Exam (elaborations)
CYSA+ Chapter 7 (1)
Exam of 2 pages for the course CySA+ at CySA+ (CYSA+ Chapter 7 (1))
[Show more]
Seller
Follow
Content preview
CYSA+ Chapter 7What are three important things that a digital forensics workstation should have? -
ANS-A powerful, multicore CPU, plenty of ram, and lots of fast, reliable storage.
What are write blockers? - ANS-Things that ensure that drives connected to a forensic
system or device cannot be written to.
What is the purpose of an imaging utility? - ANS-It creates a forensic image of a
complete disk, a disk partition, or a logical volume.
What is slack space? - ANS-The space left when a file is written.
What are packers? - ANS-A tool used in many malware packages intended to protect it
from reverse engineering.
What are the steps to the forensics process? - ANS-1. Determine what you are trying to
find out.
2. Outline the locations and types of data that you will need.
3. Document and review your plan.
4. Acquire and preserve evidence.
5. Perform the initial analysis.
6. Use the initial analysis to guide further work.
7. Report on the findings of the investigation.
What information can be found in the Windows Registry? - ANS-Information about files
and services, locations of deleted files, evidence of applications being run.
What information can be found in the Autorun keys? - ANS-Programs set to start on
startup (often associated with malware or compromise).
What information can be found in the Master File Table (MFT)? - ANS-Details of
inactive/removed records.
What information can be found in the Event logs? - ANS-Logins, service start/stop,
evidence of applications being run.
What information can be found in the INDX files and change logs? - ANS-Evidence of
deleted files, MAC timestamps.
The benefits of buying summaries with Stuvia:
Guaranteed quality through customer reviews
Stuvia customers have reviewed more than 700,000 summaries. This how you know that you are buying the best documents.
Quick and easy check-out
You can quickly pay through credit card or Stuvia-credit for the summaries. There is no membership needed.
Focus on what matters
Your fellow students write the study notes themselves, which is why the documents are always reliable and up-to-date. This ensures you quickly get to the core!
Frequently asked questions
What do I get when I buy this document?
You get a PDF, available immediately after your purchase. The purchased document is accessible anytime, anywhere and indefinitely through your profile.
Satisfaction guarantee: how does it work?
Our satisfaction guarantee ensures that you always find a study document that suits you well. You fill out a form, and our customer service team takes care of the rest.
Who am I buying these notes from?
Stuvia is a marketplace, so you are not buying this document from us, but from seller modockochieng06. Stuvia facilitates payment to the seller.
Will I be stuck with a subscription?
No, you only buy these notes for CA$11.45. You're not tied to anything after your purchase.
Can Stuvia be trusted?
4.6 stars on Google & Trustpilot (+1000 reviews)
80461 documents were sold in the last 30 days
Founded in 2010, the go-to place to buy study notes for 14 years now