Cyber Forensics — DU B.Sc. (Prog) Physical Science courses pertaining to Computer Science Previous Year Question Papers

Cyber Forensics Generic Elective Parts of a question must be answered together. I. (a) What is the purposeofthe sedcommand inLinux? Write asedcommandto delete 2 all log lines containing the word "DEBUG" from logfile.txt. indicate if the hash value of an acquired image differs from that of the original evidence? (a) Classify the following as volatile or Non-volatile evidence: i. Network connections ii. Windows Registry iii. RAM contents iv. SwapFiles (d) (e) Explain the provisions of section 43 of the lnfomation Technology Act, 2000. Give 3 two specific examples of actions that constitute offences under this section. Briefly explain any two password re.covery tools used in forensic investigation. 4 (I) State whether each of the following statements i§ True or False: NTFS supports file-level encryption using the Encrypting File system Files deleted from the windows Recycle Bin are permanently and iITecoverably removed from the disk. Encase is a free and open-source digital forensic tool available `for download. The SMFT file in NTFS contains one record for every file and directory on the volume. (g) Match the following windows Registry hive files with their forensic content: Hive File Content i. SAM Hive ii. SYSTEMHive ii i. S OFTWARE Hive iv. NTUSER.DAT v. SECURITY Hive vi. Usrclass.dat a. Installed software and application settings b. Current user desktop preferences c. Local user account names and password hashes d. Hardware configuration and active services e. Shell folder paths and shellBag entries f. Local security policy and LSA secrets ai) A file named "systemevents.log" contains timestamped security event entries. Write grep commands to perform the following tasks: i. ii. iii. iv. v. vi. Find and display all lines containing the text "FAILED LOGIN'. Display all lines that contain the date "2025-03-15". Count the total number of lines containing the word "SUCCESS" Show line numbers for all lines containing "ADMIN", ignoring case sensitivity. Display all lines that do NOT contain the word "INFO". Find and display lines that begin with the tag "[CRITICAL]". its answer 2. (a) Differentiate between.the following: i. ii. Physical Disk and Logical Disk MBR (Master Boot Record) and GPT (GUII) Partition Table) partition schemes a) What is a digital forensic report? List any four essential components that must be included in a well-structured digital forensic report. (c) What are the.salient features ofe-commerce? Explain any four key features ofe-commerce and their importance in on line business operations. associated with EDI in the context of e-commerce. a) (c) What is Dual Key Encryption? How does it work in the context of digital signatures to ensure (i) authenticity and (ii) non-repudiation? Explain the six stages of digital evidence documentation in a cyber-forensic investigation. Describe what occurs during each stage.