D431 Digital Forensics in Cybersecurity - Set 1 - Part 3

Correct Answer: An analysis method that requires minimal information about the file system

Zero-knowledge analysis involves recovering data from a damaged file system with limited knowledge about the system itself, often used in forensic analysis.

Correct Answer: Email headers

Email headers provide critical information, such as the sender, recipient, and routing details, which are essential in forensic investigations involving email.

Correct Answer: Communications Assistance to Law Enforcement Act (CALEA)

CALEA requires telecommunications carriers to design their systems with built-in surveillance capabilities to allow law enforcement to monitor communications.

Correct Answer: Cloning a SIM card to preserve data for analysis

A forensic SIM cloner is used to create an exact copy of a SIM card so that data can be preserved and analyzed without altering the original.

Correct Answer: To maintain minimal operations during a disruption

A business continuity plan (BCP) ensures that a business can continue to operate at a basic level during a disaster or disruption until full operations can be restored.

Correct Answer: MP3Stego

MP3Stego is a steganography tool used to hide data within MP3 audio files, allowing covert communication within the audio stream.

Correct Answer: A virus that stays active in RAM after the system boots

A memory-resident virus loads into the computer's RAM during the boot process and stays active while the system is running, allowing it to execute malicious actions without needing to infect files on the disk.

Correct Answer: Real evidence refers to physical objects, while documentary evidence is stored in electronic or written form

Real evidence includes tangible objects like hardware, while documentary evidence includes written or digital documents, such as emails or contracts.

Correct Answer: A cipher that encrypts data in fixed-size blocks

A block cipher encrypts data in fixed-size blocks, typically 64 or 128 bits at a time, unlike stream ciphers, which encrypt data bit by bit.

Correct Answer: Unlawful Access to Stored Communications Act

The Unlawful Access to Stored Communications Act regulates how law enforcement can access stored account records and contents from service providers, including ISPs and telecommunications companies.