Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

SOC Analyst HackTheBox Academy Path > Introduction to Digital Forensics > Flashcards

Introduction to Digital Forensics Flashcards

(58 cards)

Start Studying
1
Q

What is Digital Forensics?

A

A specialized branch of cybersecurity that involves the collection, preservation, analysis, & presentation of digital evidence to investigate cyber incidents, criminal activities, and security breaches. It applies forensic techniques to digital artifacts to uncover the truth behind cyber-related events.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is the aim of digital forensics?

A

To reconstruct timelines, identify malicious activities, assess the impact of incidents, and provide evidence for legal or regulatory proceedings.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Where is electronic evidence collected from and what is collected?

A

Electronic evidence is collected from computers, mobile devices, servers, cloud services, and other digital sources. And the evidence can include files, emails, logs, databases, network traffic, and more.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Preservation of Evidence

A

Ensuring the integrity and authenticity of digital evidence is crucial.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Stages in the Forensic Process

A
  • Identification
  • Collection
  • Examination
  • Analysis
  • Presentation
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Forensic Process: Identification

A

Determining potential sources of evidence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Forensic Process: Collection

A

Gathering data using forensically sound methods

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Forensic Process: Examination

A

Analyzing the collected data for relevant information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Forensic Process: Analysis

A

Interpreting the data to draw conclusions about the incident

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Forensic Process: Presentation

A

Presenting findings in a clear and comprehensible manner

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Types of Cases

A
  • Cybercrime investigations (hacking, fraud, data theft)
  • Intellectual property theft
  • Employee misconduct investigations
  • Data breaches and incidents affecting organizations
  • Litigation support in legal proceedings
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Basic steps for performing a forensic investigation

A
  1. Create a Forensic Image
  2. Document the System’s State
  3. Identify and Preserve Evidence
  4. Analyze the Evidence
  5. Timeline Analysis
  6. Identify Indicators of Compromise (IOCs)
  7. Report and Documentation
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

New Technology File System (NTFS)

A

A proprietary file system developed by Microsoft

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Predecessor of NTFS

A

File Allocation Table (FAT)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What File Metada is stored in NTFS

A

Creation time, modification time, & attribute information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Master File Table (MFT)

A

A crucial component of NTFS that stores metadata for all files and directories on a volume. When files are deleted, their MFT entries are marked as available, but the data may remain on the disk untiil overwritten.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What do MFT Entries provide during examination?

A

Insights into file names, sizes, timestamps, and data storage locations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Unallocated Space on an NTFS volume

A

May contain remnants of deleted files or fragments of data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

File slack

A

The unused portion of a cluster that may contain data from a previous file

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

File Signatures

A

Useful, along with file headers, in identifying file types.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Update Sequence Number (USN) Journal

A

A log maintained by NTFS to record changes made to files and directories

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

LNK Files

A

Windows shortcut files (LNK files) contain information about the target file or program, as well as timestamps and metdata

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Prefetch Files

A

Generated by Windows to improve the startup performance of applications. Can indicate which programs have been run on the system & when they were last executed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Registry Hives

Study These Flashcards
A

Contain important configuration and system information. Malicious activities or unauthorized changes can leave traces in the registry. Not directly related to the file system

25
Shellbags
Registry entries that store folder view settings. Can reveal user navigation patterns and potentially identify accessed folders
26
Thumbnail Cache
Store miniature previews of images & documents. Can reveal files that were recently viewed, even if the original files have been deleted
27
Recycle Bin
Contains files that have been deleted from the file system
28
Alternate Data Streams (ADS)
Additional streams of data associated with files. Malicious actors may use ADS to hide data
29
Volume Shadow Copies
Snapshots of the file system at different points in time. Supported by NTFS
30
Secruity Descriptors and Access Control Lists (ACLs)
Determine file & folder permissions. Analyzing artifacts helps understand user access rights and potential security breaches
31
Default File Path for Log Storage
C:\Windows\System32\winevt\logs
32
Windows execution artifacts
Traces & evidence left behind on a Windows OS when programs & processes are executed.
33
Windows Execution Artifact: Prefetch Files
Windows maintains prefetch folder that contains metadat about the execution of various applications. Prefetch files can reveal a history of executed programs & the order in which they were run C:\Windows\Prefetch
34
Windows Execution Artifact: Shimcache
Windows mechanism that logs information about program execution to assist with compatibility and performance optimizations. Can help identify recently executed programs & their associated files. Registry:HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache
35
Windows Execution Artifact: Amcache
A database introduced in Windows 8 that stores info about installed applications and executables. Can provide insights into program execution history & identify potentially suspicious or unauthorized software C:\Windows\AppCompat\Programs\Amcache.hve (Binary Registry Hive)
36
Windows Execution Artifact: UserAssist
A registry key that maintains info about programs executed by users Registry:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurentVersion\Explorer\UserAssist
37
Windows Execution Artifact: RunMRU Lists
RunMRU (Most Recently Used) lists in Windows Registry store info about recently executed programs from various locations. Can indicate which programs were run, when they were executed, & potentially reveal user activity Registry:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU
38
Windows Execution Artifact: Jump Lists
Store info about recently accessed files, folders, & tasks associated with specific applications. User-specific folders (e.g., %AppData%\Microsoft\Windows\Recent)
39
Windows Execution Artifact: Shortcut (LNK) Files
Can contain info about the target executable, file paths, timestamps, & user interactions Various locations (e.g., Desktop, Start Menu)
40
Windows Execution Artifact: Recent Items
Folder that maintains a list of recently opened files User-specific folders (e.g., %AppData%\Microsoft\Windows\Recent)
41
Windows Execution Artifact: Windows Event Logs
Record events related to program execution, application crashes, & more C:\Windows\System32\winevt\Logs
42
Windows Persistence
The techniques & mechanisms used by attackers to ensure their unauthorized presence & control over a compromised system, allowing them to maintain access & control even after initial intrusion
43
Windows Registry
Acts as a crucial database, storing critical system settings for the Windows OS
44
What are some Autorun keys used for persistence?
- Run/RunOnce Keys - Keys used by WinLogon Process - Startup Keys
45
Scheduled Tasks (Schtasks)
- saved as XML file, details creator, task's timing/trigger, & path to command/program set to run - C:\Windows\System32\Tasks
46
Services in Windows
Pivotal for maintaining processes on a system, enabling software components to operate in background w/o user intervention HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services
47
Web Browser: Cookies
Small data files stored by websites on a user's device, containing info such as session details, preferences, & authentication tokens
48
Web Browser: Cache
Cached copies of web pages, images, & other content visited by the user. Can reveal websites even if the history is cleared
49
Web Browser: Session Data
Info about active browsing sessions, tabs, & windows
50
Web Browser: Typed URLs
URLs entered directly into the address bar
51
Web Browser: Favicons
Small icons associated w/ websites, which can reveal visited sites
52
System Resource Usage Monitor (SRUM)
Meticulously tracks resource utilization and application usage patterns. Data is housed in database file sru.db in C:\Windows\System32\sru. Can help reconstruct application & resource usage over specific durations
53
SRUM: Application Profiling
Provides comprehensive view of applications & processes that have been executed on a Windows system. Crucial for understanding software landscape on a system, identifying potentially malicious or unauthorized applications, & reconstructing user activities
54
SRUM: Resource Consumption
Captures data on CPU time, network usage, & memory consumption for each application & process.
55
SRUM: Timeline Reconstruction
Can create timelines of application & process execution, resource usage, & system activities by analyzing SRUM data
56
SRUM: User & System Context
Includes user identifiers, helps attribute activities to specific users
57
SRUM: Malware Analysis & Detection
Used to identify unusual or unauthorized applications taht may be indicative of malware or malicious activities
58

SOC Analyst HackTheBox Academy Path (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions