Computer ForensicsMidterm Exam
Name____________________________________
Answer the following questions.you can make your own assumptions.
1. Data acquisition – Study the acquisition methods used by Encase, FTK, and Prodiscover. Explain how the information is organized and stored when an image is created.For example, FTK creates and index of all data. Propose a method that is more efficient than the methods used by Encase, FTK, and Prodiscover.You answer needs to consider the case of creating an image of large volumes of data (terabytes). I am not asking about the procedure to create an image, but the way information is organized. You could use Artificial Intelligence search methods or some of the knowledge you learn in Data Structures.
2. Data Hidden-
a. Search the literature and write a paper describing data hidden techniques. Three pages long including the bibliography, 1.5 space, Times new roman 12.
b. Propose and describe your own data hidden method. Grading will be based on originality. For example, cryptography, steganography, etc, have been used for a long time.
3. Disk Encryption – password recovering tools.
a. Search the Web and find and describe in detail five of the most common open source password recovering tools.
b. Create 9 passwords 6 characters long as follows: three weak (names or dictionary words); 3 of medium complexity (uppercase + lower case + digits), and 3 strong password (special characters).Using the tools you described in question 3a, recover the 9 passwords. Record the time it took to recover each password. Include a table with all the results.
4. Virtual Machines. – Install an open source VM. With the VM running, create a few files (word, ppt, xls, you can include pictures (.gif, .jpeg). Then delete all the files and remove them from the recycle bin. Next, delete the virtual machine. Explain and demonstrate how you can recover the deleted files after deleting the VM.
5. Computer Forensics Tools –
a. Write a summary of the most recent open source computer forensics tools. Explain the tool, target OS, functions, etc.Three pages long including the bibliography, 1.5 space, Times new roman 12.
b. Summarize three of the computer forensics tools evaluated in the National Institute of Standards (NIST) Forensics Tool Testing handbook www.oftt.nist.gov