Computer Forensics CCT Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A forensic examiner must analyze a suspect's hard drive without altering the original. The examiner has a forensic write blocker and a hashing tool. Which procedure BEST ensures the integrity of the original evidence?

   • ACopy all files from the drive to a new folder on the workstation and hash the copied files.
   • BConnect the drive through the write blocker, create a forensic image, hash the original and the image, and compare hashes.
   • CUse the operating system's built-in copy command to duplicate the entire drive.
   • DBoot the suspect drive directly on a forensic workstation and run analysis tools.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Why is it important to capture memory before powering off a suspect system?

   • ATo prevent the system from being infected with malware
   • BTo speed up the forensic analysis
   • CTo avoid damaging the hard drive
   • DTo preserve volatile data that would be lost
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A forensic analyst is examining a drive that may contain anti-forensic artifacts. The analyst notices that the drive's free space contains random data that does not match the typical pattern of deleted files. The suspect may have used a data wiping tool. What is the BEST way to determine if data wiping occurred?

   • ACheck the MFT for deleted file entries.
   • BUse a keyword search for 'wipe' in the registry.
   • CAnalyze the free space for patterns of overwriting, such as repeated data patterns or remnants of previous writes.
   • DSearch for the wiping tool's executable on the drive.
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A forensic examiner is investigating a data breach. The examiner has a forensic image of the compromised server and network packet captures from the time of the breach. The examiner needs to determine the exact sequence of events that led to the breach. Which combination of techniques is most effective?

   • AMemory analysis of the server and registry analysis.
   • BTimeline analysis of file system metadata combined with network flow analysis.
   • CKeyword search for 'password' in the disk image and packet captures.
   • DFile carving on the disk image and malware analysis of suspicious files.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   What is file carving in forensic analysis?

   • AThe process of compressing files to save space
   • BThe process of encrypting files to protect them
   • CThe process of recovering files based on their content signatures without relying on file system metadata
   • DThe process of deleting files securely
   Reveal Solution Discussion Select an answer first