CNET151 - Chapt 14 - Intro to Forensics

Frequently, the first responder to a computer crime is the network administrator.

• True

• False

You use the netstat command with a forensic copy of a machine to compare two files and show the differences.

• True

• False

The Windows Registry contains a list of USB devices that have been connected to the machine.

• True

• False

In Linux, you use the dd command to set up a target forensics server to receive a copy of a drive. True or False?

• True

• False

The chain of custody documents the handling of evidence from the moment of seizure until it is presented in court.

• True

• False

Most Windows logs are turned on automatically.

• True

• False

Windows stores information such as web addresses, search queries, and recently opened files in a file called index.dat.

• True

• False

Windows logging can be turned on and off with a tool called auditpol.exe.

• True

• False

The Windows fc command lists any active sessions connected to a computer. True or False?

• True

• False

The Windows Registry is organized into five sections referred to as hives. True or False?

• True

• False