Exam (elaborations)
SANS FOR508 Book 4-5 Questions with correct Answers
- Course
- Institution
SANS FOR508 Book 4-5
[Show more]
Content preview
SANS FOR508 Book 4-5Timeline Analysis - answer the capability that allows an investigator to automatically
assemble artifacts from the registry, filesystem, and OS in temporal order.
Plaso - answerlog2timeline analysis tool
MACB (timeline analysis) – answer M - Data content Modification
A - Data content Access
C - Meta data Change
B - Meta data Creation (Birth date)
when you create a new file, all 4 timestamps will be updated
when a file is deleted, not timestamps are updated.
file access - no changes with windows 7+ FOR NTFS ONLY. (great trick question or
exam)
Timestamping - answer Most tools only put in times up to seconds, so the milliseconds
will be 00 which is weird
MACB - Birth date - answerThis is not the time the file was created. its when the
metadata was created.
Timestamps - Copy file to new location - answerThis is really a file creation. all
timestamps are updated. but it inherits the original modification time. THUS the
modification time will be before the Birth date.
Move file from dir A to dir B - answermove parent folder of file only. the file still has the
same MFT entry.
Timestamps - Volume file move - answerSystem A to system B. or UAB to system
CLI: New file is created, inherits originals mod and meta data change
Explorer: .......?????
RegKey - OpenSaveMRU/OpenSavePID1MRU - answer(XP/7+)
Tracks files that have been opened or saved within a Windows shell dialog box.
(File>Save As)
The benefits of buying summaries with Stuvia:
Guaranteed quality through customer reviews
Stuvia customers have reviewed more than 700,000 summaries. This how you know that you are buying the best documents.
Quick and easy check-out
You can quickly pay through credit card or Stuvia-credit for the summaries. There is no membership needed.
Focus on what matters
Your fellow students write the study notes themselves, which is why the documents are always reliable and up-to-date. This ensures you quickly get to the core!
Frequently asked questions
What do I get when I buy this document?
You get a PDF, available immediately after your purchase. The purchased document is accessible anytime, anywhere and indefinitely through your profile.
Satisfaction guarantee: how does it work?
Our satisfaction guarantee ensures that you always find a study document that suits you well. You fill out a form, and our customer service team takes care of the rest.
Who am I buying these notes from?
Stuvia is a marketplace, so you are not buying this document from us, but from seller julianah420. Stuvia facilitates payment to the seller.
Will I be stuck with a subscription?
No, you only buy these notes for $12.99. You're not tied to anything after your purchase.
Can Stuvia be trusted?
4.6 stars on Google & Trustpilot (+1000 reviews)
81989 documents were sold in the last 30 days
Founded in 2010, the go-to place to buy study notes for 14 years now