Many password recovery tools have a feature for generating potential lists for a ___

Growing use of mobile handheld devices, such as cell phones and PDA does provide productivity benefits but they also pose new security risks. Due to continued growth of processing power and ever evolving ubiquitous functionality of these devices, they are also being used for lots of criminal activities too. This poses great challenges for investigators and law enforcement officials all over the world. The use of mobile phones in criminal activities has led to the need of recovering the data in them. The acquisition of information derived from cellular devices can be used as forensic evidence which has become a prime component of crime scene investigations. Digital evidence, like any other type of evidence, requires identification, collection, a chain of custody, examination/analysis, and finally authentication in court during presentation to the trier of fact. Forensic hashing is used for identification, verification and authentication of data and provide forensic examiner with the ability to verify the integrity of acquired data. This paper focuses on use of cryptographic hashing in mobile forensics and discusses the current challenges. Additional experiments were carried out to validate compared known hash values with reported values for data objects populated onto mobile devices using various data transmission methods. KEYWORDS: Mobile forensics, Digital evidence, Hashing, MD5, SHA1.

Inhaltsverzeichnis Show

Related Papers
Chapter 6-13 multiple choice
Where do software forensics tools copy data from a suspect's disk drive?
What type of tool can be used to compare results and verify a new tool by viewing data in its raw format?
What is the first task in digital forensics investigations?
What two data copying methods are used in software data acquisitions?

Providing the ability to any law enforcement officer to remotely transfer an image from any suspect computer directly to a forensic laboratory for analysis, can only help to greatly reduce the time wasted by forensic investigators in conducting on-site collection of computer equipment. RAFT (Remote Acquisition Forensic Tool) is a system designed to facilitate forensic investigators by remotely gathering digital evidence. This is achieved through the implementation of a secure, verifiable client/server imaging architecture. The RAFT system is designed to be relatively easy to use, requiring minimal technical knowledge on behalf of the user. One of the key focuses of RAFT is to ensure that the evidence it gathers remotely is court admissible. This is achieved by ensuring that the image taken using RAFT is verified to be identical to the original evidence on a suspect computer.

The extraordinary development of mobile communications is a source of new security challenges. Today, mobile phones have become ubiquitous in nature involving their use in many daily activities, and sometimes those activities might be criminal in nature. The remarkable advancements in the technology and increase in computing power of these devices over last few years, has led to an increase of their functionality while keeping the size of such devices small enough to fit in a pocket. The use of mobile phones in criminal activities has led to the need of recovering the digital evidence data in them for the further investigations. It is therefore essential for investigators to be able to extract digital evidence quickly and accurately. The digital forensic examiner must know how to preserve and acquire digital evidence effectively from mobile devices. This paper provides an overview of digital evidence preservation issues, relevant solutions for digital forensics examiners, and tips for successful preservation of digital evidence on mobile devices.

Forensic science is the application of science relates to the criminal investigation by a court of law. Cyber forensic is a branch of forensic science technology. The digital media are used to perform cybercrime as a target or source. The investigation of such type of crime is carried out by using thedigital storage media which used in this crime such as hard disk, pen drive, CD or DVD etc. In this paper, we use the different forensic tool to createa forensic image of the hard disk for further analysis in digital crime investigation, which result in same MD5 hash value. Here we also describe the importance of forensic image in the process of investigation of digital crimes.

Digital Forensics is an area of Forensics Science that uses the application of scientific method toward crime investigation. The thwarting of forensic evidence is known as anti-forensics, the aim of which is ambiguous in the sense that it could be bad or good. The aim of this project is to simulate digital crimes scenario and carry out forensic and anti-forensic analysis to enhance security. This project uses several forensics and anti-forensic tools and techniques to carry out this work. The data analyzed were gotten from result of the simulation. The results reveal that although it might be difficult to investigate digital crime but with the help of sophisticated forensic tools/antiforensics tools it can be accomplished.

focusNode

Didn't know it?
click below

Knew it?
click below

Embed Code - If you would like this activity on your web page, copy the script below and paste it into your web page.

Normal Size Small Size show me how

Chapter 6-13 multiple choice

Question	Answer
Data streams can obscure valuable evidentiary data, intentionally or by coincidence	true
A ____ is a column of tracks on two or more disk platters.	cylinder
____ is how most manufacturers deal with a platter’s inner tracks being shorter than its outer tracks.	ZBR
____ is the file structure database that Microsoft originally designed for floppy disks.	FAT
____ was introduced when Microsoft created Windows NT and is the primary file system for Windows Vista	NTFS
On an NTFS disk, immediately after the Partition Boot Sector is the ____.	MFT
Records in the MFT are referred to as ____.	metadata
In the NTFS MFT, all files and folders are stored in separate records of ____ bytes each	1024
The file or folder’s MFT record provides cluster addresses where the file is stored on the drive’s partition. These cluster addresses are referred to as ____.	data runs
When Microsoft introduced Windows 2000, it added built-in encryption to NTFS called ____.	EFS
The purpose of the ____ is to provide a mechanism for recovering encrypted files under EFS if there’s a problem with the user’s original private key.	recovery certificate
When Microsoft created Windows 95, it consolidated initialization (.ini) files into the ____.	Registry
____ is a 16-bit real-mode program that queries the system for device and configuration data, and then passes its findings to NTLDR.	NTDetect.com
____, located in the root folder of the system partition, is the device driver that allows the OS to communicate with SCSI or ATA drives that aren’t related to the BIOS.	NTBootdd.sys
____ contain instructions for the OS for hardware devices, such as the keyboard, mouse, and video card, and are stored in the %system-root%\Windows\System32\Drivers folder.	Device drivers
____ is a hidden text file containing startup options for Windows 9x.	Msdos.sys
The ____ file provides a command prompt when booting to MS-DOS mode (DPMI).	Command.com
____ is a text file containing commands that typically run only at system startup to enhance the computer’s DOS configuration.	Config.sys
____ is a batch file containing customized settings for MS-DOS that runs automatically.	Autoexec.bat
A ____ allows you to create a representation of another computer on an existing physical computer.	virtual machine
In software acquisition, there are three types of data-copying methods.	false
To help determine what computer forensics tool to purchase, a comparison table of functions, subfunctions, and vendor products is useful.	true
The Windows platforms have long been the primary command-line interface OSs.	false
After retrieving and examining evidence data with one tool, you should verify your results by performing the same tasks with other similar forensics tools.	true
Computer forensics tools are divided into ____ major categories.	2
Software forensics tools are commonly used to copy data from a suspect’s disk drive to a(n) ____.	image file
To make a disk acquisition with En.exe requires only a PC running ____ with a 12-volt power connector and an IDE, a SATA, or a SCSI connector cable.	ms-dos
Raw data is a direct copy of a disk drive. An example of a Raw image is output from the UNIX/Linux ____ command.	dd
____ of data involves sorting and searching through all investigation data.	Discrimination
Many password recovery tools have a feature that allows generating potential lists for a ____ attack.	password dictionary
The simplest method of duplicating a disk drive is using a tool that does a direct ____ copy from the original disk to the target disk.	disk-to-disk
To complete a forensic disk analysis and examination, you need to create a ____.	report
The first tools that analyzed and extracted data from floppy disks and hard disks were MS-DOS tools for ____ PC file systems.	IBM
In Windows 2000 and XP, the ____ command shows you the owner of a file if you have multiple users on the system or network.	Dir
In general, forensics workstations can be divided into ____ categories.	3
A forensics workstation consisting of a laptop computer with a built-in LCD monitor and almost as many bays and peripherals as a stationary workstation is also known as a ____.	portable workstation
____ is a simple drive-imaging station.	FIRE IDE
____ can be software or hardware and are used to protect evidence disks by preventing you from writing any data to the evidence disk.	Write-blockers
Many vendors have developed write-blocking devices that connect to a computer through FireWire,____ 2.0,and SCSI controllers.	USB
The ____ publishes articles, provides tools, and creates procedures for testing and validating computer forensics software.	NIST
The standards document, ____, demands accuracy for all aspects of the testing process, meaning that the results must be repeatable and reproducible.	ISO 5725
The NIST project that has as a goal to collect all known hash values for commercial software applications and OS files is ____.	NSRL
The primary hash algorithm used by the NSRL project is ____.	SHA-1
One way to compare your results and verify your new forensic tool is by using a ____, such as HexWorkshop, or WinHex.	disk editor
Although a disk editor gives you the most flexibility in ____, it might not be capable of examining a ____ file’s contents	testing, compressed
Macintosh OS X is built on a core called ____.	Darwin
In older Mac OSs, a file consists of two parts: a data fork, where data is stored, and a ____ fork, where file metadata and application information are stored.	resource
The maximum number of allocation blocks per volume that File Manager can access on a Mac OS system is ____.	65,535
On older Macintosh OSs all information about the volume is stored in the ____.	Master Directory Block (MDB)
With Mac OSs, a system application called ____ tracks each block on a volume to determine which blocks are in use and which ones are available to receive data.	Volume Bitmap
On Mac OSs, File Manager uses the ____ to store any information not in the MDB or Volume Control Block (VCB).	extents overflow file
Linux is probably the most consistent UNIX-like OS because the Linux kernel is regulated under the ____ agreement.	GPL
The standard Linux file system is ____.	Ext2fs
Ext2fs can support disks as large as ____ TB and files as large as 2 GB.	4
Linux is unique in that it uses ____, or information nodes, that contain descriptive information about each file or directory.	inodes
To find deleted files during a forensic investigation on a Linux computer, you search for inodes that contain some data and have a link count of ____.	0
____ components define the file system on UNIX.	4
The final component in the UNIX and Linux file system is a(n) ____, which is where directories and files are stored on a disk drive.	data block
LILO uses a configuration file named ____ located in the /Etc directory.	Lilo.conf
Erich Boleyn created GRUB in ____ to deal with multiboot processes and a variety of OSs.	1995
On a Linux computer, ____ is the path for the first partition on the primary master IDE disk drive.	/dev/hda1
There are ____ tracks available for the program area on a CD.	99
The ____ provides several software drivers that allow communication between the OS and the SCSI component.	Advanced SCSI Programming Interface (ASPI)
All Advanced Technology Attachment (ATA) drives from ATA-33 through ATA-133 IDE and EIDE disk drives use the standard ____ ribbon or shielded cable.	40-pin
ATA-66,ATA-____, and ATA-133 can use the newer 40-pin/80-wire cable.	100
IDE ATA controller on an old 486 PC doesn’t recognize disk drives larger than 8.4 ____.	GB
FTK cannot analyze data from image files from other vendors.	false
A nonsteganographic graphics file has a different size than an identical steganographic graphics file.	false
____ increases the time and resources needed to extract,analyze,and present evidence.	scope creep
You begin any computer forensics case by creating a(n) ____.	investigation plan
In civil and criminal cases, the scope is often defined by search warrants or ____, which specify what data you can recover.	subpoenas
There are ____ searching options for keywords which FTK offers.	2
____ search can locate items such as text hidden in unallocated space that might not turn up in an indexed search.	Live
The ____ search feature allows you to look for words with extensions such as “ing,”“ed,” and so forth.	stemming
In FTK ____ search mode, you can also look for files that were accessed or changed during a certain time period.	indexed
FTK and other computer forensics programs use ____ to tag and document digital evidence.	bookmarks
Getting a hash value with a ____ is much faster and easier than with a(n) ____.	hexadecimal editor, computer forensics tool
AccessData ____ compares known file hash values to files on your evidence drive or image files to see whether they contain suspicious data.	KFF
Data ____ involves changing or manipulating a file to conceal information.	hiding
One way to hide partitions is to create a partition on a disk, and then use a disk editor such as ____ to manually delete any reference to it.	Norton DiskEdit
Marking bad clusters data-hiding technique is more common with ____ file systems.	FAT
The term ____ comes from the Greek word for“hidden writing.”	steganography
____ is defined as the art and science of hiding messages in such a way that only the intended recipient knows the message is there.	Steganography
Many commercial encryption programs use a technology called ____, which is designed to recover encrypted data if users forget their passphrases or if the user key is corrupted after a system data failure.	key escrow
People who want to hide data can also use advanced encryption programs, such as PGP or ____.	BestCrypt
____ recovery is a fairly easy task in computer forensic analysis.	Password
____ attacks use every possible letter, number, and character found on a keyboard when cracking a password.	Brute-force
____ are handy when you need to image the drive of a computer far away from your location or when you don’t want a suspect to be aware of an ongoing investigation.	Remote acquisitions
____ is a remote access program for communication between two computers. The connection is established by using the DiskExplorer program (FAT or NTFS) corresponding to the suspect (remote) computer’s file system.	HDHOST
With many computer forensics tools, you can open files with external viewers.	true
Steganography cannot be used with file formats other than image files.	false
____ are based on mathematical instructions that define lines, curves, text, ovals, and other geometric shapes.	Vector graphics
You use ____ to create, modify, and save bitmap, vector, and metafile graphics files.	graphics editors
____ images store graphics information as grids of individual pixels.	Bitmap
The process of converting raw picture data to another format is referred to as ____.	demosaicing
The majority of digital cameras use the ____ format to store digital pictures	EXIF
____ compression compresses data by permanently discarding bits of information in the file.	Lossy
Recovering pieces of a file is called ____.	carving
A(n) ____ file has a hexadecimal header value of FF D8 FF E0 00 10.	JPEG
If you can’t open an image file in an image viewer, the next step is to examine the file’s ____.	header data
The uppercase letter ____ has a hexadecimal value of 41.	"A"
The image format XIF is derived from the more common ____ file format.	TIFF
The simplest way to access a file header is to use a(n) ____ editor	hexadecimal
The ____ header starts with hexadecimal 49 49 2A and has an offset of four bytes of 5C01 0000 2065 5874 656E 6465 6420 03.	XIF
____ is the art of hiding information inside image files.	Steganography
____ steganography places data from the secret file into the host file without displaying the secret data when you view the host file in its associated program.	Insertion
____ steganography replaces bits of the host file with other bits of data.	Substitution
In the following list, ____ is the only steg tool.	Outguess
____ has also been used to protect copyrighted material by inserting digital watermarks into a file.	Steganography
When working with image files, computer investigators also need to be aware of ____ laws to guard against copyright violations.	copyright
Under copyright laws, computer programs may be registered as ____.	literary works
Under copyright laws, maps and architectural plans may be registered as ____.	pictorial, graphic, and sculptural works
A graphics program creates and saves one of three types of image files: bitmap, vector, or ____________________.	metafile
____________________ is the process of coding of data from a larger form to a smaller form.	Data compression
The ____________________ is the best source for learning more about file formats and their associated extensions.	internet
All ____________________ files start at position zero (offset 0 is the first byte of a file) with hexadecimal 49 49 2A.	TIFF
The two major forms of steganography are ____________________ and substitution.	insertion
____ can help you determine whether a network is truly under attack or a user has inadvertently installed an untested patch or custom program.	Network forensics
____ forensics is the systematic tracking of incoming and outgoing traffic on your network.	Network
A common way of examining network traffic is by running the ____ program.	Tcpdump
____ is a popular network intrusion detection system that performs packet capture and analysis in real time.	Snort
____ is the U.S. DoD computer forensics lab’s version of the dd command that comes with Knoppix-STD.	dcfldd
____ are devices and/or software placed on a network to monitor traffic.	Packet sniffers
Most packet sniffers operate on layer 2 or ____ of the OSI model.	3
____ is the text version of Ethereal, a packet sniffer tool.	Tethereal
The ____ Project was developed to make information widely available in an attempt to thwart Internet and network hackers.	Honeynet
Machines used on a DDoS are known as ____ simply because they have unwittingly become part of the attack.	zombies
E-mail messages are distributed from one central server to many connected client computers, a configuration called ____.	client/server architecture
With many ____ e-mail programs, you can copy an e-mail message by dragging the message to a storage medium, such as a folder or disk.	GUI
When working on a Windows environment you can press ____ to copy the selected text to the clipboard.	Ctrl+C
To retrieve an Outlook Express e-mail header right-click the message, and then click ____ to open a dialog box showing general information about the message.	Properties
In Microsoft Outlook, you can save sent, drafted, deleted, and received e-mails in a file with a file extension of ____.	.pst
____ is a comprehensive Web site that has options for searching for a suspect, including by e-mail address, phone numbers, and names.	www.freeality.com
____ contains configuration information for Sendmail, allowing the investigator to determine where the log files reside.	/etc/sendmail.cf
Typically, UNIX installations are set to store logs such as maillog in the ____ directory.	/var/log
In Exchange, to prevent loss of data from the last backup, a ____ file or marker is inserted in the transaction log to mark the last point at which the database was written to disk.	checkpoint
The Novell e-mail server software is called ____.	GroupWise
Developed during WWII, this technology,____, was patented by Qualcomm after the war.	CDMA
The ____ digital network divides a radio frequency into time slots.	TDMA
TDMA refers to the ____ standard, which introduced sleep mode to enhance battery life.	IS-136
Typically, phones store system data in ____, which enables service providers to reprogram phones without having to physically access memory chips.	EEPROM
____ cards are found most commonly in GSM devices and consist of a microprocessor and from 16 KB to 4 MB of EEPROM.	SIM
____ can still be found as separate devices from mobile phones. Most users carry them instead of a laptop to keep track of appointments, deadlines, address books, and so forth.	PDAs
The file system for a SIM card is a ____ structure.	hierarchical
The SIM file structure begins with the root of the system (____).	MF
Paraben Software is a leader in mobile forensics software and offers several tools, including ____, which can be used to acquire data from a variety of phone models.	Device Seizure
In a Windows environment, BitPim stores files in ____ by default.	My Documents\BitPim

Where do software forensics tools copy data from a suspect's disk drive?

Chapter 6-13 multiple choice.

What type of tool can be used to compare results and verify a new tool by viewing data in its raw format?

Which type of tool can be used to compare results and verify a new tool by viewing data in its raw format? Command-line disk acquisition tool from New Technologies, Inc.

What is the first task in digital forensics investigations?

Step 1: Identification. In this very first step, all potential sources of evidence that are capable of storing digital information are identified such as computers, phones, hard drives, pen drives, etc. Forensic experts then identify which of these devices require analysis to meet case objectives.

What two data copying methods are used in software data acquisitions?

Two types of data-copying methods are used in software acquisitions: Physical copying of the entire drive. Logical copying of a disk partition.

Many password recovery tools have a feature for generating potential lists for a ____ attack.

Chapter 6-13 multiple choice

Where do software forensics tools copy data from a suspect's disk drive?

What type of tool can be used to compare results and verify a new tool by viewing data in its raw format?

What is the first task in digital forensics investigations?

What two data copying methods are used in software data acquisitions?

zusammenhängende Posts

Which password attack method tries every possible sequence of keys until the correct one is found?

Which of the following will show account aging information for a user such as the date of the last password change?

What do you call a hardware and or software that protect a networks from intrusions by denying access to unauthorized communication?

Who is ultimately accountable for effective business continuity and disaster recovery controls?

Which of the following tools cannot enable and disable the network discovery firewall rules?

Rotate text in a cell by clicking this button in the Alignment group on the table Tools Layout tab

How can you verify that your disaster recovery plan will be effective? check all that apply.

Which component of the system model includes resources such as energy capital People materials tools and machines time and information?

All of the following are important worldwide tools for knowledge and data-based firms except:

Which performance appraisal tools require a supervisor keeps a record of uncommonly good and or undesirable examples of an employees work

Werbung

NEUESTEN NACHRICHTEN

Which incentive plans are specifically designed to promote group performance

According to the flsa, which individual is most likely a nonexempt employee?

Reactive and protective behaviors designed to avoid action, blame, or change are termed ________.

The machiavellian personality is characterized by the will to manipulate and the desire for power.

Ist ein mann in brunn gefallen noten

Which of the following biometric authentication systems is the most accepted by users?

Was ist der Unterschied zwischen Hanf und CBD?

Wie viele noten braucht man für eine zeugnisnote sachsen-anhalt

Wie fühlt man sich wenn man schwanger ist am anfang

Kann man Basaltemperatur auch tagsüber Messen?

Werbung

Populer

Werbung

Um

Legal

Hilfe

Sozial

Many password recovery tools have a feature for generating potential lists for a ____ attack.

Related Papers

Chapter 6-13 multiple choice

Where do software forensics tools copy data from a suspect's disk drive?

What type of tool can be used to compare results and verify a new tool by viewing data in its raw format?

What is the first task in digital forensics investigations?

What two data copying methods are used in software data acquisitions?

zusammenhängende Posts

Werbung

NEUESTEN NACHRICHTEN

Werbung

Populer

Werbung

Um

Legal

Hilfe

Sozial