CIS 562 Week 11 Final Exam – Strayer New
Click On The Link Below To
Purchase A+ Graded Material
Instant Download
Chapters 7 Through 16
Chapter
7: Current Computer Forensics Tools
TRUE/FALSE
1. When you research for computer forensics
tools, strive for versatile, flexible, and robust tools that provide technical
support.
2. In software acquisition, there are three
types of data-copying methods.
3. To help determine what computer forensics
tool to purchase, a comparison table of functions, subfunctions, and vendor
products is useful.
4. The Windows platforms have long been the
primary command-line interface OSs.
5. After retrieving and examining evidence data
with one tool, you should verify your results by performing the same tasks with
other similar forensics tools.
MULTIPLE
CHOICE
1. Computer forensics tools are divided into
____ major categories.
|
a.
|
2
|
c.
|
4
|
|
b.
|
3
|
d.
|
5
|
2. Software forensics tools are commonly used to
copy data from a suspect’s disk drive to a(n) ____.
|
a.
|
backup
file
|
c.
|
image
file
|
|
b.
|
firmware
|
d.
|
recovery
copy
|
3. To make a disk acquisition with En.exe
requires only a PC running ____ with a 12-volt power connector and an IDE, a
SATA, or a SCSI connector cable.
|
a.
|
UNIX
|
c.
|
Linux
|
|
b.
|
MAC
OS X
|
d.
|
MS-DOS
|
4. Raw data is a direct copy of a disk drive. An
example of a Raw image is output from the UNIX/Linux ____ command.
|
a.
|
rawcp
|
c.
|
d2dump
|
|
b.
|
dd
|
d.
|
dhex
|
5. ____ of data involves sorting and searching
through all investigation data.
|
a.
|
Validation
|
c.
|
Acquisition
|
|
b.
|
Discrimination
|
d.
|
Reconstruction
|
6. Many password recovery tools have a feature
that allows generating potential lists for a ____attack.
|
a.
|
brute-force
|
c.
|
birthday
|
|
b.
|
password
dictionary
|
d.
|
salting
|
7. The simplest method of duplicating a disk
drive is using a tool that does a direct ____ copy from the original disk to
the target disk.
|
a.
|
partition-to-partition
|
c.
|
disk-to-disk
|
|
b.
|
image-to-partition
|
d.
|
image-to-disk
|
8. To complete a forensic disk analysis and
examination, you need to create a ____.
|
a.
|
forensic
disk copy
|
c.
|
budget
plan
|
|
b.
|
risk
assessment
|
d.
|
report
|
9. The first tools that analyzed and extracted
data from floppy disks and hard disks were MS-DOS tools for ____ PC file
systems.
|
a.
|
Apple
|
c.
|
Commodore
|
|
b.
|
Atari
|
d.
|
IBM
|
10. In Windows 2000 and XP, the ____ command
shows you the owner of a file if you have multiple users on the system or
network.
|
a.
|
Dir
|
c.
|
Copy
|
|
b.
|
ls
|
d.
|
owner
|
11. In general, forensics workstations can be
divided into ____ categories.
|
a.
|
2
|
c.
|
4
|
|
b.
|
3
|
d.
|
5
|
12. A forensics workstation consisting of a
laptop computer with a built-in LCD monitor and almost as many bays and
peripherals as a stationary workstation is also known as a ____.
|
a.
|
stationary
workstation
|
c.
|
lightweight
workstation
|
|
b.
|
field
workstation
|
d.
|
portable
workstation
|
13. ____ is a simple drive-imaging station.
|
a.
|
F.R.E.D.
|
c.
|
FIRE
IDE
|
|
b.
|
SPARC
|
d.
|
DiskSpy
|
14. ____ can be software or hardware and are used
to protect evidence disks by preventing you from writing any data to the
evidence disk.
|
a.
|
Drive-imaging
|
c.
|
Workstations
|
Comments
Post a Comment