Title: Module One Quiz
Course: CAP 2141 Digital Forensics II > Section: Module 1 Computer Forensics Analysis and Validation

Q: People who want to hide data can also use advanced encryption programs, such as PGP or ____.
- NTI
- BestCrypt
- FTK
- PRTK
A: BestCrypt

Q: ____ recovery is a fairly easy task in computer forensic analysis.
- Data
- Partition
- Password
- Image
A: Password

Q: ____ attacks use every possible letter, number, and character found on a keyboard when cracking a password.
- Brute-force
- Dictionary
- Profile
- Statistics
A: Brute-force

Q: ____ are handy when you need to image the drive of a computer far away from your location or when you don’t want a suspect to be aware of an ongoing investigation.
- Scope creeps
- Remote acquisitions
- Password recovery tools
- Key escrow utilities
A: Remote acquisitions

Q: ____ is a remote access program for communication between two computers. The connection is established by using the DiskExplorer program (FAT or NTFS) corresponding to the suspect (remote) computer’s file system.
- HDHOST
- DiskHost
- DiskEdit
- HostEditor
A: HDHOST

Q: Many commercial encryption programs use a technology called ____, which is designed to recover encrypted data if users forget their passphrases or if the user key is corrupted after a system data failure.
- steganography
- key escrow
- password backup
- key splitting
A: key escrow

Q: ____ is defined as the art and science of hiding messages in such a way that only the intended recipient knows the message is there.
- Bit shifting
- Encryption
- Marking bad clusters
- Steganography
A: Steganography

Q: The term ____ comes from the Greek word for“hidden writing.”
- creep
- steganography
- escrow
- hashing
A: steganography

Q: Marking bad clusters data-hiding technique is more common with ____ file systems.
- NTFS
- FAT
- HFS
- Ext2fs
A: FAT

Q: One way to hide partitions is to create a partition on a disk, and then use a disk editor such as ____ to manually delete any reference to it.
- Norton DiskEdit
- PartitionMagic
- System Commander
- LILO
A: Norton DiskEdit

Q: Data ____ involves changing or manipulating a file to conceal information.
- recovery
- creep
- integrity
- hiding
A: hiding

Q: AccessData ____ compares known file hash values to files on your evidence drive or image files to see whether they contain suspicious data.
- KFF
- PKFT
- NTI
- NSRL
A: KFF

Q: Getting a hash value with a ____ is much faster and easier than with a(n) ____.
- high-level language, assembler
- HTML editor, hexadecimal editor
- computer forensics tool, hexadecimal editor
- hexadecimal editor, computer forensics tool
A: hexadecimal editor, computer forensics tool

Q: FTK and other computer forensics programs use ____ to tag and document digital evidence.
- tracers
- hyperlinks
- bookmarks
- indents
A: bookmarks

Q: To generate reports with the FTK ReportWizard, first you need to ____________________ files during an examination.
A: bookmark

Q: FTK cannot analyze data from image files from other vendors.
- true
- false
A: false

Q: A nonsteganographic graphics file has a different size than an identical steganographic graphics file.
- true
- false
A: false

Q: The data-hiding technique ____________________ changes data from readable code to data that looks like binary executable code.
A: bit-shifting

Q: Describe the effects of scope creep on an investigation in the corporate environment.

Q: Describe with examples why the approach you take for a forensics case depends largely on the specific type of case you’re investigating.