FRSC 2750 - Exam Questions and Answers

FRSC 2750 - Exam Questions and Answers Plaso's pinfo command (choose all that apply): Is a command-line interface (CLI) tool. Filters, sorts and conducts analysis on the plaso database file. Extracts and processes events in a single step. Displays infromation about the plaso database file. Exports file content from a device, media image, or forensic image. - answer- a, d The regular expression CO*IS will return (instances separated by spaces): SIOC ISOC SICO COSI CIS COIS COOIS COOOIS IS COIS COCOIS COCOCOIS COAIS COBIS COCIS CODIS CO IS COI OIS - answer- b Timeline analysis: Places the artefact within the context of user and system activity. Requires an accurate stopwatch. Is independent of the context of user and system activity. Is an unimportant component of digital forensic investigations. Is best used when you are looking to exonerate the suspect. - answer- a MAC times refer to: Modified, accessed and created times that are records created by the filesystem as files are created, edited, or accessed. Times found on an Apple device. Modified, accessed and created times that are records created by the operating system as files are created, edited, or accessed. Modified, accessed and corrupted times that are records created by the filesystem as files are created, edited, or accessed. Made, accessed and created times that are records created by the operating system as files are created, edited, or accessed. - answer- a Brian Carrier's progression of media analysis, in order, is: Disk, volume, filesystem, data unit, metadata. Filesystem, volume, disk, data unit, metadata. Disk, volume, data unit, filesystem, metadata. Filesystem, disk, volume, data unit, metadata. Disk, volume, data unit, metadata, filesystem. - answer- a Bad blocks, sectors, or clusters are (choose all that apply): The same as unallocated space. Unavailable to forensic examination. The space on a disk that has been marked as bad by the filesystem because of a defect. Potential areas to hide data away from casual inspection. Full of useful data. - answer- c, d The creation of a pre-fetch file starts with: The hexadecimal numbers xE5 x00. A change in the file. The hexadecimal numbers x00 x4F. Timestamp 00:00:00. System start-up. - answer- d In the FAT filesystem on deletion of a file (choose all that apply): The file allocation tables entries are reset to x00. The MFT is deleted. Data is irretrievably gone. The directory entry is changed to xE5. Data will never be deleted. - answer- a, d The regular expression CO+IS will return (instances separated by spaces): COIS COISIS COISISIS COISISISIS COIS COCOIS COCOCOIS COCOCOCOIS CIS COIS COOIS COOOIS COIS COOIS COOOIS COOOOIS COIS COIIS COIIIS COIIIIS - answer- d Plaso is (choose all that apply): Originally a replacement for a Perl version. Free to download. The Python backend and framework for the log2timeline tool. A forensic imaging tool. The Python backend and framework for the log2longtime tool. - answer- a, b, c The following forensic suites may be used to analyze timeline data (choose all that apply): Recon Lab. Belkasoft Evidence Center. X-Ways. Paladin. Autopsy. - answer-