Digital Evidence
What is Chain of Custody?
This process ensures digital evidence remains unaltered from collection to presentation.
This is the default Windows file system
What is NTFS?
This type of memory loses its contents when power is removed
What is RAM?
This protocol translates domain names into IP addresses.
What is DNS?
This commercial tool is widely used for digital forensic investigations.
What is EnCase?
What are hash values (MD5, SHA-1, SHA-256)?
These cryptographic values verify that evidence has not changed
Deleted file information can often remain in this area until overwritten
What is unallocated space?
This forensic technique captures volatile memory before shutdown.
What is memory acquisition?
This protocol is commonly used to capture web traffic.
What is HTTP?
This open-source suite developed by Sleuth Kit provides forensic analysis.
Question: What is Autopsy?
What is a forensic image?
This is an exact bit-for-bit copy of a storage device
The NTFS database containing file metadata.
What is the Master File Table (MFT)?
This framework is commonly used to analyze RAM dumps
What is Volatility?
This tool is widely used for packet capture and analysis.
What is Wireshark?
This command-line Linux utility creates forensic disk images.
What is dd?
This hardware device prevents writes to the original storage media during acquisition.
What is a write blocker?
This NTFS file records filesystem changes for recovery purposes.
What is the USN Journal?
Malware that hides its presence by modifying operating system behavior is called this
What is a rootkit?
This protocol securely encrypts web communications.
What is HTTPS (TLS)?
This file format is commonly used to store memory dumps in Windows.
What is .dmp?
This legal principle requires evidence to be collected in a manner that preserves admissibility in court.
What is forensic soundness?
Slack space refers to this unused portion of a storage allocation unit.
What is the unused space between the end of a file and the end of its allocated cluster?
This malware technique injects malicious code into legitimate processes to evade detection.
What is process injection?
The three steps of the TCP connection setup are SYN, SYN-ACK, and this.
What is ACK?
This investigative methodology reconstructs events based on timestamps from multiple sources.
What is timeline analysis?