Title: Module 7 Quiz
Course: CAP 2140 Digital Forensics > Section: Current Computer Forensics Tools

Q: Have you read the syllabus completely and thoroughly?
- Yes
- No
A: Yes

Q: Do you accept all the items in the syllabus?
- Yes
- No
A: Yes

Q: The primary hash algorithm used by the NSRL project is ____.
- MD5
- SHA-1
- CRC-32
- RC4
A: SHA-1

Q: One way to compare your results and verify your new forensic tool is by using a ____, such as HexWorkshop, or WinHex.
- disk imager
- write-blocker
- bit-stream copier
- disk editor
A: disk editor

Q: Although a disk editor gives you the most flexibility in ____, it might not be capable of examining a ____ file’s contents.
- testing, compressed
- scanning, text
- testing, pdf
- testing, doc
A: testing, compressed

Q: Computer forensics tools are divided into ____ major categories.
- 2
- 3
- 4
- 5
A: 2

Q: Software forensics tools are commonly used to copy data from a suspect’s disk drive to a(n) ____.
- backup file
- firmware
- image file
- recovery copy
A: image file

Q: To complete a forensic disk analysis and examination, you need to create a ____.
- forensic disk copy
- risk assessment
- budget plan
- report
A: report

Q: The simplest method of duplicating a disk drive is using a tool that does a direct ____ copy from the original disk to the target disk.
- partition-to-partition
- image-to-partition
- disk-to-disk
- image-to-disk
A: disk-to-disk

Q: In Windows 2000 and XP, the ____ command shows you the owner of a file if you have multiple users on the system or network.
- Dir
- ls
- Copy
- owner
A: Dir

Q: The first tools that analyzed and extracted data from floppy disks and hard disks were MS-DOS tools for ____ PC file systems.
- Apple
- Atari
- Commodore
- IBM
A: IBM

Q: Raw data is a direct copy of a disk drive. An example of a Raw image is output from the UNIX/Linux ____ command.
- rawcp
- dd
- d2dump
- dhex
A: dd

Q: To make a disk acquisition with En.exe requires only a PC running ____ with a 12-volt power connector and an IDE, a SATA, or a SCSI connector cable.
- UNIX
- MAC OS X
- Linux
- MS-DOS
A: MS-DOS

Q: Many password recovery tools have a feature that allows generating potential lists for a ____ attack.
- brute-force
- password dictionary
- birthday
- salting
A: password dictionary

Q: The Windows application of EnCase requires a(n) ____________________ device, such as FastBloc, to prevent Windows from accessing and corrupting a suspect disk drive.
A: write-blocker

Q: The ____________________ function is the most demanding of all tasks for computer investigators to master.
A: extraction

Q: Because there are a number of different versions of UNIX and Linux, these platforms are referred to as ____________________ platforms.
A: *nix

Q: Hardware manufacturers have designed most computer components to last about ____________________ months between failures.
A: 18 / eighteen

Q: Briefly explain the purpose of the NIST NSRL project.

Q: Explain the difference between repeatable results and reproducible results.