What prevents you from discussing the case withthe CEO?
You are employed directly by an attorney to help investigate an alleged sexual harassment case at a large pharmaceutical manufacture. While at the corporate office of the company, the CEO demands to know the status of the investigation. What prevents you from discussing the case with
the CEO?
A honey pot deployed with the IP 172.16.1.108 was compromised by an attacker . Given below is an excerpt from
A honey pot deployed with the IP 172.16.1.108 was compromised by an attacker . Given below is an excerpt from a Snort binary capture of the attack. Decipher the activity carried out by the attacker by studying the log. Please note that you are required to infer only what is explicit in the excerpt.
(Note: The student is being tested on concepts learnt during passive OS fingerprinting, basic TCP/IP connection concepts and the ability to read packet signatures from a sniff dump.)
03/15-20:21:24.107053 211.185.125.124:3500 -> 172.16.1.108:111 TCP TTL:43 TOS:0x0 ID:29726 IpLen:20 DgmLen:52 DF
***A**** Seq: 0x9B6338C5 Ack: 0x5820ADD0 Win: 0x7D78 TcpLen: 32 TCP Options (3) => NOP NOP TS: 23678634 2878772
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=
03/15-20:21:24.452051 211.185.125.124:789 -> 172.16.1.103:111 UDP TTL:43 TOS:0x0 ID:29733 IpLen:20 DgmLen:84
Len: 64
01 0A 8A 0A 00 00 00 00 00 00 00 02 00 01 86 A0 ……………. 00 00 00 02 00 00 00 03 00 00 00 00 00 00 00 00 ……………. 00 00 00 00 00 00 00 00 00 01 86 B8 00 00 00 01 …………….
00 00 00 11 00 00 00 00 ……..
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+= 03/15-20:21:24.730436 211.185.125.124:790 -> 172.16.1.103:32773 UDP TTL:43 TOS:0x0 ID:29781 IpLen:20 DgmLen:1104
Len: 1084
47 F7 9F 63 00 00 00 00 00 00 00 02 00 01 86 B8
What information do you need to recover when searching a victims computer for a crime committed with specific
What information do you need to recover when searching a victims computer for a crime committed with specific e-mail message?
What can an investigator examine toverify that a file has the correct extension?
One technique for hiding information is to change the file extension from the correct one to one that might not be noticed by an investigator. For example, changing a .jpg extension to a .doc extension so that a picture file appears to be a document. What can an investigator examine to
verify that a file has the correct extension?
This organization maintains a database of hash signatures for known software
This organization maintains a database of hash signatures for known software
The ____________________ refers to handing over the results of private investigations to the authorities becau
The ____________________ refers to handing over the results of private investigations to the authorities because of indications of criminal activity.
Can the Employer file a criminal complain with Police?
During the course of a corporate investigation, you find that an Employee is committing a crime. Can the Employer file a criminal complain with Police?
____________________ is simply the application of Computer Investigation and analysis techniques in the intere
____________________ is simply the application of Computer Investigation and analysis techniques in the interests of determining potential legal evidence.
What is the name of the Standard Linux Command that is also available as windows application that can be used
What is the name of the Standard Linux Command that is also available as windows application that can be used to create bit-stream images ?
To preserve digital evidence, an investigator should ____________________
To preserve digital evidence, an investigator should ____________________