This answer is correct.

QUESTION 2 OF 10

Autopsy is able to ingest the following data sources directly:

Choose ALL answers that apply.

·         A

Disk Image or VM file

·         B

Pieces of paper

·         C

Logical files

·         D

Scratched hard drive platters

This answer is correct.

QUESTION 3 OF 10

True or False: When adding a data source to Autopsy, in-depth analysis on the data is automatically performed

Choose only ONE best answer.

A

True

B

False

This answer is correct.

QUESTION 4 OF 10

True or False: The Autopsy case database stores a full copy of every single file contained within a data source

Choose only ONE best answer.

A

True

B

False

This answer is correct.

QUESTION 5 OF 10

Autopsy supports many volume systems, including:

Choose ALL answers that apply.

·         A

DOS

·         B

BSD

·         C

RSVP

·         D

YAJBFS3

·         E

GPT

This answer is correct.

QUESTION 6 OF 10

Autopsy supports many file system formats, including:

Choose ALL answers that apply.

·         A

FAT32

·         B

YAFFS2

·         C

HFS+

·         D

Ext4

·         E

NTFS

This answer is correct.

QUESTION 7 OF 10

Orphan files in Autopsy are stored under the $OrphanFile folder.  What is an orphan file? 

Choose only ONE best answer.

A

A deleted file that no longer has a parent folder. 

B

An allocated, but corrupt file

This answer is correct.

QUESTION 8 OF 10

What types of disk images are currently NOT NATIVELY SUPPORTED by Autopsy

Choose ALL answers that apply.

·         A

SUPER DUPER EXTREME RAID

·         B

Bitlocker

·         C

RAID

·         D

KUBEKLUSTER

This answer is correct.

QUESTION 9 OF 10

True or False: When adding "Local Files and Folders" to a case in Autopsy, file times are added to the database

Choose only ONE best answer.

A

True

B

False

This answer is correct.

QUESTION 10 OF 10

True or False: When adding an E01 file to a case within Autopsy, the E01 file is automatically validated upon import

Choose only ONE best answer.

A

True

B

False

This answer is correct.

Lab Steps

Enable fullscreen

Lab Quiz

Enable fullscreen

QUESTION 1 OF 5

How many volumes does the disk image have?

Choose only ONE best answer.

A

1

B

3

C

6

D

9

This answer is correct.

 

QUESTION 2 OF 5

What is the name of the unallocated space file in vol1?

Choose only ONE best answer.

A

Volume1_Unallocated_Space.dat

B

Unalloc_3_0_1048576

C

Vol1 doesn't have unallocated space

This answer is correct.

 

QUESTION 3 OF 5

What file system is in vol7?

Choose only ONE best answer.

A

NTFS

B

FAT

C

YAFFS2

This answer is correct.

 

QUESTION 4 OF 5

What is the database called?

Choose only ONE best answer.

A

device1_laptop.db

B

database.db

C

autopsy.db

This answer is correct.

 

QUESTION 5 OF 5

Roughly how big is the case database (in megabytes)?

Choose only ONE best answer.

A

1MB

B

50MB

C

250MB

D

1GB

This answer is correct.

 

Sponsored by Cyber Triage

Enable fullscreen

Cyber Triage is fast and affordable DFIR software any organization can use for endpoint visibility. Built by Brian Carrier’s team at Basis Technology, Cyber Triage is agentless and integrates with threat intelligence to automatically collect and analyze endpoint data. 

Click here to start your 7-day free trial now.

Basis Technology and Cyber Triage are providing this free Autopsy training.