Computer Forensics Questions and Answers
1. What Is An .iso File?
An ISO file contains an application or CD image of several files and executables. Most app software can be made into an ISO that you then mount as a virtual drive and can browse files within the ISO. New Windows versions come with internal ISO mounting capabilities.
2. What Is Md5 Checksum?
MD5 checksum is a 128 bit value that helps identify the uniqueness of a file. You can have two file names, but each will have a different checksum. You use these checksums to compare two different files to identify if they are the same.
3. Name Some Common Encryption Algorithms That Are Used To Encrypt Data?
Some common ones include triple DES, RSA, Blowfish, Twofish and AES.
4. What Is A Sam File?
A SAM, or Security Accounts Manager, file is a file specifically used in Windows computers to store user passwords. It’s used to authenticate both remote and local Windows users, and can be used to gain access to a user’s computer.
5. What Is Data Mining?
Data mining is the process of recording as much data as possible to create reports and analysis on user input. For instance, you can mine data from various websites and then log user interactions with this data to evaluate which areas of a website are accessed by users when they are logged in.
6. What Is Data Carving?
Data carving is different than data mining in that data carving searches through raw data on a hard drive without using a file system. Data carving is essential for computer forensics investigators to find data when a hard drive’s data is corrupted.
7. What Operating Systems Do You Use?
Most computer forensic experts know at least one operating system well. Be honest with this question, but you should know either Windows, Linux or Mac operating systems well.
8. What Type Of Email Analysis Experience Do You Have?
Computer forensics relies on email analysis. You should be experienced with email servers such as MS Exchange and free web-based platforms such as Gmail and Yahoo.
9. What Is Steganography?
Steganography conceals a message within a message. In other words, someone can send an email message with content that says one thing, but every third word comprises a second message that makes sense to a recipient.
10. What Are Some Common Port Numbers?
TCP port numbers are the virtual connections created by computers and applications. Common port numbers are 21 for FTP, 80 for web services, 25 for SMTP and 53 for DNS.
11. Explain The Sha-1 Hash?
The secure hash algorithm 1 is a hash algorithm that creates a 160-bit or 20-byte message digest.
12. How Would You Handle Retrieving Data From An Encrypted Hard Drive?
First determine the encryption method used. For simple encryption types, try finding the configuration file. Use tools such as EaseUS Data Recovery, Advanced EFS Data Recovery or Elcomsoft Forensic Disk Decryptor. You can also use brute force methods.
13. What Port Does Dns Run Over?
53
14. What Are Some Security Issues Related To The Cloud?
The biggest issue is the increased potential for data breaches or exfiltration as well as the potential for account hijacking. The Man in Cloud Attack is a new threat specific to Cloud usage. It is similar to the MitM attack, where an attacker steals the user token which is used to verify devices without requiring additional logins. Cloud computing introduces insecure API usage, which is discussed on the OWASP Top 10 Vulnerabilities list.
15. Explain Some Of The Vulnerabilities Listed On The Owasp Top 10 Vulnerabilities List?
This list is updated yearly with the current top 10 application security risks. Cross-site scripting is one item that has been on the list year after year. But others on the most current list include injections such as SQL, OS and LDAP, security misconfigurations, sensitive data exposure and under-protected APIs.
16. What Is An Acl?
An access control list. It is a list used to grant users and processes access to system resources.
17. How Would You Be Able To Tell At The Hex Level That A File Has Been Deleted In Fat12?
Run fsstat against the FAT partition to gather details. Run fls to get information about the image files. This will return information about deleted files and the metadata information.
18. What Are Some Tools Used To Recover Deleted Files?
Recuva, Pandora Recovery, ADRC data recovery, FreeUndelete, Active UNDELETE, Active partition or File recovery and more.
19. If You Needed To Encrypt And Compress Data For Transmission, Which Would You Do First And Why?
Compress then encrypt. Because encryption takes up resources and can be cumbersome to perform, it makes sense to compress the data first.
20. What Is The Difference Between Threat, Vulnerability And Risk?
A threat is what a potential attacker poses, by potentially using a system vulnerability that was never identified as a risk. Using this answer provides context for the three terms together, but you can define them separately.
- A threat is the possibility of an attack.
- A vulnerability is a weakness in the system.
- Risks are items that may cause harm to the system or organization.
21. Explain Your Home Network?
In cybersecurity-related positions, interviewers often want to know your interest in security spills over into your personal life as well. Make sure you know the security features of your router or your specific ISP. Be sure to mention any additional security measures you have added to your home network.