Assignment: Review Questions
Part 1
1. Describe the physical structure of a USB flash drive.
2. Describe the physical specifications of a Blu-ray disc.
3. Discuss the uses of flash memory cards.
4. Describe the three sizes of floppy disks and their storage capacities.
5. For what purpose are magnetic tapes most often used, and what feature makes them ideal for this -purpose?
Part 2
1. What kinds of nonvolatile information can an investigator get from a system?
2. What is the difference between static analysis and dynamic analysis of an executable file?
3. What kinds of volatile information can an investigator get from a system?
4. What is an MRU list?
5. What is metadata and how is it used in Windows files?
6. Why is it important for an investigator to capture volatile information first during an investigation?
7. What is the purpose of a browser cache?
8. What is the function of a network sniffer?
9. Describe the MD5 algorithm.
10. What are cookies?
Part 3
1. Describe the Kerberos authentication method.
2. Describe the structure of the event log header.
3. Describe the functions of the Cain & Abel tools.
4. Which fields are included in the IIS logs for a Web site but not for an FTP site?
5. What types of event logs do domain controllers have that other systems do not?
Part 4
1. What is the Farmer's Boot CD?
2. What are some precautions to take during an investigation?
3. What is keyword searching?
4. List the tools included in the Penguin Sleuth Kit.
5. List some Linux forensic tools.
Part 5
1. What is a default password database?
2. Differentiate between syllable, rule-based, and hybrid password attacks.
3. How is password-cracking software classified?
4. How does a password cracker work?
5. Why is a rule-based attack considered more powerful than other password-cracking methods?
6. How is security provided for the connection between devices and wireless access points?
7. What is the difference between active wireless scanning and passive wireless scanning?
8. How can an attacker hijack wireless network traffic?
9. How do electronic emanations help an attacker access a wireless network?
10. Describe what should be included in a report for a forensic investigation involving a wireless network.
Part 6
1. Explain the least-significant-bit method of steganography
2. Name two technical methods used to embed messages in a text file
3. Name two legal uses for steganography
4. Name the three main types of steganography.
5. How is steganography used with audio files?
6. How is steganography different from cryptography?
7. Define steganography
8. What is a watermark?
9. Explain the process of echo data hiding
10. What is a cover medium?
11. Explain the process of echo data hiding
12. Name two technical methods used to embed messages in a text file
13. How is steganography different from cryptography?
14. Name the three main types of steganography.
15. Explain the least-significant-bit method of steganography
16. What is a cover medium?
17. Define steganography
18. How is steganography used with audio files?
19. Name two legal uses for steganography
20. What is a watermark?
Part 7
1. What are the methods investigators use to acquire digital evidence?
2. Write down the hardware tools used for data acquisition
3. What file systems does dd work with?
4. Why is there a need for data duplication?
5. What are the system requirements for Drive SnapShot?
Part 8
1. Which tool would you use to recover lost partitions? Why?
2. How can you delete a partition using the command line?
3. Explain the following:
i. Damaged or deleted INFO2 file
ii. Damaged Recycled folder
4. How does the Recycle Bin work in Windows?
5. Which tools recover deleted files in Linux?
6. How does file compression work?
7. Name three image file formats and name whether each is vector, raster, or both.
8. Describe two main differences between the LZW and Huffman coding systems.
9. Name a steganalysis tool and describe how it works.
10. How do you reconstruct file fragments?
Format your assignment according to the following formatting requirements:
1. The answer should be typed, double spaced, using Times New Roman font (size 12), with one-inch margins on all sides.
2. The response also includes a cover page containing the title of the assignment, the student's name, the course title, and the date. The cover page is not included in the required page length.
3. Also include a reference page. The Citations and references should follow APA format. The reference page is not included in the required page length.