General MCQ Flashcards

How many bytes do hard disk sectors normally contain?

Answer: 512

Hard disk sectors have historically contained 512 bytes of data. While newer 'Advanced Format' drives use 4096-byte (4KB) sectors, they often employ 512-byte sector emulation for compatibility with legacy operating systems and software. Therefore, 512 bytes remains the standard and most commonly encountered sector size in general computer forensics contexts.

The following guidelines should be followed when employing an anti-virus scanner for a computer forensics investigation:

Answer: Scan your forensics workstation before beginning investigation

Before commencing any computer forensics investigation, it is paramount to scan the forensics workstation with an up-to-date anti-virus program. This ensures that the analysis environment itself is clean and free from malware, which could otherwise compromise the integrity of the investigation, alter evidence, or infect the suspect's data. Scanning the suspect drive directly or during the investigation is generally avoided to prevent altering potential evidence.

Office suites like Word, Excel, and PowerPoint generate a code for each document that is based on the Media Access Control (MAC) address, also known as the machine's unique identification. What is the name of this code?

Answer: The Globally Unique IDentifrier (GUID)

Microsoft Office documents and many other applications embed a Globally Unique IDentifier (GUID) within their metadata. This 128-bit number serves as a unique identifier for the document or object, ensuring its distinctness across various systems and applications. While its generation might involve system-specific information like a MAC address, the resulting unique code is known as the GUID.

A _______________ is an attack where the steps in the attack sequence are carried out by a computer program rather than a hacker.

Answer: Automated attack

An automated attack is a type of cyberattack where the sequence of malicious actions is executed by a computer program, script, or botnet rather than requiring direct, real-time human interaction. These attacks are designed to operate autonomously, often scanning for vulnerabilities, exploiting weaknesses, or distributing malware on a large scale without constant human oversight.

In a hexadecimal code, the offset is:

Answer: The Ox at the beginning of the code

In hexadecimal code, the prefix '0x' is conventionally used to denote that the subsequent characters represent a hexadecimal number. This prefix explicitly indicates the base-16 numbering system, distinguishing it from decimal, binary, or octal representations. Therefore, '0x' marks the beginning of a hexadecimal offset or value.

Due to his visits to sexual websites and image downloads, a suspect is accused of abusing computer resources. The goal of the investigation is to show that the suspect actually went to these places. The suspect, however, has deleted the cookie cache and wiped the search history. In addition, he deleted any photographs he may have downloaded. What steps can the investigator take to demonstrate the infraction?

Answer: Image the disk and try to recover deleted files

When files are 'deleted' from a computer, they are often not immediately overwritten; instead, the operating system simply marks the space they occupied as available. A forensic imaging tool creates a bit-for-bit copy of the entire storage device, including this unallocated space. Investigators can then use specialized data recovery software on this image to reconstruct and retrieve these 'deleted' files. This process can uncover evidence like browser history, cookies, and downloaded images, even after a suspect attempts to erase them.

Corporate investigations are often simpler than those conducted by the government because:

Answer: The investigator does not have to get a warrant

Corporate investigations are typically simpler because they operate under different legal frameworks than government investigations. In a corporate setting, employees usually consent to monitoring and searches of company-owned equipment as part of their employment agreement or company policy. This pre-existing consent often negates the need for a search warrant, which is a strict legal requirement for government agencies to seize or search private property.