Busy. Please wait.

show password
Forgot Password?

Don't have an account?  Sign up 

Username is available taken
show password


Make sure to remember your password. If you forget it there is no way for StudyStack to send you a reset link. You would need to create a new account.
We do not share your email address with others. It is only used to allow you to reset your password. For details read our Privacy Policy and Terms of Service.

Already a StudyStack user? Log In

Reset Password
Enter the associated with your account, and we'll email you a link to reset your password.

Remove Ads
Don't know
remaining cards
To flip the current card, click it or press the Spacebar key.  To move the current card to one of the three colored boxes, click on the box.  You may also press the UP ARROW key to move the card to the "Know" box, the DOWN ARROW key to move the card to the "Don't know" box, or the RIGHT ARROW key to move the card to the Remaining box.  You may also click on the card displayed in any of the three boxes to bring that card back to the center.

Pass complete!

"Know" box contains:
Time elapsed:
restart all cards

Embed Code - If you would like this activity on your web page, copy the script below and paste it into your web page.

  Normal Size     Small Size show me how


4th amendment protects everyone's right to be secure in their person, residence, and property
Police workstation one computer every 250,000
Live Acquisition data can be changed, it also capture memory and can easily solve the problem of encrypted disk
static acquisition data cannot be changed
main formats for data storage raw, proprietary, advanced forensics
method of data acquisition disk to image, disk to disk, logical
private sector investigation don't do any further investigation until you receive court order
windows startup task we learn what files to access when windows starts, will help determine when the computer was last accessed
evaluating forensics tools validating yourself experience, NIST tools, validation protocol
4 blocks component in Unix boot block, super block, inode, data block
2 linux loaders LILO, GRUB
how to validate data with FTK and Prodiscover use KFF(Smartfile), Using .eve file
main data hiding file manipulation, encryption, disk manipulation
graphics format type bitmap, vector, metafile
network forensics systematic tracking of incoming and outgoing traffic. Ascertains how an attack was carried out or how an event occurred on a network
how to examine e-mail headers return path, name of the e-mail server, recipients email address, IP address of sending server, unique message #, date and time email was sent
Created by: ITSec_guy