Muhammad Ramzan

OJT-CS

Theory Part
Attempt all questions. All questions carry equal marks. Total marks: 40
Q1) What is Password cracking?. Briefly discuss any three password cracking techniques.
password cracking is the process of recovering passwords from data that has been stored in or
transmitted by a computer system in twisted form. A common approach is to repeatedly try guesses for
the password and to check them against an available cryptographic hash of the password.

password cracking techniques are,

brute-force attack

dictionary attacks

buffer overflow

Q2) What is meant by sniffing? Briefly discuss any three sniffing techniques used today.
Sniffing is the process of monitoring and analyzing network traffic. network sniffing involves
capturing and examining the packets of data that are sent and received over a network.
Techniques used are
 Network sniffing
 Packet sniffing
 Password sniffing
 ARP (Address Resolution protocol) sniffing
 DHCP sniffing
Q3) Given below graph depicts various sources of threats that exist today. Write down 4
examples of “internal” and “external” intentional threat sources.
Internal threats
Disgruntled Employees
Insider Threats
Contractors and Third-Party Vendors
system Administrators
external threats
hacker attack
Session Hijacking
Man-in-the-Middle Attack
Ransomware
DDoS Attacks
phishing

Q4) Data acquisition is the use of established methods to extract Electronically Stored
Information (ESI) from suspect computer or storage media to gain insight into a crime or an
incident. Differentiate between “Live acquisition” and “Dead Acquisition”.
Live acquisition
It is the process of data acquisition in which data is acquired while system is on/working.
In this process volatile data in ram, register, cache, is acquired
Dead Acquisition
It is the process of data acquisition in which data is acquired while system is off, and hard drive
is used for data acquisition. It is for nonvolatile source such as a hard drive or USB.
It is also called static acquisition
In this method, emails, deleted data is recovered.
Q5) When collecting evidence, an investigator needs to evaluate the order of volatility of data
depending on the suspect machine and the situation. Arrange the given below pieces of
information based on the order of volatility.

Order of Volatality
1- Register and cache
2- Temporary system file
3- Remote logging and monitoring data that is relevant to the system in question
4- Archival media