Boston University Digital Forensics Questions

Description

What are some of the advantages and disadvantages of setting up a forensic workstation based on a distribution of Linux?

What are the steps to perform an e-mail abuse investigation? What do you need to conduct an e-mail abuse investigation?

What are the minimum requirements for a forensics lab?

What are some of advantages and disadvantages of mobile forensic workstations implemented using laptop PCs?

Describe the advantages and disadvantages of using raw format.

What are the four different methods for acquiring data?

Describe the steps to create an image file.

What are the differences between private-sector computing investigations and investigations handled by law enforcement agencies?

What is a partition? How many primary and extended partitions can a Windows Operating System have?

How can you determine the type of a file? What tools are used in determining the type of a file?

Describe the subfunctions of the digital evidence extraction phase.

Compare and contrast hardware and software write-blockers.

What are some of the techniques you can use to re-create a suspect’s disk drive?

What is the main purpose of inodes in Linux? What information does an inode contain?

Describe the major steps for reconstructing file fragments.