1. In a forensics investigation, you must follow certain procedures. Which of the following is NOT something you should do?

-Carry out the investigation on the original evidence only

-Wipe and prepare target drives

-Check date and time values in the suspect computer's CMOS

-Document all your steps

2. What is a good resource for known OSs and applications?

-National Institute of Standards and Technology (NIST)

-National Software Resource Library (NSRL)

-National Library of Software and Applications (NLSA)

-National institute for known Oss and applications (NIOA)

3. In OSForensics, how do you can attach to a drive to examine evidence?

-Choose Build Drive Image

-Choose Install Drive Image

-Choose Attach Drive Image

-Choose Mount Drive Image

4. Which of the following can be used to determine if the contents of a file have changed?

-encryption keys

-hash

-file flags

-bit-shifting

5. Which of the following contains a set of hashes for known passwords?

-Cracked Hash Tables

-Rainbow Tables

-Solved Hash Tables

-Brute-forced Tables