Which statement describes a feature of timestamps in Linux? Furthermore, restarting a computer may change or overwrite files and inadvertently destroy evidence.ġ7.
To prevent tampering and alteration of the suspect data, a data forensic analysis should be conducted on a copy of the suspect computer. iptables -I OUTPUT -p tcp -d 209.165.202.133 –dport 7777 -j DROPĭigital forensic investigation is the science of collecting and examining electronic evidence that can evaluate damage to a computer as a result of an electronic attack or that can recover lost information from a system in order to prosecute a criminal.Which command should the administrator use? The IT administrator is adding a rule to the firewall iptables to block internal hosts from connecting to a remote device that has the IP address 209.165.202.133. A law office uses a Linux host as the firewall device for the network. Reporting should be impartial and alternative explanations should be offered if appropriate.ġ5. Reporting – preparing and presenting information that resulted from the analysis.Salient features such as people, places, times, events, and so on should be documented. Analysis – drawing conclusions from the data.This may involve decompression or decryption of the data. Examination – assessing and extracting relevant information from the collected data.Collection – the identification of potential sources of forensic data and acquisition, handling, and storage of that data.NIST describes the digital forensics process as involving the following four steps:
0 kommentar(er)
