Digital Forensics

Course Implementation Plan

Labs

[Lab 5] Registry Forensics with RegRipper plug-ins

Quiz

Key Technical Concepts

CCSF’s Web4 lets students enroll in classes online. What type of cloud computing is it?

A company moves to the cloud, taking images of their servers, routers, and switches, and deploying them to Amazon’s servers as virtual machines and software-defined networks. What type of cloud service is that?

Tyler makes a Word document and saves it on his desktop. What type of data is it?

Tyler deletes the document, so it goes into the Recycle Bin. What type of data is it?

Tyler empties his Recycle Bin, so the Word document is gone. What type of data is it?

Tyler uses DISKPART and CLEAN ALL to write zeroes to his whole hard drive, including the Word document. What type of data is the Word document now?

Labs and Tools

Which of these documents is most important, and can ruin the evidence if it is lost?

Which of these items must be written in clear, non-technical English?

Which is the most reliable forensic software?

Collecting Evidence

Which item must be placed in a Faraday bag immediately after seizure?

Which item of evidence is the most volatile?

If a suspect is using encryption, which data below is likely to be lost if the device is powered off?

Which is the first step done by a forensic examiner who arrives at a crime scene?

Joe is making a clone of the evidence drive onto a target drive. Which of these is NOT a good practice?

You find a laptop at a crime scene with a dead battery. What type of acquisition should you perform?

You find a cell phone at a crime scene with a low battery, and no charger is available. What type of acquisition should you perform?

Windows System Artifacts

Which type of data is created when a laptop lid is closed?

Which type of data must be reconstructed with file carving?

Where is the identity of the last-logged-in user stored?

Where is the Modified timestamp for a file stored?

Anti-forensics

What term best describes BASE64 encoding?

Which method uses one key to encrypt, and a different key to decrypt?

Which of these is a hardware device?

If you see a repeated pattern of DEADBEEF for a large portion of a hard drive, what does this indicate?

Which law protects you from third-party wiretaps?

Boston police searched houses for the bomber without warrants. What justification did they have for that?

What starts as soon as there is a reasonable expectation of litigation?

Internet and Email

What is the technical term for the last part of a Web address, such as .com or .net?

Which item is deceptive, often containing data from a Web site the suspect never visited?

Which protocol is used to send email?

Digital Forensics and Networking

What type of network is the Internet?

What type of attack could be prevented by egress filtering?

What part of the Incident Response process involves finding out how large the problem is and making sure it stops growing?

Mobile Device Forensics

Which phones use an ESN to identify them?

Which phones use SIM cards?

What is the most popular phone OS?

Which devices store a track log of physical locations automatically?

Looking Ahead – Challenges and Concerns

Which term describes long-term off-site storage of old data?

Which term describes data accidentally left on discarded devices?

What activity of an SSD controller causes write operations to one block to actually store data on some other block?

What activity of an SSD controller causes latent data to vanish?

Learning Materials