Forensics: summary questions¶

The questions are randomised per student, and for these questions you receive only correct / incorrect feedback. In each question of Problem 1 there is exactly one correct option.

In Problem 2, each student is randomly assigned at least one correct option, usually more. For a partially correct answer Plussa gives incorrect, but Problem 2 is accepted when the score is 12 or higher and the points are shown on a yellow background. Point accumulation begins only when more than half of the choices are correct. The score cannot be used to directly determine whether an individual choice is correct or not.

Question 1

Forensics has increasingly moved from the study of implicit traces towards explicit ones, and the reason for this is

the increasing prevalence of computer crime.

the loosening of legislation concerning telecommunications traffic data.

increased logging due to the growth of memory capacity.

the shift of calls from the telephone network to Internet-based calls.

Question 2

How does forensics (F) relate to reverse engineering (RE)?

F can be interpreted as a subfield of RE.

RE can be interpreted as a subfield of F.

RE has nothing to do with F.

A forensic investigator can interpret implicit traces using RE techniques.

Question 3

Consider carefully what kinds of traces left by a possible crime can be investigated using forensics. Violation of which law is not relevant here?

Data Protection Act

Criminal Code

Coercive Measures Act

Question 4

In forensic investigation, the easiest task is to

find traces.

interpret traces.

keep discovered traces preserved.

convince the court of the correctness of the interpretation of traces.

Question 5

Destroying a file even by multiple overwrites does not necessarily guarantee that the information contained in the file cannot still fall into unauthorised hands. If a leak occurs, which of the following is the most likely reason?

The attacker has installed a Trojan horse in the overwriting program that copies and sends the data before normal operation.

The overwriting program fails to reach all storage blocks of the file on the disk due to faulty file system behaviour.

The attacker first obtains the file name from some archive listing and then manages to find a copy of the file on another storage medium.

Even when overwritten, the magnetic field used to store the original data can be revealed using specialised equipment.

Question 6

Which of the following is the smallest problem when trying to ensure that some information disappears without a trace?

Autosave files created by a word processor if the program crashed during editing.

A file encrypted with a separate encryption program whose name has been forgotten—assuming that the long encryption passphrase used has also been forgotten.

Macro viruses attached to a file saved by a word processor.

Information converted to HTML and read only using a browser on the same machine, after which the browser cache has been cleared.

Select the correct statements. You may select one or more options.

Question 1

From a forensic investigator’s perspective, the use of steganography presents a more difficult challenge than strong encryption whose key cannot be obtained.

Metadata is of interest to a forensic investigator.

Forensics uses many kinds of software, but spyware does not belong among them.

From a technical perspective, the working position of a forensic investigator somewhat resembles that of an attacker who has gained control of a computing device.

Data protection regulations now decisively restrict the ability of forensics to investigate traces of crimes.

When a forensic investigator examines data stored by a user’s browser, they are working with explicit traces.

If a PDF editor corrupts the header data when saving so that it can no longer open the file, the data in the file has become residual information.

Even if the operating system cannot find any application with which to open a certain file, it is still not residual information.

A forensic investigator is powerless in the face of encrypted data.

Residual information can be particularly useful from a forensic investigator’s perspective.