Rule 702. Testimony by Expert Witnesses

VERY IMPORTANT REVIEW ON TEST DAY

Rule 702. Testimony by Expert Witnesses A witness who is qualified as an expert by knowledge, skill, experience, training, or education may testify in the form of an opinion or otherwise if: (a) the expert’s scientific, technical, or other specialized knowledge will help the trier of fact to understand the evidence or to determine a fact in issue; (b) the testimony is based on sufficient facts or data; (c) the testimony is the product of reliable principles and methods; and (d) the expert has reliably applied the principles and methods to the facts of the case. (Legislative History Links: Pub. L. 93-595, Jan. 2, 1975; Apr. 17, 2000, eff. Dec. 1, 2000; Apr. 26, 2011, eff. Dec. 1, 2011.)

http://federalevidence.com/downloads/rules.of.evidence.pdf

Rule 703. Bases of an Expert’s Opinion Testimony

VERY IMPORTANT REVIEW ON TEST DAY

Rule 703. Bases of an Expert’s Opinion Testimony

An expert may base an opinion on facts or data in the case that the expert has been made aware of or personally

observed. If experts in the particular field would reasonably rely on those kinds of facts or data

in forming an opinion on the subject, they need not be admissible for the opinion to be admitted. But if

the facts or data would otherwise be inadmissible, the proponent of the opinion may disclose them to the

jury only if their probative value in helping the jury evaluate the opinion substantially outweighs their

prejudicial effect.

(Legislative History Links: Pub. L. 93-595, Jan. 2, 1975; Mar. 2, 1987, eff. Oct. 1, 1987; Apr. 17, 2000, eff. Dec. 1, 2000;

Apr. 26, 2011, eff. Dec. 1, 2011. ) http://federalevidence.com/downloads/rules.of.evidence.pdf

Rule 704. Opinion on an Ultimate Issue

(a) In General — Not Automatically Objectionable. An opinion is not objectionable just because it

embraces an ultimate issue.

(b) Exception. In a criminal case, an expert witness must not state an opinion about whether the defendant

did or did not have a mental state or condition that constitutes an element of the crime charged or of a

defense. Those matters are for the trier of fact alone.

(Legislative History Links: Pub. L. 93-595, Jan. 2, 1975; Pub. L. 98-473, Sept. 12, 1994;

Apr. 26, 2011, eff. Dec. 1, 2011.)

Rule 705. Disclosing the Facts or Data Underlying an Expert’s Opinion

Unless the court orders otherwise, an expert may state an opinion — and give the reasons for it — without

first testifying to the underlying facts or data. But the expert may be required to disclose those facts or data

on cross-examination.

(Legislative History Links: Pub. L. 93-595, Jan. 2, 1975; Mar. 2, 1987, eff. Oct. 1, 1987; Apr. 29, 1994, eff. Dec. 1, 1994;

 Apr. 26, 2011, eff. Dec. 1, 2011.)

Rule 706. Court-Appointed Expert Witnesses

Rule 706. Court-Appointed Expert Witnesses

(a) Appointment Process. On a party’s motion or on its own, the court may order the parties to show

cause why expert witnesses should not be appointed and may ask the parties to submit nominations. The

court may appoint any expert that the parties agree on and any of its own choosing. But the court may only

appoint someone who consents to act.

(b) Expert’s Role. The court must inform the expert of the expert’s duties. The court may do so in writing

and have a copy filed with the clerk or may do so orally at a conference in which the parties have an

opportunity to participate. The expert:

(1) must advise the parties of any findings the expert makes;

(2) may be deposed by any party;

(3) may be called to testify by the court or any party; and

(4) may be cross-examined by any party, including the party that called the expert.

(c) Compensation. The expert is entitled to a reasonable compensation, as set by the court. The compensation

is payable as follows:

(1) in a criminal case or in a civil case involving just compensation under the Fifth Amendment, from

any funds that are provided by law; and

(2) in any other civil case, by the parties in the proportion and at the time that the court direct — and

the compensation is then charged like other costs.Federal Rules of Evidence Federal Evidence Review 2014

32 www.FederalEvidence.com

(d) Disclosing the Appointment to the Jury. The court may authorize disclosure to the jury that the court

appointed the expert.

(e) Parties’ Choice of Their Own Experts. This rule does not limit a party in calling its own experts.

(Legislative History Links: Pub. L. 93-595, Jan. 2, 1975; Apr. 17, 2000, eff. Dec. 1, 2000; Apr. 26, 2011,

eff. Dec. 1, 2011.)

Admissibility of Evidence:

DO NOT confuse FRE Rule 401 with the Frye Standard...

Rule 401: (the relevancy test) addresses the RELEVANCE of evidence to a TRIAL

Frye Standard: (the general acceptance test) addresses the ACCEPTABILITY of TECHNIQUES in obtaining evidence or information

Admissibility of Evidence:

evidence must be C.R.M 

competent: reliable/credible

relevant: tend to prove a fact of the case

material: substantiate an issue in question in the case

and

in the USA evidence must be obtained legally

Application Password crackers

Windows password recovery tools 

Application Password Crackers

Office 

- Advanced Office XP Password Recovery - Microsoft Office 
- Word Password Recovery Master 
- Office Password Recovery Toolbox 
- Passware Kit - 25 password recovery programs 
- PstPassword - Outlook 
- Access PassView - Microsoft Access 

dd if=/dev/hda of=mbr.bin bs=512 count=1 

used to see contents of the master boot record. Must be run as root. Reads the first 512 bytes from /dev/hda (the first IDE drive) and writes them to a file named mbr.bin 

Reference: EC Council Press. (2010). Computer Forensics: Investigating Data and Image Files, 1st Edition. Clifton Park, NY: Cengage Learning. P. 2-4 and 2-5.

Service provider search warrant and electronic storage device search warrant 

Electronic storage device search warrant allows for search and seizure of computer components such as hardware, software, storage devices and documentation 

Service provider search warrant allows the first responder to get information such as service records, billing records and subscriber information if the crime is committed through the internet. 

Do not change the state of any electronic device.

Leave the computer on, unplug the network cable and photograph the screen 

ARP spoofing is also known as ARP cache poisoning or ARP poison routing.

used to attack a local-area network. ARP spoofing can allow an attacker to intercept data and modify or halt network traffic. ARP spoofing can be used to attack an Ethernet wired or wireless network. 

During normal functioning, ARP sends a broadcast with the IP address asking for the associated MAC address. A host having said IP address replies with its MAC address. Thus the ARP cache gains an entry matching IP address with MAC address. 

During ARP spoofing or ARP poisoning, ARP sends the same broadcast but an attacker replies with fake MAC address. Now the ARP cache has a false entry and all communication from the host will go to the fake MAC address 

One defense against ARP spoofing is placing static ARP entries on servers, workstations, and routers using the ARPWALL system. 

netstat -ano

displays TCP and UDP network connections, the listening ports and process identifiers (PID) using those network connections 

netstat - r

displays the routing table 

Open firmware, boot loader, typical Mac OS X boot sequence :

Open Firmware is a nonproprietary platform-independent boot firmware similar to PC BIOS.

It is stored in ROM and is the first program executed at power up.

Press Command-Option-O-F 

Command-Option-O-F or telnet 

Reference: EC Council Press. (2010). Computer Forensics: Hard Disk and operating Systems, 1st Edition. Clifton Park, NY: Cengage Learning. P. 3-12.

BootX is the default boot loader for Mac OS X.

BootX can load kernals from HFS+, HFS, UFS, ext2 or TFTP 

A big-endian machine stores the

most significant byte

first.

A little-endian machine stores the

least significant byte

first. 

Mac OS X boot process 

- BootX initialized Open Firmware 
- BootX creates a pseudodevice called sl_words (secondary loader) 
- BootX looks up device options properties (little endian, real mode...) 
- BootX looks up the chosen device handles 
- BootX initialized handles to memory, keyboard, display 
- BootX checks the security mode 
- BootX finds the kernel and constructs the path to the kernel 
- BootX draws Apple logo splash screen 
- BootX decodes the kernel 
- BootX saves the file system cache data and sets up various boot arguments 
- Kernel executes 
- Kernel determines the root device 
- Kernel initializes BSD data structures, I/O kit 
- Kernel starts /sbin/mach_init which maintains mappings between service names and Mach ports that provide those services 
- Mac OS X desktop is loaded with login window by default 

Reflective DDoS,

the attacks usually spoof the originating IP addresses and send the requests at reflectors. 

This type of DoS attack involves

sending a spoofed TCP SYN packet

to an open port

with the host IP address as both source and destination.

This causes the host to reply to itself continuously:

Fraggle?

Smurf?

Land?

What type of virus can redirect the disk head to read another sector?

What type of scan sends FIN, URG, PSH flags?

XMAS ?

FIN ?

Half-open ?

XMAS scan sends FIN, URG, PSH 

http://nmap.org/book/man-port-scanning-techniques.html

Which nmap scan is a slow scan to avoid detection?

nmap -sS -PT -PI -O -T1 122.13.145.15 

nmap –sP 10.1.2.0/24 

nmap -sS -O www.somewebsite.com/24 

Which netcat command is an example of port scanning?

nc -l -p port_number > /test/outfile.txt

nc www.targethost.com 80

nc -v -z target port-range

Which command provides a history of commands?

Doskey /history 

Dos - history 

Ls - history 

Doskey /history

prints recent commands 

Which port does SSL typically use?

Secure Sockets layer typically runs on port 443 

Which port does IS typically used?

SMB on port ?

two keys:

Asymmetric encryption has a public key and a private key 

Which key is used to encrypt an email to be sent....in asymmetric encryption?

• The recipient’s public key encrypts the message

• If the public key encrypts information, only the matching private key can decrypt the same information.
• If the private key encrypts information, only the matching public key can decrypt the same information.
• Private keys are always kept private and never shared.
• Public keys are freely shared by embedding them in a certificate.

As mentioned by the other two replies, the CA verifies the certificate (and in turn the public key).

Which encryption algorithm is streaming?

FISH 

AES 

DES 

FISH swim in a stream.....FISH = streaming

FISH - FISH (FIbonacci SHrinking) stream cipher [http://www.google.com/#hl=en&sclient=psy-ab&q=stream+cipher+fish&oq=stream+cipher+fish&gs_l=serp.3...2118.6551.0.6803.25.16.0.0.0.0.1123.3003.5-2j1j1.4.0.les%3B..0.0...1c.1.2.serp.2leYPHYeYtI&pbx=1&bav=on.2,or.r_gc.r_pw.r_qf.&fp=785d3bc0fb80a0d7&biw=708&bih=643]

AES (Advanced Encryption Standard) is a variant of Rijndael which has a fixed block size of 128 bits, and a key size of 128, 192, or 256 bits. [http://en.wikipedia.org/wiki/Advanced_Encryption_Standard] 

DES predessor of AES 

Preservation, identification, extraction, interpretation and documentation of computer evidence.

PIE-ID 

Leone Lattes was first to 

use blood groupings to connect criminal to crime.

Which event was instrumental to the evolution of computer forensics?

1925: Calvin Goddard was first to 

1925: Calvin Goddard was first to make use of

bullet comparisons. 

1932: FBI set up a...

Which event was instrumental to the evolution of computer forensics?

1993: first international conference on computer evidence was held in.... 

Which one is NOT an objective of computer forensics?

To recover, analyze, and preserve computer related materials in a manner so they can be presented as evidence in a court of law

To identify the evidence quickly, estimate the malicious impact on the victim, and determine the intent and identify of the perpetrator

To recover and identify the evidence quickly

NOT :To recover and identify the evidence quickly

Recovering and identifying evidence quickly is not a primary objective of computer forensics. Working too quickly can lead to mistakes that might compromise the evidence. 

There are two objectives of computer forensics: 

- Recover, analyze, and preserve computer related materials in a manner so they can be presented as evidence in a court of law 

- Identify the evidence quickly, estimate the malicious impact on the victim, and determine the intent and identify of the perpetrator 

Which item is NOT part of forensic readiness planning?

Define business scenarios that require collection of digital evidence

Identify potential available evidence

Identify crime scene

Determine evidence collection requirements

Develop procedures for securely collecting evidence that meets defined requirement in accordance with forensics good practice

Establish a policy for securely handling and storing collected evidence

Identifying a crime scene is not part of forensic readiness planning. Forensic readiness planning includes: 

- Define business scenarios that require collection of digital evidence 

- Identify potential available evidence 

- Determine evidence collection requirements 

- Develop procedures for securely collecting evidence that meets defined requirement in accordance with forensics good practice 

- Establish a policy for securely handling and storing collected evidence 

Which item is NOT part of forensic readiness planning?

Develop a plan to investigate team members

Develop a plan to make sure investigative team members are properly trained

Develop a process for step-by-step documentation of all activities performed during examination of evidence and the impact of said activities

Determine evidence collection requirements

Develop procedures for securely collecting evidence that meets defined requirement in accordance with forensics good practice

Establish a policy for securely handling and storing collected evidence

Developing a plan to investigate team members is not part of forensic readiness planning The following are part of forensic readiness planning: 

- Develop a plan to make sure investigative team members are properly trained 

- Develop a process for step-by-step documentation of all activities performed during examination of evidence and the impact of said activities 

- Determine evidence collection requirements 

- Develop procedures for securely collecting evidence that meets defined requirement in accordance with forensics good practice 

- Establish a policy for securely handling and storing collected evidence 

What is the definition of cybercrime?

Cybercrime means any illegal act that involves a computer or the systems and applications associated with it?

Cybercrime is the same as identity theft?

Cybercrime is any illegal act that involves a criminal using a computer?

Tools of crime and Target of crime are two categories of cybercrime. 

Reference: EC Council Press. (2010). Computer Forensics: Investigation Procedures and Response, 1st Edition. ( Page 1-12 ) Clifton Park, NY: Cengage Learning

Computer crimes include all but which of the following?

Fraud via manipulation of computer records

Performing vulnerability assessment for a client

Spam

Deliberate avoidance of computer security systems

Unauthorized access

Unauthorized modification of software

CHFI v8.0 Training Course Outline
Module 01: Computer Forensics in Today’s World
Module 02: Computer Forensics Investigation Process
Module 03: Searching and Seizing Computers
Module 04: Digital Evidence
Module 05: First Responder Procedures
Module 06: Computer Forensics Lab
Module 07: Understanding Hard Disks and File Systems
Module 08: Windows Forensics
Module 09: Data Acquisition and Duplication
Module 10: Recovering Deleted Files and Partitions
Module 11: Using AccessData FTK
Module 12: Using EnCase
Module 13: Steganography and Image File Forensics
Module 14: Application Password Crackers
Module 15: Log Capturing and Event Correlation
Module 16: Network Forensics, Investigating Logs and Investigating Network Traffic
Module 17: Wireless Attacks
Module 18: Web Attacks
Module 19: Emails
Module 20: Mobile
Module 21: Investigative Reports
Module 22: Expert Witness

Authorized penetration testing is NOT a computer crime. Computer crimes include: 

- Intellectual property theft 

- Industrial espionage by means of access to the computer 

- Identify theft 

- Spreading viruses or worms 

- Authorized penetration testing 

- Denial of Service or DDoS 

What is cybercrime investigation:

Collecting clues and forensic evidence about a cybercrime?

Securing the crime scene?

Disassembing a computer and carefully packaging the harddrive for further investigation?

When does the investigation begin:

When the police arrive?

When the crime scene technician arrives?

When the crime is suspected?

What occurs immediately after the investigation begins?

Immediate response to preliminary evidence including photographing the scene and marking evidence?

Immediately determine the damage from the crime?

Immediately call the police?

This is the proper order for response to a crime by first responders: 

1. Begin investigation the moment a crime is suspected

2. Response to preliminary evidence by photographing the scene and marking evidence 

3. Obtain search warrant, if needed 

4. Follow first responder procedures 

5. Seize evidence seized at crime scene then safely number and secure it 

6. Transport evidence to forensic laboratory 

7. Make two bit-stream copies of evidence 

8. Generate a checksum (generally MD5) on the bit-stream images 

9. Prepare chain of custody 

10. Store the original disk so that time stamps and evidence remain intact 

11. Use image copy to analyze the evidence 

12. Prepare a forensic report describing the forensic method and recovery tools 

13. Submit the forensic report 

14. Testify as expert witness, if needed 

What is part of the role of a forensics investigator?

Recover data

Determine damage from crime

Gather evidence based on forensic guidelines

Protect evidence

All of the above

All of the above

The role of a forensics investigator is to: 

- Recover data 

- Determine damage from crime 

- Gather evidence based on forensic guidelines 

- Protect evidence 

- Create images of original evidence 

- Guide officials in managing investigation 

- Reconstruct damaged media 

- Analyze data and prepares report 

- Address the issues in court, if necessary. May act as expert witness. 

What is the role of digital evidence in forensic investigation?

Provide material for investigative report in lawsuit?

Provide clues to identify the criminal?

Support expert witness testimony?

Which of the following is NOT part of corporate investigation?

Business must continue during the forensic investigation

Generally address policy violations or legal disputes

May address wrongful termination

Must carefully follow government regulations

May address industrial espionage

Following government regulations is not the primary part of corporate investigation although corporations must adhere to appropriate government regulations. Corporate investigation is generally looking into the following: 

- Business must continue during the forensic investigation 

- Generally address policy violations or legal disputes 

- May address wrongful termination 

- Must carefully follow government regulations 

- May address industrial espionage 

What is generally part of corporate investigation?

Email harassment

Falsification of information

Embezzlement

Fraud

Corporate sabatage

Router settings may be too detailed for an investigative report 

IDS/IPS may be too detailed for an investigative report. 

A good investigative report includes: 

- Methods of investigation 

- Adequate supporting data 

- Description of data collection techniques 

- Calculations used 

- Error analysis 

- Results and comments 

- Graphs and statistics explaining results 

- References 

- Appendices 

- Acknowledgments 

- Litigation support reports 

Which range of HTTP Status Codes

reveals client error status?

Which statements are true regarding EFS?

EFS encyrpts files stored on Windows 2000, XP Pro and Server 2003. It is NOT designed to protect data in transit from one system to another.

EFS uses symmetric and asymmetric cryptography. 

EFS encyryption occurs at the file system level not the application level. It is transparent to the user and to the application. 

If a folder marked for encryption, then every file created in or moved to said folder will be encrypted. 

There is no back door. File encryption uses a symmetric key. This symmetric key is then encrypted with an asymmetric public key. 

EFS keys are protected by the user's password 

EFS-encrypted files do not remain encrypted during transport if saved to or opened from a folder on a remote server. The file is decrypted, traverses the network in plaintext and if saved to a folder with encryption, re-encrypted. 

EnCase organizes evidence into cases.

Evidence can be viewed in various formats:

Evidence can be viewed in table, gallery, timeline or report formats .

Evidence data can be view as text, hex or picture .

From which devices can EnCase acquire data?

Evidence file (E01), raw image or dd image ?

Local Device ?

Smartphones?

Local Device 

Smartphones

...

Technically, EnCase would not acquire data from a raw image file or evidence file but these can be viewed in EnCase 

Tree - Case information 

Table, Timeline, Gallery 

View - text, hex, picture, fields... 

fourth pane = filter pane

(Computer Crime, Investigation, and the Law

 By Chuck Easttom)

MD5 produces 128-bit hash value

The size of the hash value (128 bits) is small enough to contemplate a birthday attack.

(SHA-1 produces 160-bit has value).

MD5 is used to check data integrity.

MD5 is typically expressed as a 32-digit hexadecimal number

 MD5 is not collision resistant- As such, MD5 is not suitable for applications like SSL certificates or digital signatures that rely on this property for digital security

 http://en.wikipedia.org/wiki/MD5

FAT32 is the 32-bit version of the FAT file system .

that uses smaller clusters which results in more efficient storage capacity.

It supports drives up to 2 TB. It can relocate the root directory and use the backup copy rather than the default copy. It can dynamically resize a partition. 

File Systems

?- Sun Solaris 
?- Mac OS 
? - iPod sync'd to MAC 
?- iPod sync'd to Windows 
?- Windows 
?- Unix 
? - Linux 

Which dd command is used to make a complete physical backup of a hard disk?

 dd if=/dev/?

dd if=/dev/hda of=/dev/case5img1 

Which dd command is used to copy a floppy?

Platter, track, sector 

Each platter has two read-write heads - one on top and one on bottom. Platters are divided into tracks. Tracks are concentric circles that are divided into sectors. Each sector holds 512 bytes. 

Clusters are groups of sectors, eg. 128-sector cluster would have about 65536 bytes. Clusters are the smallest logical storage units on a hard disk.

The forensics laboratory must have :

office space,

storage for evidentiary materials,

interview facility,

and operational laboratory 

( a vault protects against flood, fire, theft...)

...system-specific data and configuration files .

 Nemeth, E., Snyder, G., and Hein, T. (2002). Linux Adminstration Handbook Upper Saddle River, Nj: Prentice Hall PTR. p. 68.

Choose the true statements about SIMPLE:

Developed by Australian university students using Linux Live CD 

Customized kernal and OS so it is impossible to write to the hard disk 

SIMPLE launches from a CD 

Search text on hard disks and retrieves the context of keyword occurrences on computer media 

Examines entire allocated space including swap space, hibernate files and unallocated space on Local hard drives 

Evidor cannot access remote networked hard disks 

Typical /user sub-directories include: 

bin - support files for programs 

local - software (stuff you install) 

sbin - more commands for system adminstration and repair 

share - items common to multiple systems 

src - source code for nonlocal software 
(NOT "dev") 

Reference: Nemeth, E., Snyder, G., and Hein, T. (2002). Linux Adminstration Handbook Upper Saddle River, Nj: Prentice Hall PTR. p. 68.

Repairs and restores corrupt or inaccessible Microsoft Office and Zip files 

Includes EmailRepair 

EasyRecovery does not do disk imaging 

ref chp 13 Official CHFI study guide

Which of these statements are true regarding

18 U.S.C. 2318?

18 U.S.C. 2318 involves trafficking in

counterfeit phone records,

computer programs,

motion pictures,

audio visual works

or computer program documentation 

BIOS will lock the system completely if the password is typed wrong three times

The BIOS password for Dell is Dell

====

BIOS manufacturers do provide backdoor passwords in case the BIOS password is lost.

The Dell password is Dell and the Compaq password is Compaq.

The Epox password is central.

BIOS will lock after three invalid password attempts.

If the CMOS battery is removed and replaced after about 30 minutes, the password will reset itself. 

Turn the computer off and unplug the power cord 

Locate the battery on the motherboard 

Carefully lift the battery from the socket 

Wait 30 minutes and replace the battery 

Reboot the computer and enter BIOS 

Set the default settings, save the settings and start the computer 

Reference: EC Council Press. (2010). Computer Forensics: Investigating Data and Image Files, 1st Edition. Clifton Park, NY: Cengage Learning. P. 7-5 and 7-6.

Windows password recovery tools 
- Windows XP/2000/NT Key Generator - resets the domain adminstrator password for Active Directory 
- ERD Commander 2005 - boots systems into a Windows-like repair environment giving complete control over the system 
- Active@ Password Changer - DOS-based solution for resetting local administrator and user passwords in XP, Vista, 2003, 2000 and NT 
- Cain & Abel 
- LCP 
- SID&USER 
- ophcrack - uses rainbow tables 
- RockXP 
- Magical Jelly Bean Keyfinder 

Office 
- Advanced Office XP Password Recovery - Microsoft Office 
- Word Password Recovery Master 
- Office Password Recovery Toolbox 
- Passware Kit - 25 password recovery programs 
- PstPassword - Outlook 
- Access PassView - Microsoft Access 

Other 
- Advanced ZIP password recovery - zip file passwords
- PicoZip Recovery - zip file passwords 
- PDF Password Crackers - pdf file passwords 
- Default Password Databases 
- Dialupass - dial-up passwords 
- Database Sleuth 

Network Password Recovery - network passwords 
- SniffPass - captures password that pass through the network adapter (POP3, IMAP4, SMTP, FTP, HTTP) 

- Asterisk Key - reveals asterisks that hide passwords 
- Asterisk Logger - reveals asterisks that hide passwords 
- Password Spectator - reveals asterisks that hide passwords 

Linux 
- John the Ripper 
- DJohn 

Unix 
- Crack 

HTTP, POP3, FTP, Telnet 
- Brutus 

Email, Instant Messaging... 
- Mail PassView - email 
- Messenger Key - instant messaging 
- MessenPass 
- Mail Recovery 

Reference: EC Council Press. (2010). Computer Forensics: Hard Disk and Operating Systems, 1st Edition. Clifton Park, NY: Cengage Learning. Chapter 7. 

Which statement is used to partition an image on another machine?

netcat -l -p 1234 | dd of=/dev/hdc bs=16065b

dd if=/dev/sda2 of=/dev/sdb2 bs=4096 conv=notrunc,noerror

dd if=/dev/fd0 of=/home/sam/floppy.image conv=notrunc

netcat -l -p 1234 | dd of=/dev/hdc bs=16065b 

used to partition an image on another machine.

Run on the target machine 

A forensic investigator wants to find some information on a computer running Linux. He wants to find the computer name and version of Linux. Then he wants to list the files in the root directory Finally, he wants to see protocol information. What commands should he use to accomplish these three tasks?

uname -a 

ls -l 

netstat -s 

dir 

uname -a

ls -l

netstat -s

can be used to get the required information. 

Reference: EC Council Press. (2010). Computer Forensics: Hard Disk and Operating Systems, 1st Edition. Clifton Park, NY: Cengage Learning. P. 6-2

A forensic investigator types sfdisk -l 

Part of the output lists four devices: /dev/hda1, /dev/hda2, /dev/hda3, and /dev/hda4 

What is an hda device?

There are four types of partitions in Linux: 

A forensic investigator types: file CopyInstall.log 

What is the response?

1. ASCII text (if the file is ASCII) .
2. Length of CopyInstall.log .
3. ELF 32-bit LSB executable... (if the file is actually an executable) .

What is the response?

1. ASCII text (if the file is ASCII) .
2. xno
3. ELF 32-bit LSB executable... (if the file is actually an executable) 

file command returns the type of file. Attackers may hide files with names or extensions design to fool investigators 

The forensic investigator made a copy of the CopyInstall.log in the root directory and wants to see the contents in hex because he believes this file may not be what it seems. What Linux command line tool could he use?

1. xxd -l CopyInstall.log  
2. xxd -l CopyInstall.log HexOutput.log  
3. notepad 

1. xxd -l CopyInstall.log  
2. xxd -l CopyInstall.log HexOutput.log

xxd is a command line hex dump tool that can dump hex values to the console or a fil

What is the size of a hard drive having the following: 

16384 cylinders/disk 

80 heads/cylinder 

63 sectors/track 

512 bytes/sector

How does a network intruder enter a system? (Choose all that apply) 

Enumeration 

Vulnerabilities 

Viruses, Trojans, Email infection 

Logging on 

Router attacks 

Password cracking

 Network intruders can enter a system using the following techniques: 

Enumeration yielding topology of network, list of live hosts, network architecture, types of traffic, potential vulnerabilities of host systems 

Vulnerabilities 

Virus, Trojans, Email infection and other malware 

Router attacks 

Password cracking 

Hint: Take into account that logging on can only be accomplished if the attacker knows the username and password. How would they know this unless they performed some other activitie such as social engineering or password cracking first. All other answers are correct. 

What are some pitfalls of network evidence collection?

Gaps in evidence 

Other nations may be involved creating legal and political challenges 

Locating evidence is only local 

Logs change rapidly and some information may be lost before permission is granted to analyze the log 

Logs may be housed at ISP which requires special permission (such as a search warrant) to view 

End-to-end investigation is fairly simple 

Evidence can be lost quickly during log analysis becuase logs change rapidly.

There may be gaps in evidence.

Sometimes other nations are involved in the investigation resulting in legal and political issues.

Logs may be ambiguous, incomplete or missing. 

Prosecution must present appropriate testimony to show logs are accurate, reliable, fully intact 

Witness must authenticate computer records presented as evidence 

Will record of failures or security breaches on the machine creating logs impeach the evidence?

Generally, yes 

Failures and security breaches tend to impeach evidence 

which three types of logs that can be used together to provide more compelling evidence.

Router logs 

IDS logs 

TCPDump output 

Firewall logs 

Event logs 

Firewall logs,

IDS logs

and TCPDump output

can contain evidence of an internet user connecting to a specific server at a given time. 

What causes an IIS log to be suspect?

Full and complete log 

Any modification to the log 

Carefully implemented log 

SYSTEM\CurrentControlSet\W32Time\Parameters is part of the registry key used for _______________?

Setting time 

Loading NTP 

Timing logs 

Loading NTP :

Windows time service can be used to synchronize IIS servers by connecting them to external time source. To accomplish this SYSTEM\CurrentControlSet\W32Time\Parameters can be set to NTP. 

types of IIS logging:

IIS standard logs 

ODBC logging 

System Event log 

Centralized binary logging 

IISLogger tool 

System Event logs are for the operating system.

All other answers are correct. 

IIS standard log, ODBC logging (disables HTTP.sys kernal-mode cache and degrades server performance), centralized binary logging and IISLogger (provides additional functionality on top of IIS standard logging) 

Which of the following statements are true about syslog? 

Controlled on per-machine basis with /etc/syslog.conf 

Space key used to define white space 

Local and remote log collection 

Facility, level and action are included 

Audit mechanism used by Linux 

Controlled on per-machine basis with /etc/syslog.conf  

Local and remote log collection 

Facility, level and action are included 

Audit mechanism used by Linux 

Syslog is the audit mechanism used by Linux.

It permits both local and remote logging. 

Syslog is controlled on a per-machine basis by /etc/syslog.conf. 

Tab key is used to define white space between the selector (left) and the action (right) 

The list of severity Levels:

0       Emergency: system is unusable

1       Alert: action must be taken immediately

2       Critical: critical conditions

3       Error: error conditions

4       Warning: warning conditions

5       Notice: normal but significant condition

6       Informational: informational messages

7       Debug: debug-level messages

Recommended practice is to use the Notice or Informational level for normal messages.

Log is not a syslog level 

What files must be changed for remote logging? 

/etc/rc.d/init.d/syslog add -r to SYSLOGD_OPTIONS="-m 0 -r" 

/etc/sysconfig/syslog add -r to SYSLOGD_OPTIONS="-m 0 -r" 

/etc/services files. Syslog 514/udp 

/sbin/service syslog restart 

/etc/rc.d/init.d/syslog add -r to SYSLOGD_OPTIONS="-m 0 -r" 

/etc/sysconfig/syslog add -r to SYSLOGD_OPTIONS="-m 0 -r" 

/etc/services files. Syslog 514/udp 

After the three files have been changed, the administrator must run /sbin/service syslog restart .

Hint: /sbin/service syslog restart is a command not a file. The other three files must be changed before this command can be executed. 

Which statements are true regarding NTP? 

Network Time Protocol - internet standard protocol built on UDP 

Synchronizes clocks on client computers 

Fault tolerant and dynamically autoconfiguring 

Use UTC time 

all.

Technically, NTP runs over UDP or TCP/IP as explained in these references: 

http://tools.ietf.org/html/rfc5905 

http://en.wikipedia.org/wiki/Network_Time_Protocol 

Static address is the 48-bit unique address programmed by the Ethernet board manufacturer 

Configurable address is programmed into the NIC during initial installtion then becomes static 

Dynamic address is obtained when the computer is powered on. There may be a number of systems having the same address

HTTP, SMTP, NNTP, Telnet, FTP, SNMP, and TFTP are the main protocols for the Session, Presentation and Application Layers 

UDP and TCP are the main protocols for the Transport layer 

RARP, ICMP, IGMP, IP the main protocols for Network layer 

PPP, SLIP, ARP are the main protocols for the Data Link layer

What regular expression :

is a way to detect Cross-Site Scripting attacks. 

It checks for the opening and closing HTML tags (< and >) and the text between them so it can catch < script > 

Task manager lists running proccesses. Why does Helix have a viewer for running processes?

Task manager only shows processes in Windows 

Task manager loads too slow 

Task manager may be corrupt. Helix runs from a CD so it cannot be modified; therefore, it should display an accurate list of current processes 

Task manager may be corrupt. Helix runs from a CD so it cannot be modified; therefore, it should display an accurate list of current processes 

Reference:Gleason, B. and Fahey, D. (2006). Helix 1.7 for Beginners. Retrieved from Helix v1.8 Software. p. 29.

What are options using dd in Helix?

Netbios/Local, Netcat, Split image 

True!

A cache is duplicate data stored in a temporary location so a computer can rapidly access that data. In this case, the NetBIOS Remote Cache Name Table may contain a list of systems that a computer has connected to. 

nbtstat -c can be used to view the cache of NetBIOS names on the host operating system 

netstat -o shows process to port mappings 

fport shows process-to-port mappings but must be executed with administrator privileges 

What command can be used to view command history?

doskey /history 

show history 

scroll up in the command window 

doskey /history 

scroll up in the command window 

If a command window is open, the investigator can scroll up to see command history. But the attacker may have typed cls to clear the screen. Then, the investigator can use the doskey /history command to see the history. 

ClearPageFileAtShutdown - tells the OS to clear the page file when the system is shut down. This will clear virtual memory in the swap file 

DisableLastAccess - disables updating of the last access times on files so the timestamp might not be accurate 

index.dat is used for redundant information such as AutoComplete information. 

Index.dat can be found in the History folder for Internet Explorer 

What is the most important element of EProcess?

PEB - Process Environment Block contains: 

-pointer to loader data PPEB_LDR_DATA contains pointers to DLLs 

-pointer to image base address used to find the beginning of an executable image file 

-pointer to process parameters structure which maintains the DLL path, path to executable image and command line used to launch the process 

What tool can parse memory:

Lsproc.pl d:\dumps\test-mem.dmp 

Lsproc locates processes but not thread 

Lsproc.pl d:\dumps\test-mem.dmp 

Lspd allows a user to list the details of a process: 

Lspd.pl d:\dumps\test-mem.dmp 0x0414dd60 

What files contains pool headers?

Pooltag.txt 

Which registry key is NOT accessed and parsed when a user logs into a system?

HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Runonce 

HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\PoliciesExplorer\Run

HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run 

HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Windows\Run 

HKEY_CURRENT_USER\software\Microsoft\Windows\CurrentVersion\Run 

HKEY_CURRENT_USER\software\Microsoft\Windows\CurrentVersion\RunOnce 

All of the above are parsed when a user logs into a system 

All of the above are parsed when a user logs into a system 

Run means the values in this key execute at system startup 

Runonce means the values in this key execute once at system startup then they are deleted 

What steganography methods are used in audio files?

Frequencies inaudible to human ear 

White space 

LSB 

Substitution 

Steganography methods for audio files: 

ALL ABOVE EXCEPT White space (which is for Text)

Substitution scheme 

    For example, suppose note F = 0 and note C = 1. Using this scheme, music could be composed with a secret message. 

Low-Bit Encoding 

    Artifacts such as bitmaps and audio files often contain redundant information 

    DigSteg can replace redundant information with a message 

Phase Coding 

    Original sound sequence is shortened into segments 

    New phases are generated for each segment with the message 

    The new phase is combined with the original magnitude to create the encoded output 

Echo Data Hiding 

    Echo is introduced into the original signal 

    Properties of echo are manipulated to hide data. Properties include initial amplitude, decay rate, and offset