Computer Forensics CCT Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   During a memory forensics analysis, an examiner finds a suspicious process that is not visible in the process list from the operating system. The examiner suspects the process is hidden using a rootkit technique. Which memory forensics technique is MOST effective for detecting this hidden process?

   • ACross-view analysis by comparing the process list from multiple sources (e.g., PsActiveProcessHead and EPROCESS pool scanning).
   • BCheck the Windows event logs for process creation events.
   • CSearch for the process name in the memory dump using strings.
   • DUse the 'pslist' command from Volatility.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A forensic examiner is analyzing an NTFS volume and discovers that a file's MFT entry is marked as deleted, but the file's data clusters are still marked as allocated. What is the most likely reason for this condition?

   • AThe file was deleted but the data has not yet been overwritten.
   • BThe file was encrypted and the MFT entry is corrupted.
   • CThe file system is corrupted and needs to be repaired.
   • DThe file was moved to the Recycle Bin and is still recoverable.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which file system is commonly used by modern Windows operating systems?

   • AFAT32
   • Bext4
   • CHFS+
   • DNTFS
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   An investigator is analyzing a forensic image of a Windows system and needs to find evidence of a specific file that was deleted and then overwritten. Which technique is most likely to recover remnants of the file?

   • AFile carving based on file signatures.
   • BTimeline analysis of file system metadata.
   • CKeyword search across the entire image.
   • DChecking the Recycle Bin.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   During a forensic investigation, an examiner transfers a seized hard drive from the evidence locker to the lab. The drive is later analyzed, and the findings are presented in court. What documentation is essential to prove the evidence was not tampered with during this transfer?

   • AA forensic report summarizing the analysis findings and conclusions.
   • BA detailed chain of custody form listing every person who handled the evidence and when.
   • CAn email from the examiner to the lab manager stating the drive was received.
   • DA photograph of the evidence locker and the lab entrance.
   Reveal Solution Discussion Select an answer first