Chfi 5 - Study guides, Class notes & Summaries

CHFI Chapter 5-6 Questions with 100% Verified Solutions

CHFI Chapter 5-6 Questions with 100% Verified Solutions Windows: When a user deletes a file, the OS does not actually delete the file, it - marks the file name in the Master File Table (MFT) with a special character. This character represents that the space once occupied by the file is ready for use FAT - The OS replaces the first letter of the deleted filename with - E5H, Corresponding clusters of that file are marked unused, even though they are not empty. Until these clusters are overwritte...

CHFI-5 Questions and Answers 100% Solved What information do you need to recover when searching a victim's computer for a crime committed with specific e-mail message? Internet service provider information E-mail header Username and password Firewall log - E-mail header Melanie was newly assigned to an investigation and asked to make a copy of all the evidence from the compromised system. Melanie did a DOS copy of all the files on the system. What would be the primary reason ...

CHFI Tools Questions and Answers Latest update 100% Solved in linux can be used locate residual data - DD Tool a. Networking/protocol stack tool and function - Netstat tool a. Allow view of information in the name resolution cache in a Windows machine - Nbtstat in Windows a. Allows view of routing table - 5. Route print i. A tool that blocks modification of the source drive - Write blocker DeepSpar Recovery Environment is a free Windows-based application DeepSpar Operations Serv...

CHFI Chapter 5-6 Questions and Answers 100% Solved Windows: When a user deletes a file, the OS does not actually delete the file, it - marks the file name in the Master File Table (MFT) with a special character. This character represents that the space once occupied by the file is ready for use FAT - The OS replaces the first letter of the deleted filename with - E5H, Corresponding clusters of that file are marked unused, even though they are not empty. Until these clusters are over...

CHFI Tools Questions and Answers | Latest update Already Passed in linux can be used locate residual data - DD Tool a. Networking/protocol stack tool and function - Netstat tool a. Allow view of information in the name resolution cache in a Windows machine - Nbtstat in Windows a. Allows view of routing table - 5. Route print i. A tool that blocks modification of the source drive - Write blocker a. DeepSpar Recovery Environment is a free Windows-based application b. DeepSpar Operations Ser...

CHFI Final Exam Study Guide with 100% Verified Solutions Key steps for Forensic Investigation - 1. Identify the Computer Crime. 2. Collect Primary Evidence. 3. Obtain court warrant for seizure (if required). 4. Perform first responder Procedures. 5. Seize evidence at the crime scene. 6. Transport Evidence to the forensic laboratory. 7. Create 2-bit stream copies of the evidence. 8. Generate MD5 checksum on the images. 9. Chain of Custody. 10. Store the original evidence in a secure loc...

CHFI Final Exam Study Guide with 100% Verified Solutions Key steps for Forensic Investigation - 1. Identify the Computer Crime. 2. Collect Primary Evidence. 3. Obtain court warrant for seizure (if required). 4. Perform first responder Procedures. 5. Seize evidence at the crime scene. 6. Transport Evidence to the forensic laboratory. 7. Create 2-bit stream copies of the evidence. 8. Generate MD5 checksum on the images. 9. Chain of Custody. 10. Store the original evidence in a secure lo...

CHFI - Chapter 3 (Hard Disks and File Systems) Test 100% Solved This RAID architecture uses Byte level stripping with a dedicated parity disk - RAID 3 This RAID architecture does not use any parity, striping or mirrioring - RAID 2 This RAID architecture uses Hamming code and ECC - RAID 2 This RAID architecture provides the best performance of the single RAID levels but does not providing mirroring - RAID 0 This RAID architecture uses disk mirroring and copies data to multiple disks at the s...

CHFI - Chapter 3 (Hard Disks and File Systems) Test 100% Solved This RAID architecture uses Byte level stripping with a dedicated parity disk - RAID 3 This RAID architecture does not use any parity, striping or mirrioring - RAID 2 This RAID architecture uses Hamming code and ECC - RAID 2 This RAID architecture provides the best performance of the single RAID levels but does not providing mirroring - RAID 0 This RAID architecture uses disk mirroring and copies data to multiple disks at the s...