WGU Digital-Forensics-in-Cybersecurity - Digital Forensics in Cybersecurity (D431/C840) Course Exam

Comprehensive and Detailed Explanation From Exact Extract:

Magnetic hard drives generally have a lower cost per gigabyte compared to solid-state drives (SSDs). However, they are more susceptible to mechanical damage and slower in data access.

SSDs have no moving parts and provide better durability and speed but at a higher price.

Forensics practitioners consider these differences during evidence acquisition.

Comprehensive and Detailed Explanation From Exact Extract:

The chain of custody is a documented, chronological record detailing the seizure, custody, control, transfer, analysis, and disposition of evidence. Maintaining this record proves that the evidence was protected and unaltered, which is essential for court admissibility.

Each transfer or access must be logged with date, time, and handler.

Breaks in the chain can compromise the legal validity of evidence.

Comprehensive and Detailed Explanation From Exact Extract:

The browser cache stores recently accessed web pages, images, and cookies, which may include phishing site content and related activity. Investigators analyzing phishing attacks collect browser cache data to reconstruct the victim’s web activity and detect malicious sites.

Cached web pages help corroborate victim statements and establish timelines.

Browser history and cache are volatile and must be preserved promptly.

Comprehensive and Detailed Explanation From Exact Extract:

NIST Special Publication 800-72 provides guidelines for mobile device forensics and identifies four device states during data extraction: active, idle, powered off, and locked. These states influence how data can be accessed and preserved.

Understanding these states helps forensic investigators select appropriate acquisition techniques.

NIST SP 800-72 is a key reference for mobile device forensic methodologies.

Comprehensive and Detailed Explanation From Exact Extract:

A bit-level (bitstream) copy creates an exact sector-by-sector duplicate of the original media, capturing all files, deleted data, and slack space. This method is essential to preserve the entirety of digital evidence without modification.

Bit-level imaging maintains forensic soundness.

It allows investigators to perform analysis without altering original data.

Comprehensive and Detailed Explanation From Exact Extract:

The ipconfig command executed at a Windows command prompt displays detailed network configuration information such as IP addresses, subnet masks, and default gateways. Collecting this information prior to seizure preserves volatile evidence relevant to the investigation.

Documenting network settings supports the understanding of the suspect system's connectivity at the time of seizure.

NIST recommends capturing volatile data (including network configuration) before shutting down or disconnecting a suspect machine.

Comprehensive and Detailed Explanation From Exact Extract:

The 'dd' command is a Unix/Linux utility used to perform low-level copying of data, including forensic imaging. It allows bit-for-bit copying of drives or memory, making it a common tool in Linux-based forensic environments.

Windows does not natively support 'dd'; similar imaging tools are used there.

The command syntax and file paths indicate Linux/Unix usage.

Comprehensive and Detailed Explanation From Exact Extract:

When collecting evidence from a running system, volatile and critical evidence such as security logs should be collected first as they are most susceptible to being overwritten or lost. Security logs may contain valuable information on unauthorized access or malicious activity.

Chat room logs, recently accessed files, and temporary internet files are important but often less volatile or can be recovered from disk later.

NIST SP 800-86 and SANS Incident Response Guidelines prioritize the collection of volatile logs and memory contents first.

This approach helps ensure preservation of time-sensitive data critical for forensic analysis.

Comprehensive and Detailed Explanation From Exact Extract:

Microsoft Exchange Server uses the.edbfile extension for its Extensible Storage Engine (ESE) database files. These.edbfiles contain the mailbox data including emails, calendar items, and contacts.

.nsfis used by IBM Lotus Notes.

.mailand.dbare generic extensions but not standard for Exchange.

The.edbfile is the primary data store for Exchange mailboxes.

Comprehensive and Detailed Explanation From Exact Extract:

StegVideo is a steganographic tool designed to embed hidden messages within multimedia files such as sound, video, and image files, making it suitable for multi-media steganography.

Snow is mainly used for text-based steganography.

MP3Stego is specialized for MP3 audio files only.

Stealth Files 4 is a general steganography tool but less commonly referenced for multimedia.

Forensic and academic sources identify StegVideo as a tool for multimedia steganography, useful in complex digital investigations.