Description
Q2. should you perform a live data collection on each system you suspect is compromised? Explain your answer
write blocker if you going to boot a linux-based CD? Explain why or why not.
Q6. How would you quickly identify whether a large pcap file with thousands of sessions contained FTP activity? How would you extract the transferred files?*
Q7. You have configured and used the open source forensics tool FTimes and learned its capabilities. Especially for change detection. Explain how you might use FTimes as a component in your home network security.
Q8. Given the following scenario, explain how you would proceed an investigation stockholder tells you that one of the most critical objectives is to prove that a file with a specific MD5 hash was not present on a system at the time of analysis. You have a recent forensic disk image for the system.
Q10.List the types of data you would collect in a live response. Hint this is volatile data that is no longer accessible after a system shut down.
Q13.List the requirements for digital forensics tools as described in the Media book?
Q16. Do you believe that digital forensics should be a core component of information assurance curriculum? Why or why not?
Explanation & Answer
Thank you for choosing me
1
Running Head: NETWORK AND COMPUTER FORENSICS
Network and Computer Forensics
Student’s Name
Institution
2
NETWORK AND COMPUTER FORENSICS
Network and Computer Forensics
Question 2
Yes, sometimes the compromised system may have incident data due to malicious code
like LKM based rootkits which are loaded in the memory and don’t modify any file. A similar
situation may also exist in the operating system where Code Red worm may be witnessed which
instead of being saved as a file it was inserted into and then run the memory.
Question 6
This is done by getting the file that was downloaded. This is done so as to have a copy of
malware or the exploit so as to analyze it through reversing engineer.
Files are usually extracted by first of all identify the original sources where t...
Review
Review
