Computer Forensics CCT Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is the first step in a systematic forensic investigation process?

   • AIdentification
   • BPreservation
   • CReporting
   • DAnalysis
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   An analyst is examining a drive from a suspect who is known to use encryption and data hiding. The analyst finds a partition that appears to be unallocated space, but the size is suspiciously large. The analyst suspects hidden data. Which technique is MOST effective for discovering hidden data in this unallocated space?

   • AUse a keyword search for common file extensions.
   • BPerform a timeline analysis of the filesystem.
   • CRun a file carving tool to search for file signatures in the unallocated space.
   • DCheck the partition table for hidden partitions.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A forensic examiner must image a 4TB hard drive from a server. The examiner has a write blocker, but the only available forensic workstation has a 2TB internal drive. The examiner needs to preserve the evidence while working within these constraints. What is the BEST course of action?

   • AUse a network share to store the image on a remote server with enough space.
   • BConnect the suspect drive directly to the workstation and copy files to the internal drive.
   • CUse the write blocker and create a compressed forensic image in segments on external drives.
   • DImage only the active files and skip unallocated space to fit the image.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which phase of the forensic investigation process involves drawing conclusions based on the evidence?

   • AReporting
   • BCollection
   • CAnalysis
   • DExamination
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A forensic examiner is analyzing an NTFS volume. The examiner needs to recover a deleted file, but the MFT entry for the file has been overwritten. However, the file's data clusters are still marked as allocated. What is the BEST way to recover the file content?

   • APerform file carving on the unallocated space using file signatures.
   • BRebuild the MFT from the $MFT mirror.
   • CUse the 'undelete' function of the forensic tool to restore the MFT entry.
   • DSearch the $LogFile and $UsnJrnl for file records.
   Reveal Solution Discussion Select an answer first