What term describes data about information such as disk partition structures and file tables?
What term describes data about information, such as disk partition structures and file tables? Metadata.
What is a partition gap and how might it be used to hide data?
Knowing what partition is, partition gap refers to the unused space between partitions. It is also “Inter-partition space” which can be used to hide data on a hard disk. In this case a disk editor utility is used to access the hidden data in the partition gap.
What term is used to describe a disk’s logical structure of platters tracks and sectors?
What term below describes a column of tracks on two or more disk platters? What term is used to describe a disk’s logical structure of platters, tracks, and sectors? Geomerty. A Master Boot Record (MBR) partition table marks the first partition starting at what offset?
What program serves as the GUI front end for accessing sleuth kit’s tools?
Autopsy® is an easy to use, GUI-based program that allows you to efficiently analyze hard drives and smart phones.
Is a column of tracks on two or more disk platters?
* Cylinders—A cylinder is a column of tracks on two or more disk platters. Typically, each platter has two surfaces: top and bottom.
What is the space on a drive called when a file is deleted choose all that apply?
Disk spaces The file which is deleted remains in the drive. The areas of the disk where the deleted files reside are called unallocated disk space. This space is free for the new files to write.
How many clusters does it require to store a 6 KB file?
The 6-KB file will consume clusters 3, 4, and 5. Now suppose you write another 4-KB file to the hard disk. The hard disk will look for the next available cluster, which is number 6.
Whats the most critical aspect of digital evidence?
Chapters 1-7
| Question | Answer |
|---|---|
| 17. What is the most critical aspect of computer evidence? | validation |
| 18. What is a hashing algorithm? | A program designed to create a binary or hexadecimal number that represents the uniqueness of a data set, file, or entire disk |
What is the biggest concern when acquiring data from a RAID server?
What are two concerns when acquiring data from a RAID server? 1) amount of data storage needed. 2) the type of RAID server (0, 1, 5, etc.) 3) whether your acquisition tool can handle RAID acquisitions.
What is the main goal of static acquisition?
Your goal when acquiring data for a static acquisition is to preserve the digital evidence. Many times, you have only one chance to create a reliable copy of disk evidence with a data acquisition tool.
What is COC chain of custody and why is it important for evidence integrity?
The chain of custody is the most critical process of evidence documentation. It is a must to assure the court of law that the evidence is authentic, i.e., it is the same evidence seized at the crime scene. It was, at all times, in the custody of a person designated to handle it and for which it was never unaccounted.
What should you consider when determining which data acquisition method to use?
To determine the appropriate acquisition method, the investigator must consider the following:
- The size of the source disk.
- Can you retain the source disk as an evident or must you return it to the owner?
- Time to do perform the acquisition.
- Location of the evidence.
How do you acquire data?
There are four methods of acquiring data: collecting new data; converting/transforming legacy data; sharing/exchanging data; and purchasing data. This includes automated collection (e.g., of sensor-derived data), the manual recording of empirical observations, and obtaining existing data from other sources.
What is live acquisition method?
A “live” acquisition is where data is retrieved from a digital device directly via its normal interface; for example, switching a computer on and running programs from within the operating system.
What is sparse or logical acquisition method?
Sparse acquisition is similar to logical acquisition. Through this method, investigators can collect fragments of unallocated (deleted) data. This method is very useful when it is not necessary to inspect the entire drive.
What could be the importance of performing live acquisitions?
Live acquisitions are done on scene if the computers password/passphrase is available. One of the benefits of doing a live acquisition is when an encrypted drive that is readable only when the computer is powered on or a computer that is accessible only over a network.
What is a sparse acquisition?
sparse acquisition. Like logical acquisitions, this data acquisition method captures only specific files of interest to the case, but it also collects fragments of unallocated (deleted) data. See also logical acquisition.
What is a static acquisition?
Static data acquisition refers to the process of extracting and gathering the unaltered data from storage media. Sources of non-volatile data include hard drives, DVD-ROMs, USB drives, flash cards, smart-phones, external hard drives, etc.
What is the difference between live and static evidence?
Static analysis is a traditional approach in which system is analyzed forensically after taking the memory dump and shut- ting down the system, while on the other hand in live digital forensic analysis the evidentiary data is gathered, analyzed and is presented by using different kind of forensic tools, and the victim …
What is live and static evidence?
Abstract: Traditional digital forensics is performed through static analysis of data preserved on permanent storage media. Live analysis uses running system to obtain volatile data for deeper understanding of events going on. Sampling running system might irreversibly change its state making collected evidence invalid.
What type of acquisition is used for most remote acquisitions?
Most remote acquisition is live acquisition not static acquisition.
What is a logical acquisition?
The logical acquisition is a bit-by-bit copy of a given logical storage, (the storage may refer to user data partition as well as system data partition), and this acquisition method produces, in general, a relatively manageable file which can be analyzed and parsed by forensic tools.