Guide to Computer Forensics and Investigations, 5e, 9781285060033
Ch. 6 Solutions-1
Chapter 6 Solutions
Review Questions
1. Forensic software tools are grouped into _________ and _______________
applications.
2. According to ISO standard 27037, which of the following is an important factor in
data acquisition? (Choose all that apply.)
3. One reason to choose a logical acquisition is an encrypted drive. True or False?
4. Hashing, filtering, and file header analysis make up which function of computer
forensics tools?
5. Hardware acquisition tools typically have built-in software for data analysis. True or
False?
6. The reconstruction function is needed for which of the following purposes? (Choose
all that apply.)
7. List three subfunctions of the extraction function.
8. Data can’t be written to disk with a command-line tool. True or False?
9. Hash values are used for which of the following purposes? (Choose all that apply.)
10. In testing tools, the term “reproducible results” means that if you work in the same
lab on the same machine, you generate the same results. True or False?
11. The verification function does which of the following?
12. What’s the advantage of a write-blocking device that connects to a computer through
a FireWire or USB controller?
13. Building a forensic workstation is more expensive than purchasing one. True or
False?
14. A live acquisition is considered an accepted practice in digital forensics. True or
False?
15. Which of the following is true of most drive-imaging tools? (Choose all that apply.)
16. The standards for testing forensics tools are based on which criteria?
17. A log report in forensics tools does which of the following?
18. When validating the results of a forensics analysis, you should do which of the
following? (Choose all that apply.)
19. The primary hash the NSRL project uses is SHA-1. True or False?
Hands-On Projects
Guide to Computer Forensics and Investigations, 5e, 9781285060033
Ch. 6 Solutions-3
Hands-On Project 6-1
This project is to show students that deleted files are still accessible on a drive until they’re
Hands-On Project 6-2
This project shows how to verify that a disk-wiping tool eliminates data from storage media
permanently.
Hands-On Project 6-3
The purpose of this project is to show students how data can be inserted in a drive by using a hex
Hands-On Project 6-4
In this project, students learn how to validate tools by comparison. They examine the same
Case Projects
Case Project 6-1
Students’ responses will vary, depending on the tools they selected and the available versions.
Case Project 6-2
Students should find Hex Fiend, HexEdit, and 0xED for Macintosh and HexEditor and Bless Hex
Editor for Linux.
Case Project 6-3