Help
Options
Didn't know it?
click below
click below
Knew it?
click below
click below
Don't Know
Remaining cards (0)
Know
retry
shuffle
restart
0:00
Embed Code - If you would like this activity on your web page, copy the script below and paste it into your web page.
Normal Size Small Size show me how
Normal Size Small Size show me how
Digital F Mod 5&6
| Question | Answer |
|---|---|
| What is a Master File Table (MFT) in NTFS? | A database that contains information about every file and directory on the volume |
| What is the significance of Prefetch files in Windows forensics? | They store information about recently executed programs |
| What is the primary use of the Windows Task Scheduler in forensics? | To identify scheduled tasks that may indicate malicious activity |
| Which command is used to capture memory in a Windows forensic investigation? | memdump |
| Which of the following tools can analyze browser artifacts? | SQLite Browser |
| What is the main purpose of Pagefile in Windows forensics? | To act as virtual memory and store data that cannot fit in RAM |
| What does volatile data collection focus on? | Capturing data that will be lost when the system is shut down |
| Which registry key contains startup applications? | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run |
| What does the Windows Registry store? | Configuration settings and preferences for the operating system and applications |
| What is the primary role of metadata in Windows files? | To store creation, modification, and access details of files |
| What is the purpose of plists in macOS forensics? | To analyze preferences and configurations for applications |
| What is the significance of plists in macOS forensics? | They store application and user preference settings |
| Which tool is useful for parsing Spotlight databases on macOS? | SQLite Browser |
| What is the purpose of the /var/log directory in Linux? | To store system and application log files |
| What is the role of Spotlight in macOS forensics? | Indexing and searching files, including deleted metadata |
| What is the purpose of journaling in file systems like HFS+? | To log changes for data recovery in case of a system crash |
| Which Linux command is used to display open files by a process? | lsof |
| What does the inode in Linux file systems store? | Metadata about a file, such as permissions and timestamps |
| What is the main role of the Linux grep command in forensics? | Searching for specific patterns in text files |
| Where are user preferences typically stored on macOS? | /Library/Preferences |
| What is a key purpose of a SIEM system in network forensics? | Collecting, analyzing, and correlating log data from multiple sources |
| Which protocol is commonly used in email traffic? | IMAP |
| How can an IoC be identified from network traffic? | By detecting anomalies such as unusual traffic spikes |
| Which technique is used to bypass network firewalls? | DNS tunneling |
| What is the main function of network forensics tools like Zeek (formerly Bro)? | Analyzing and monitoring network traffic for security threats |
| Which log file format is commonly used in network forensics? | PCAP |
| What is packet sniffing? | Capturing and analyzing network packets to monitor traffic |
| What type of attack involves redirecting traffic to malicious websites? | DNS spoofing |
| What is a common indicator of a Distributed Denial of Service (DDoS) attack? | A sudden spike in network traffic from multiple sources |
| What is a honeypot used for in network forensics? | To divert and monitor potential attackers |
Created by:
jxxnixx