Digital Forensics & Investigation Flashcards
7 cards from real ISA practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Digital Forensics & Investigation flashcards as text
What is the primary legal standard for digital evidence to be admissible in a US court?
Answer: It must be relevant, authentic, and collected without alteration
For digital evidence to be admissible, it must be relevant to the case, authenticated as genuine, and proven to have been collected and preserved without alteration.
An investigator discovers that log files on a compromised server were deleted by the attacker. Which forensic technique could help recover them?
Answer: File carving from unallocated disk space
File carving can recover deleted log files from unallocated disk space by searching for known file headers and footers even after deletion.
Which Windows Registry hive stores information about USB devices that have been connected to a system?
Answer: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR
The USBSTOR key in the SYSTEM hive records information about USB storage devices that have been connected, including device identifiers and first/last connection times.
What is 'anti-forensics' and why is it a concern for investigators?
Answer: Techniques used to destroy, hide, or falsify digital evidence to impede investigations
Anti-forensics encompasses techniques like log wiping, timestamp modification, steganography, and file encryption used by attackers to hinder or mislead forensic investigations.
During a forensic investigation, an analyst finds timestamps that appear inconsistent with the suspected attack timeline. What should the analyst consider?
Answer: Consider time zone differences, clock skew, and possible timestamp manipulation
Timestamp inconsistencies can result from time zone differences, system clock drift, or deliberate anti-forensic manipulation, all of which must be accounted for during analysis.
What is the significance of the 'prefetch' folder in Windows forensic investigations?
Answer: It contains files that record when and how frequently applications were executed
Windows Prefetch files record application execution history including the executable name, run count, and last run time, providing evidence of program execution on a system.
Which standard framework provides guidelines for conducting digital forensic investigations?
Answer: NIST SP 800-86 (Guide to Integrating Forensic Techniques into Incident Response)
NIST SP 800-86 provides a comprehensive guide for performing digital forensics as part of incident response, covering evidence collection, examination, analysis, and reporting.