Digital Forensics & Investigation Flashcards
7 cards from real ISA practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Digital Forensics & Investigation flashcards as text
Which forensic tool is widely used for creating forensic images and analyzing disk evidence?
Answer: FTK (Forensic Toolkit)
FTK (Forensic Toolkit) by AccessData is a widely used digital forensics platform for disk imaging, file analysis, and evidence processing.
In memory forensics, what does the term 'process injection' indicate?
Answer: Malicious code running within the address space of another process
Process injection is a technique where malicious code is inserted into the memory space of a legitimate running process to evade detection.
What is a 'dead box' forensic investigation?
Answer: Forensic analysis of a powered-off or powered-down system
Dead box forensics involves examining a system that is powered off, typically by imaging the hard drive and analyzing it offline, avoiding changes to the live system.
Which file system artifact is most useful for reconstructing a timeline of file activity on a Windows system?
Answer: The $MFT (Master File Table)
The $MFT on NTFS file systems records metadata for every file including creation, modification, and access timestamps, making it essential for timeline reconstruction.
What is 'file carving' in digital forensics?
Answer: Recovering files based on file headers and footers without file system metadata
File carving recovers files from raw data by identifying known file signatures (headers/footers), even when file system metadata has been deleted or corrupted.
When analyzing Windows Event Logs for forensic purposes, which log primarily contains security-related events such as logon attempts?
Answer: Security.evtx
The Security.evtx log records security-related events including successful and failed logon attempts, account management changes, and privilege use.
In network forensics, which tool is best suited for capturing and analyzing full packet data?
Answer: Wireshark / tcpdump
Wireshark and tcpdump are packet capture tools that record full network packet data, enabling detailed analysis of network communications during an investigation.