Title: Module 4 Quiz
Course: CAP 2140 Digital Forensics > Section: Data Acquisition

Q: ____ has developed the Rapid Action Imaging Device (RAID) to make forensically sound disk copies.
- DIBS USA
- EnCase
- ProDiscover
- ILook
A: DIBS USA

Q: Have you read the syllabus completely and thoroughly?
- Yes
- No
A: Yes

Q: ____ is the only automated disk-to-disk tool that allows you to copy data to a slightly smaller target drive than the original suspect’s drive.
- SafeBack
- EnCase
- SnapCopy
- SMART
A: SnapCopy

Q: Do you accept all the items in the syllabus?
- Yes
- No
A: Yes

Q: SafeBack performs a(n) ____ calculation for each sector copied to ensure data integrity
- SHA-1
- MC5
- SHA-256
- MC4
A: SHA-256

Q: SnapBack DatArrest runs from a true ____ boot floppy.
- UNIX
- Linux
- Mac OS X
- MS-DOS
A: MS-DOS

Q: SnapBack DatArrest can perform a data copy of an evidence drive in ____ ways.
- two
- three
- four
- five
A: three

Q: The ____ DOS program En.exe requires using a forensic MS-DOS boot floppy or CD and a network crossover cable.
- ProDiscover
- ILook
- DIBS USA
- EnCase
A: EnCase

Q: EnCase Enterprise is set up with an Examiner workstation and a Secure Authentication for EnCase (____) workstation
- ILook
- SAFE
- Incident Response
- Investigator
A: SAFE

Q: The ____ command, works similarly to the dd command but has many features designed for computer forensics acquisitions.
- raw
- bitcopy
- dcfldd
- man
A: dcfldd

Q: Current distributions of Linux include two hashing algorithm utilities: md5sum and ____.
- rcsum
- shasum
- hashsum
- sha1sum
A: sha1sum

Q: The ____ command displays pages from the online help manual for information on Linux commands and their options.
- cmd
- hlp
- inst
- man
A: man

Q: The ____ command creates a raw format file that most computer forensics analysis tools can read, which makes it useful for data acquisitions.
- fdisk
- dd
- man
- raw
A: dd

Q: Microsoft has recently added ____ in its Vista Ultimate and Enterprise editions, which makes performing static acquisitions more difficult.
- whole disk encryption
- backup utilities
- recovery wizards
- NTFS
A: whole disk encryption

Q: Bit-stream data to files copy technique creates simple sequential flat files of a suspect drive or data set. The output of these flat files is referred to as a(n) ____________________ format.
A: raw

Q: Unlike RAID 0, RAID 3 stripes tracks across all disks that make up one volume.
- true
- false
A: false

Q: FTK Imager requires that you use a device such as a USB or parallel port dongle for licensing.
- true
- false
A: true

Q: One advantage with live acquisitions is that you are able to perform repeatable processes.
- true
- false
A: false

Q: What are the requirements for acquiring data on a suspect computer using Linux?

Q: What are some of the main characteristics of Linux ISO images designed for computer forensics?