Computer Forensics - Midterm Exam

INFA 650 – Computer Forensic

MID-TERM

Due Date: June 30, 2020 by 12pm Eastern Standard Time.

Use your required readings. It is okay to research Internet sources, however be certain to cite ALL sources using APA style, however, no credit will be provided for uncited answers, or sources that do not resolve to reflect the correct answer.

1. (10 points). Discuss how digital forensic procedures may differ when used in support of law enforcement versus when used for incident response and how computer forensics tools might be integrated into incident response.

2. (10 points). What are the qualifications of an expert witness as discussed in Federal Rules of Evidence, Rule 702?

3. (10 points). In your labs, you “hashed” files that you added as evidence. Explain the use of hashes in authenticating evidence. Address how collisions might negatively impact a case. How would an investigator avoid collisions?

4. (10 points). Discuss the importance of timestamping server and network log files that might be used as evidence to a court case. How would digitally signing log files support their use as evidence?

5. (5 points). How do attackers use anti-forensic tools to misdirect an investigation? List at least 3 common anti-forensic techniques.

6. (5 points) What is the significance of the 4th Amendment to a forensic investigation? If you are a corporation, what is the best way to ensure that users waive any expectation of privacy when using their computers?

7. (10 points). Discuss why a live analysis is preferred over a “dead” analysis and the issue of “volatility”. In an investigation, what information would need to be captured first?

8. (10 points) As a forensic investigator, provide two examples, one of a corporate investigation and one of a criminal investigation, in which you would be asked to investigate. Identify where the evidence supporting each of these cases in your example would be likely to reside.

9. (10 points) Discuss how capturing a bit-stream image differs from simply copying the contents of a suspect’s hard drive to an evidence drive. What information would be present in a bit-stream image that would not be present if you just copied the drive?

10. (10 points) Identify at least 1 challenge and a possible solution to acquiring network data that you don’t have when acquiring computer data.

11. (10 points). Discuss why the Cloud is a challenge to network forensics.