Indication Analysis

Question 1

Joint Test Action Group (JTAG)

Answer 1

A hardware interface standard used primarily for testing and debugging embedded systems

Question 2

Non-Volatile Storage

Answer 2

Like hard drives, holds permanent data and is analyzed through forensic imaging

Question 3

Order of Volatility

Answer 3

Sequence in which digital evidence should be collected during a forensic investigation
Registers and CPU cache
Routing tables, ARP cache, process tables, kernel statistics, and RAM
Temporary file systems or swap space
Disks
Remote logging and monitoring data
Physical configurations and network topologies
Archival media such as backup tapes

Question 4

Forensic Imaging

Answer 4

Process of creating an exact bit-by-bit copy of digital data from a storage device to preserve its integrity for use in court

Question 5

Slack Space

Answer 5

Unused space between a file’s end and the storage unit’s end

Question 6

dd

Answer 6

Native to Unix/Linux systems, creates a bit-by-bit copy of a storage device

Question 7

dcfldd

Answer 7

Forensic version of the dd command, was developed by the US Department of DCFL to enhance dd for forensic data acquisition and secure wiping
Includes on the fly hashing and progress indicators for forensic work

Question 8

FTK Imager

Answer 8

Creates bit-by-bit copies, automates hash generation, and ensures data integrity of both the original and the copy

Question 9

Reverse Engineering

Answer 9

Breaks down software or hardware components to understand their structure, functionality, and potential vulnerabilities

Question 10

Byte Code

Answer 10

Low-level representation of code that can be executed by virtual machines
Acts as an intermediate form between high-level programming and machine code for platform independent execution

Question 11

Binary Code

Answer 11

Machine-level code that the computer directly executes and is made up of ones and zeroes

Question 12

Disassembly

Answer 12

Process of converting binary code into assembly language to analyze how the software operates

Question 13

Decompilation

Answer 13

Translates executable code into a higher-level language for easier understanding

Question 14

binwalk

Answer 14

Inspects firmware images to extract components like archives, file systems, and executable code for reverse engineering

Question 15

hexdump

Answer 15

Used to display binary files in a human-readable hexadecimal format, allowing analysts to examine the structure and content of a file

Question 16

strace

Answer 16

Tracks system calls by a running binary, revealing system interactions and suspicious actions like unauthorized file access

Question 17

ldd

Answer 17

Identifies shared libraries a binary relies on to understand dependencies and detect malicious modifications

Question 18

Incident Response Process

Answer 18

Preparation
Detection and Analysis
Containment, Eradication, and Recovery
Post-Incident Activity