Computer Forensics Chapter 6

4. A project sponsored by the National Institute of Standards and Technology to manage research on digital forensics tools.
5. A NIST project with the goal of collecting all known hash values for commercial software and OS files.
8. The process of pulling relevant data from an image and recovering or reconstructing data fragments; one of the required functions of digital forensics tools.
9. A hardware device or software program that prevents a computer from writing data to an evidence drive. Software write-blockers typically alter interrupt-13 write functions to a drive in a PC's BIOS. Hardware write-blockers are usually bridging devices between a drive and the forensic workstation.
10. An attack that uses a collection of words or phrases that might be passwords for an encrypted file. Password recovery programs can use a password dictionary to compare potential passwords to an encrypted file's password or passphrase hash values.
12. Records an investigator's actions in examining a case

1. The process of proving that two sets of data are identical by calculating hash values or using another similar method.
2. The process of trying every combination of characters—letters, numbers, and special characters typically found on a keyboard—to find a matching password or passphrase value for an encrypted file.
3. The process of rebuilding data files; one of the required functions of digital forensics tools.
6. The process of creating a duplicate image of data; one of the required functions of digital forensics tools.
7. A way to confirm that a tool is functioning as intended; one of the functions of digital forensics tools.
11. A method of finding files or other information by entering relevant characters, words, or phrases in a search tool.