NewAI Content Creation is now live in Early Access
Turning Point Training Instituteby Training Center
Catalog
Skip to content
0%
CapstoneLesson 3 of 3
10 min readBeginner

Where you are: Capstone · C.3 · About 30 minutes. This final self-assessment covers all seven parts of the course and all fourteen chapters of Dr. Al-Doori's IT Forensics Essentials.

What you'll be able to do

By the end of this self-assessment you will know how well you can apply the whole course to realistic situations, and which lessons to revisit.

  • Apply the forensic process, the technical foundations and the core techniques to new scenarios.
  • Make sound ethical, legal and reporting judgments.
  • Identify your strongest and weakest parts of the course.

How This Self-Assessment Works

This is a self-assessment, not an exam. Your answers are checked only on your own screen: they are not saved, scored or sent to the Academy, and finishing this lesson does not give you a grade or a qualification.

There are 20 scenario-based questions, grouped by part. Choose your answer and commit to it before you press Check, because the check shows whether you were right and highlights the correct option. Count only your first answers in a private tally. The explanations at the end say which lesson to revisit for each question. As a guide: 17 or more correct first answers is excellent; 13 to 16 is solid, so review the lessons you missed; below 13, revisit the parts where you lost the most marks before relying on this knowledge in practice.

Then go back to the forensic instincts check in Lesson 0.2 and compare your instincts now with your instincts at the start.

All people and organizations in the questions are fictional.

Part I — Foundations

1. A detective at a scene wants to open a suspect's recent documents on the running laptop to save time. What is the main problem?

2. A suspect's phone location history places it near a burglary at the time it happened. Which role does the phone play?

3. While searching a server for evidence of fraud under a court order, you find files suggesting a different crime. What do you do?

Part II — The Technical Foundations

4. The SHA-256 values of a drive and its image match. What does that prove?

5. A confidential file and a file called holiday_list.txt on a USB stick have the same SHA-256 value. What is the best conclusion?

6. A traditional disk sector holds 512 bytes. How is 512 written in hexadecimal?

7. A file was deleted from an SSD a week ago. Which statement is most accurate?

Part III — DFIR, Services and Techniques

8. A server is running with an unlocked encrypted volume. Following the order of volatility, what should be captured first?

9. During an incident, the team removes malware and disables accounts the attacker created. Which phase is this?

10. File carving recovers a partial document with no name or dates. How should it be reported?

11. An email passes SPF, DKIM and DMARC for the domain paymnts-company.example, while the real company uses company.example. What does the pass show?

Part IV — Integrity

12. What does a hardware write-blocker NOT protect against?

13. Two forensic tools report different numbers of visits to the same website. What should the examiner do?

14. In the Mat Honan case, his accounts were linked so that taking over one opened the next. In security terms, the linked accounts were…

Part V — Forensics in Practice

15. In an IP theft investigation, which source needs the employee's consent or a court order?

16. A company hit by ransomware has clean backups. Why should the investigation continue after restoring?

Part VI — Professional Practice

17. In which section of a forensic report do the tools, their versions and the integrity steps belong?

18. Under cross-examination you are asked something your evidence cannot answer. What is the best response?

Part VII — Landmark Cases

19. In the BTK case, what role did the floppy disk's metadata play?

20. According to the US Department of Justice, how did the 2019 Capital One intrusion occur?

Answers explained

  1. a. Browsing changes access times and other traces (Lesson 1.3).
  2. d. The location history backs up other evidence, which is corroboration (Lesson 1.3).
  3. b. Stay within scope and seek further authority; never delete (Lessons 1.4, 2.5).
  4. d. A match proves identical data at hashing time, nothing about who, malware or lawfulness (Lesson 2.1).
  5. c. Hashes cover contents, not names, so a renamed copy is found by its hash (Lesson 2.1).
  6. c. 512 = 2 × 256 = hex 200. FF is 255 and 1000 is 4,096 (Lesson 2.2).
  7. a. TRIM and garbage collection can erase freed blocks; results vary (Lesson 2.3).
  8. b. Memory and live state come first in RFC 3227's order of volatility (Lessons 2.4, 3.4).
  9. c. Removing the root cause and the attacker's access is eradication (Lesson 3.2).
  10. a. Carved data may be incomplete or merged; report method and limits (Lesson 3.5).
  11. a. Authentication proves the domain, not honesty; look-alike domains pass easily (Lesson 3.7).
  12. c. A write-blocker stops host writes, not the drive's internal housekeeping (Lessons 2.3, 4.2).
  13. d. Validate, examine the raw records and disclose discrepancies (Lesson 4.1).
  14. a. The linked accounts were a weak point, a vulnerability (Lesson 4.3).
  15. c. A personal device needs consent or legal authority (Lessons 3.3, 5.2).
  16. b. Investigate exfiltration and the entry point (Lesson 5.1).
  17. d. The methodology lets others repeat and assess the work (Lesson 6.3).
  18. b. "I cannot conclude beyond the data available" (Lesson 6.4).
  19. b. Metadata was a lead; DNA and other evidence confirmed it (Lesson 7.1).
  20. d. The DOJ describes a misconfigured web application firewall; the intruder was not a Capital One employee (Lesson 7.3).

Congratulations

You have reached the end of IT Forensics Essentials, built on Dr. Tahseen Al-Doori's book. If the capstones and this self-assessment went well, you can explain the forensic process from crime scene to courtroom and apply its basics: preserve and verify evidence with hashes, read the traces that storage devices and operating systems leave, choose a suitable technique, act with integrity, and write an honest report that you could defend.

This course is an introduction. It is not a professional qualification, and it does not by itself prepare anyone to examine evidence in a real case. Professional work also needs supervised experience, a quality-managed laboratory and, in many places, recognized certification or accreditation (Lesson 6.2).

Keep practicing with public, legal data sets such as NIST's CFReDS, follow the official documentation of the tools you use, and remember the rule that runs through the whole course: only examine devices, accounts and systems you own or are explicitly authorized to work with.

Sources

PreviousCapstone B: The Departing Engineer — Investigate and Write the Court Report