Scribd
Upload
47 views

Varsha T2 2021: ICT741 Digital Forensics Tutorial 7

This document provides an overview of tutorial 7 on digital forensics. It contains review questions on topics like virtual machine extensions, hypervisors, virtual machine file formats, forensic imaging of VMs, and network forensics tools. There are also two quick quizzes with additional questions on order of volatility, packet analyzers, honeypots, and honeywalls. The document was compiled by Dr. Saeid Iranmanesh from the textbook "Guide to Computer Forensics and Investigations".

Uploaded by

Nimra Zaheer
Copyright
© © All Rights Reserved
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
47 views

Varsha T2 2021: ICT741 Digital Forensics Tutorial 7

This document provides an overview of tutorial 7 on digital forensics. It contains review questions on topics like virtual machine extensions, hypervisors, virtual machine file formats, forensic imaging of VMs, and network forensics tools. There are also two quick quizzes with additional questions on order of volatility, packet analyzers, honeypots, and honeywalls. The document was compiled by Dr. Saeid Iranmanesh from the textbook "Guide to Computer Forensics and Investigations".

Uploaded by

Nimra Zaheer
Copyright
© © All Rights Reserved
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
You are on page 1/ 4

Varsha

T2 2021: ICT741 Digital Forensics

Tutorial 7

Questions and Projects are prepared from Cengage Learning Resource ‘Guide to Computer Forensics and Investigations’. Nelson, B, Phillips, A. &
Steuart, C 2018, Sixth Edition, Cengage Learning US. Mason. OH

ICT741 Tutorial 7 Compiled by: Dr Saeid Iranmanesh Date: 5 July 2021


Review Questions

1. Explain Virtual Machine Extensions (VMX) are part of which


technology?
Intel virtualized technology
2. You can expect to find a type 2 hypervisor on what type of device?
Laptop, desktop, tablet
3. Which of the file extensions are associated with VMware virtual
machines?
vmdk, vmsd, vmx, nvram
4. In VirtualBox, a(n) .vbox file contains settings for virtual hard drives.
5. The number of VMs that can be supported per host by a type 1 hypervisor
is generally determined by the amount of RAM and Storage.
6. A forensic image of a VM includes all snapshots. True or False?
False
7. Which Registry key contains associations for file extensions?
hkey_classes_root
8. How do you know that a virtual machine has been installed on a host
system?
9. To find network adapters, you use the ipconfig command in Windows and
the ifconfig command in Linux.
10. What are the three modes of protection in the DiD strategy?
People, technology, operations
11. A layered network defense strategy puts the most valuable data
where?
Innermost part of the network
12. Tcpslice can be used to retrieve specific timeframes of packet captures.
True or False?
True
13. Packet analyzers examine what layers of the OSI model?
Layer 2 and 3
14. When do zero-day attacks occur?
Before patch is available

Questions and Projects are prepared from Cengage Learning Resource ‘Guide to Computer Forensics and Investigations’. Nelson, B, Phillips, A. &
Steuart, C 2018, Sixth Edition, Cengage Learning US. Mason. OH

ICT741 Tutorial 7 Compiled by: Dr Saeid Iranmanesh Date: 5 July 2021


Questions and Projects are prepared from Cengage Learning Resource ‘Guide to Computer Forensics and Investigations’. Nelson, B, Phillips, A. &
Steuart, C 2018, Sixth Edition, Cengage Learning US. Mason. OH

ICT741 Tutorial 7 Compiled by: Dr Saeid Iranmanesh Date: 5 July 2021


Quick Quiz 1
1. A type 2 hypervisor rests on top of an existing OS, such as Windows, Linux, or Mac
OS.

2. True or False: Instruction sets called Virtual Machine Extensions (VMX) are
necessary to use virtualization; without these instruction sets, virtualization
software doesn’t work.
True

3. By linking a VM’s IP address to log files, you might be able to determine what Web
sites the VM accessed.

4. Live acquisitions of VMs are necessary because they include all snapshots.

5. Which hypervisor type can be installed directly on hardware and is limited only
by the amount of available RAM, storage, and throughput?
Type 1 hypervisor

Quick Quiz 2

1. The amount of time that a long a piece of information lasts on a system is known as
order of volatility (OOV).

2. Network forensics is the process of collecting and analyzing raw network data and
systematically tracking network traffic to ascertain how an attack was carried out or
how an event occurred on a network.

3. True or False: Testing networks is not as important as testing servers.


False

4. Packet Analysers are devices and/or software placed on a network to monitor traffic.

5. A(n) Honeypot is a computer set up to look like any other machine on your network;
its purpose is to lure attackers to your network, but the computer contains no
information of real value.

6. Honey walls are computers set up to monitor what’s happening to honeypots on your
network and record what attackers are doing.

Questions and Projects are prepared from Cengage Learning Resource ‘Guide to Computer Forensics and Investigations’. Nelson, B, Phillips, A. &
Steuart, C 2018, Sixth Edition, Cengage Learning US. Mason. OH

ICT741 Tutorial 7 Compiled by: Dr Saeid Iranmanesh Date: 5 July 2021

You might also like