidence.
What are examples of digital forensic tools?
Autopsy, Sleuth Kit, EnCase.
What is an SSD?
A Solid-State Drive, faster than HDDs because it has no moving parts.
What is the importance of documenting a crime scene?
To preserve the integrity and authenticity of evidence.
What does Data Acquisition mean?
Extracting electronically stored information from devices for investigation.
