This is original file structure database that Microsoft originally designed for floppy disks. It is written to
This is original file structure database that Microsoft originally designed for floppy disks. It is written to the outermost track of a disk and contains information about each file stored on the drive.
What should you do when approached by a reporter about a case that you are working on or have worked on?
What should you do when approached by a reporter about a case that you are working on or have worked on?
Which of the following refers to the data that might still exist in a cluster even though the original file ha
Which of the following refers to the data that might still exist in a cluster even though the original file has been overwritten by another file?
Where did the incident team go wrong?
A state department site was recently attacked and all the servers had their disks erased. The incident response team sealed the area and commenced investigation. During evidence collection they came across a zip disks that did not have the standard labeling on it. The incident team ran the disk on an isolated system and found that the system disk was accidentally erased. They decided to call in the FBI for further investigation. Meanwhile, they short listed possible suspects including three summer interns. Where did the incident team go wrong?
When investigating a Windows System, it is important to view the contents of the page or swap file because:
When investigating a Windows System, it is important to view the contents of the page or swap file because:
What do you think would be the next sequence of events?
Chris has been called upon to investigate a hacking incident reported by one of his clients. The company suspects the involvement of an insider accomplice in the attack. Upon reaching the incident scene, Chris secures the physical area, records the scene using visual media. He shuts the system down by pulling the power plug so that he does not disturb the system in any way. He labels all cables and connectors prior to disconnecting any. What do you think would be the next sequence of events?
The use of warning banners helps a company avoid litigation by overcoming an employees assumed _______________
The use of warning banners helps a company avoid litigation by overcoming an employees assumed __________________________ When connecting to the company’s intranet, network or Virtual Private Network(VPN) and will allow the company’s investigators to monitor, search and retrieve information stored within the network.
What does mactime, an essential part of the coroner’s toolkit do?
What does mactime, an essential part of the coroner’s toolkit do?
One way to identify the presence of hidden partitions on a suspect’s hard drive is to:
One way to identify the presence of hidden partitions on a suspect’s hard drive is to:
A honey pot deployed with the IP 172.16.1.108 was compromised by an attacker . Given below is an excerpt from
A honey pot deployed with the IP 172.16.1.108 was compromised by an attacker . Given below is an excerpt from a Snort binary capture of the attack. Decipher the activity carried out by the attacker by studying the log. Please note that you are required to infer only what is explicit in the excerpt.
(Note: The student is being tested on concepts learnt during passive OS fingerprinting, basic TCP/IP connection concepts and the ability to read packet signatures from a sniff dump.)
03/15-20:21:24.107053 211.185.125.124:3500 -> 172.16.1.108:111 TCP TTL:43 TOS:0x0 ID:29726 IpLen:20 DgmLen:52 DF
***A**** Seq: 0x9B6338C5 Ack: 0x5820ADD0 Win: 0x7D78 TcpLen: 32 TCP Options (3) => NOP NOP TS: 23678634 2878772
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=
03/15-20:21:24.452051 211.185.125.124:789 -> 172.16.1.103:111 UDP TTL:43 TOS:0x0 ID:29733 IpLen:20 DgmLen:84
Len: 64
01 0A 8A 0A 00 00 00 00 00 00 00 02 00 01 86 A0 ……………. 00 00 00 02 00 00 00 03 00 00 00 00 00 00 00 00 ……………. 00 00 00 00 00 00 00 00 00 01 86 B8 00 00 00 01 …………….
00 00 00 11 00 00 00 00 ……..
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+= 03/15-20:21:24.730436 211.185.125.124:790 -> 172.16.1.103:32773 UDP TTL:43 TOS:0x0 ID:29781 IpLen:20 DgmLen:1104
Len: 1084
47 F7 9F 63 00 00 00 00 00 00 00 02 00 01 86 B8