Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

forensic computing > forensic computing final > Flashcards

forensic computing final Flashcards

(57 cards)

Start Studying
1
Q

What are the types of file systems mentioned?

A
  • NTFS
  • FAT
  • exFAT
  • EXT
  • HFS
  • HFS+
  • APFS

These file systems are used to organize and store data on storage devices.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is the purpose of file systems?

A

To organize and store data on storage services

They define how files are named, stored, and retrieved, and are applied when formatting a drive or partitioning it.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What does FAT stand for?

A

File Allocation Table

It is the original file system in Windows, with FAT32 being commonly used today.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is the maximum file size supported by FAT32?

A

4GB

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is exFAT commonly used for?

A

Large storage media, up to 256TB

It is often used in external devices like flash drives.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What does NTFS stand for?

A

New Technology File System

It is the default file system for Windows and supports large partition sizes and file sizes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What are some features of NTFS?

A
  • File permissions
  • Encryption
  • Compression
  • Journaling
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are Alternate Data Streams (ADS)?

A

Used in NTFS to store additional data with files

This can include metadata, malware, or other hidden data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is EXT in the context of file systems?

A

Extended File System

Versions include ext2, ext3, and ext4, with ext4 being the most modern.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What storage capacity does ext4 support?

A

1 exabyte (EB)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is the purpose of journaling in ext3 and ext4?

A

Helps protect against file corruption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is HFS+?

A

Apple’s file system used until 2017

It supports up to 8 exabytes of file size and volume size.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is APFS?

A

A newer file system introduced for SSDs

It supports 9 quintillion files.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What happens to files when they are deleted?

A

They are not fully removed; space is marked as available for overwriting.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is data carving?

A

Recovering deleted files from unallocated space on a disk.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is the impact of wear leveling in SSDs?

A

Ensures even usage of memory cells, making data recovery harder over time.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is the recommended action for forensic imaging of SSDs?

A

Should be done as soon as possible to avoid data being overwritten.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What does the Windows Registry store?

A

Configuration settings and options on Windows operating systems.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What information does the Windows Registry contain?

A
  • System hardware
  • Installed software
  • System settings
  • User preferences
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Why is analyzing the Windows Registry important?

A

It helps identify timelines for system usage and evidence of deleted or modified files.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What are some encryption tools mentioned?

A
  • BitLocker (Windows)
  • FileVault (Mac)
  • VeraCrypt
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is pre-boot authentication?

A

Prevents unauthorized access by requiring user authentication before the OS can boot.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What do full disk encryption tools ensure?

Study These Flashcards
A

The data on the entire disk is protected.

24
Q

What are advanced encryption algorithms used for?

Study These Flashcards
A

For high security in encryption tools.

25
What is a virtual machine (VM)?
Software implementations of physical machines that allow for running one OS within another.
26
What are the types of hypervisors?
* Type 1 (bare metal) * Type 2 (hosted)
27
What should forensic tools be evaluated on?
* Compatibility * Scripting support * Automation * Hashing capabilities
28
What are some forensic tools mentioned?
* Autopsy * Encase * FTK
29
What defines bitmap images?
Made up of pixels, with quality determined by resolution and color depth.
30
What are examples of bitmap images?
* JPEG * PNG * GIF * BMP
31
How do vector graphics differ from bitmap images?
Use mathematical formulas to describe shapes and lines, scalable without loss of quality.
32
What are examples of vector graphics?
* SVG * AI (Adobe Illustrator)
33
What is file compression?
* Lossless * Lossy
34
What is lossless compression?
Preserves the original file without losing data. ## Footnote Example: PNG
35
What is lossy compression?
Reduces file size by removing less important data. ## Footnote Example: JPEG
36
What is file carving?
Forensic technique to recover deleted files even when file system metadata is damaged or missing.
37
What does EXIF metadata store?
* Camera settings * Timestamp * GPS location
38
What forensic tools can extract EXIF metadata?
* ExifReader * Magnet AXIOM
39
What is steganography?
Practice of hiding information within files to avoid detection.
40
What is steganalysis?
Refers to detecting and analyzing hidden data.
41
What is digital watermarking?
Used to embed copyright information within images to identify the owner or source.
42
What are examples of hashing algorithms?
* MD5 * SHA-1
43
Why is hashing important in forensic computing?
Crucial for verifying the integrity of evidence and ensuring that no data has been altered during the forensic process.
44
What is the effect of changing file extensions?
Alters the extension to mislead forensic tools.
45
What is partition hiding?
Using tools like diskpart or EaseUS to hide partitions.
46
What does bit-shifting do?
Changes the order of binary data to obscure it.
47
What are live acquisitions?
Capture volatile data from a running system such as RAM, process lists, or active network connections.
48
What tools are used for live acquisitions?
* FTK Imager * Memoryze * Belkasoft
49
What are the steps for live acquisition?
* Capture RAM * Log actions * Ensure hash integrity of all files recovered
50
What does network forensics involve?
Analyzing network traffic to detect intrusions or monitor suspicious activity.
51
What are packet analyzers used for?
Capture and decode network packets to analyze network behavior. ## Footnote Examples: Wireshark, tcpdump
52
What is a Type 1 hypervisor?
Runs directly on physical hardware. ## Footnote Example: VMware vSphere
53
What is a Type 2 hypervisor?
Runs on top of an OS. ## Footnote Example: VirtualBox
54
What should investigators acquire for VM forensics?
Forensic images of both the host and guest VMs.
55
What are snapshots used for in VM forensics?
Capturing the state of a VM at a given point in time.
56
What is Defense in Depth (DiD)?
A strategy involving multiple layers of security to protect data.
57
What do investigators analyze to detect network intrusions?
Logs and network traffic.

forensic computing (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions