CCD Digital Forensics & Evidence Handling Flashcards

What does the term 'live forensics' or 'live acquisition' refer to?

Answer: Collecting forensic evidence from a running system without powering it down

Live forensics involves collecting volatile data (RAM, active network connections, running processes) from a powered-on system before it is shut down and evidence is lost.

Which hashing algorithm is currently preferred for verifying forensic evidence integrity due to collision resistance?

Answer: SHA-256

SHA-256 is the preferred hashing algorithm for forensic evidence verification because MD5 and SHA-1 have known collision vulnerabilities that could undermine evidence integrity.

A forensic analyst is reviewing Windows Event logs and sees Event ID 4688. What does this indicate?

Answer: A new process was created

Windows Security Event ID 4688 indicates that a new process was created and includes details like the process name, parent process, and creator user account.

What is the purpose of the SANS DFIR 'FOR508' course framework in digital forensics?

Answer: Advanced incident response and threat hunting using memory and disk forensics

SANS FOR508 focuses on advanced incident response and digital forensics, covering memory analysis, disk forensics, and threat hunting techniques for incident responders.

During forensic analysis of a Linux system, which file contains a history of commands entered by users in the bash shell?

Answer: ~/.bash_history

The `~/.bash_history` file stores the command history for a user's bash shell sessions, revealing past commands executed by the user.

What is 'anti-forensics' and why is it a concern for digital forensic investigators?

Answer: Techniques used by attackers to destroy, hide, or alter evidence to impede forensic analysis

Anti-forensics encompasses techniques like file wiping, timestamp manipulation, steganography, and encryption that adversaries use to prevent investigators from recovering evidence.