FDInal Lecture

What is a standard of Digital Forensics for handling computer based evidence?

• ISO52231:2023

• ACPO Guidelines

• The Computer Data Retention Standards

• The Data Protection Act 2018

Why do you want to keep contemporaneous notes of your investigations

• To keep a log of how you found all notable information

• It is a legal requirement

• To help you remember where you have gotten up to

• It protects data from being tampered

What does FAT stand for

• File All Tables

• File Allocation Tables

• FAT is the full name

• Full Allocation Tables

Which program allows you to make a bit for bit copy of a device

• EnCase

• Autopsy

• FTK Imager

• AIM

What is the UK law which governs how personal information should be handled?

• The Computer Use Act

• The Information Protection Act

• I don't know

• The Data Protection Act

Why is it a good idea to duel verify findings in digital forensics?

• It is a legal requirement

• To make sure that the tool worked correctly and you get the same result for both

• To protect from data being changed

• You shouldn't need dual verify anything

What happens when you shift delete a file?

• It deletes and bypasses the recycle bin

• It deletes and wipes each bit to a 00 level

• Just a regular delete

• Your computer explodes

Is it legal to image you best mates computer without them knowing

• Yes, I know they would allow me

• No you can never image someone else's drive

• Yes, if I got permission from them before

• Don't need, gunna do it anyway

What forensic method can recover fragmented or deleted files based on patterns?

• File Mismatch Analysis

• File Carving

• Image Recovery Analysis

• Rootkit Functional Abolishment Recovery Drive Process

Me when the when the?

• He then me he

• When the When the

• He me

• This isn't digital forensics related?