312-49v10 — Frequently Asked Questions

Legacy LM hashing splits or pads the password into two 7-character blocks and hashes each separately, so cracking works on two smaller spaces.

Yes; local Group Policy applies on the standalone server, and its SAM stores local account hashes, so domain replication timing is irrelevant.

The quotes mark jargon: in the IP ID idle scan the quiet helper host is called the zombie, so "idle system" names that role rather than describing an unused PC.

No. It only needs predictable, incremental IP ID behavior and no competing traffic; a botnet zombie, by contrast, is a host already taken over and running a bot.

The exit relay knows the destination server but receives traffic from the middle relay, so it does not see the suspect's source IP; origin tracing requires the entry/guard relay.

No. Bridges are unlisted entry points used to bypass censorship; the guard/entry relay remains the node that holds the client's source-side information.

It is a documented dd/Netcat alternative, but it depends on the fmem module and raw device access, while the question targets LiME's purpose-built TCP memory export from the suspect host.

The suspect machine must load LiME locally because that is where the RAM resides; the forensic workstation only receives the TCP stream with Netcat.

It captures all data, including deleted fragments, but imaging a large RAID server is too time- and resource-intensive for the stated constraint; sparse acquisition is targeted.

Yes. Sparse acquisition combines logical collection of selected files with capture of unallocated deleted fragments, which matches both requirements.

Password-protected packers gate the packed payload, so the unpacker needs the password to produce a usable unpacked file. Option A skips a required decryption step.

It can observe runtime behavior, but with a password-protected known packer the recommended next step is C: decrypt and unpack before deeper static or dynamic analysis.

ShellBags Explorer parses ShellBag registry data, not LNK shortcut files; LNKs may show target paths but do not directly reconstruct deleted folder views and mounted-drive history like BagMRU/Bags do.

No. ShellBags show that a folder was viewed or interacted with in Explorer and can persist after deletion, but they are circumstantial evidence and should be correlated with other artifacts.

A null cipher selects hidden letters from a cover text by position and needs no physical overlay. The recovered plastic template is the distinctive tool of a grille cipher.

A grille cipher requires sender and receiver to use the same hole pattern. Finding duplicates at many suspects' desks shows a shared decoding template rather than ordinary text steganography.

A cluster (allocation unit) is a logical file-system construct made of one or more consecutive sectors, so it is always equal to or larger than a single sector.

A platter surface is divided into concentric tracks, and each track is subdivided into sectors, the smallest physically addressable block (512 bytes or 4 KB).

Slack space can hold remnants of deleted content, but NTFS metadata for files and directories lives in MFT records, so EnCase parses the MFT first; orphaned records go to Lost Files.

It places the entry in the Lost Files folder, which holds files parsed from unallocated MFT clusters; this behavior applies to NTFS volumes, not FAT.

Process Monitor records file, registry, process and network activity; it does not enumerate interactive or remote user sessions like PSLoggedon.

Yes, PsLoggedon can report local and resource-based logons for a remote computer when permissions allow.

myisamchk checks, repairs, and optimizes MyISAM tables; it does not process the MyISAM log file, which is myisamlog's purpose.

No; myisamlog can display the log and can also perform recovery operations on the MyISAM log file when used accordingly.

The disk is a tangible object you can seize and bag; the image file is logical data you preserve by hashing and copying. The question asks about the file itself, not the media.

Printed publications are tangible paper items that can be collected, labelled and entered into a chain of custody, so they count as physical evidence.

SAM stores local account password hashes, while SYSTEM contains the boot key needed to decrypt them; PWdump7 uses both to produce usable LM/NTLM hashes.

Nuix is an eDiscovery and forensic analysis platform for processing and reviewing data, not a dedicated utility for dumping local SAM account hashes.

pslist only walks the active process linked list, so it can miss unlinked hidden processes and does not scan process memory for injected PE regions.

It scans process memory for suspicious executable regions and PE headers that may indicate hidden processes, injected code or injected DLLs.

Malvertising is the ad-delivery vector; the question describes silent installation via a browser flaw during a site visit, which is the drive-by download itself.

Phishing relies on user interaction with a deceptive message or page, while a drive-by download needs only the visit and a browser or plugin vulnerability.

No live-triage need is described; the smartwatch is crime-scene evidence, so a forensic image must preserve its stored data before any extraction or analysis.

After the device is imaged and legally preserved; cloud and mobile-linked data are later investigative sources, especially because the paired smartphone is unavailable.

Dead acquisition requires powering down the system, which destroys volatile cloud-session data and mounted container state before they can be captured.

Yes, open files and command history remain useful, but this question's cloud-service wording makes the cloud-specific volatile evidence in C the better match.

Fingerprint protection comes after the scene is documented and surveyed; handling the keyboard first destroys the positional context and the record of how the scene was found.

Only after the scene is documented and the search is planned; the log then records each item identified and collected, so starting it first skips a CHFI stage.