Defeating Anti-Forensics Techniques CHFI Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A forensic examiner is analyzing a Windows system and finds that the 'Prefetch' folder is empty, but the system has been used extensively. The examiner also notices that the 'UserAssist' registry key has been cleared. What is the most likely anti-forensics technique?

   • AArtifact wiping to remove evidence of executed programs
   • BTrail obfuscation by changing system time
   • CSteganography to hide execution traces in images
   • DData hiding using alternate data streams
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A forensic examiner is investigating a case where the suspect is believed to have hidden data in the slack space of a hard drive and then used a wiping tool to overwrite the free space. The examiner has a forensic image of the drive. Which approach would BEST determine whether the slack space data was destroyed by the wiping tool?

   • ALook for the presence of the wiping tool in the system's prefetch files.
   • BAnalyze the file system's journal and metadata to see if the wiping tool wrote to clusters that were previously part of slack space.
   • CCheck the Recycle Bin for any files that may have been in the slack space.
   • DUse a file carving tool to extract data from the slack space and see if any remnants remain.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A forensic examiner is analyzing a Linux system where the suspect is believed to have used a rootkit to hide processes and modified the system's audit logs to remove traces of their activity. The examiner has a forensic image of the system. Which approach would BEST uncover the hidden processes and the log tampering?

   • ACheck the system's bash history for commands related to the rootkit installation.
   • BBoot the image in a controlled forensic environment and compare the file system's process list (from /proc) with the audit logs to identify discrepancies.
   • CUse a hex editor to manually search the disk image for the rootkit's binary signature.
   • DRun a live antivirus scan on the original system to detect the rootkit.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   A forensic examiner finds that entries in a system's security log have been edited to remove references to a specific user's actions. Which trail obfuscation technique is being used?

   • ALog tampering
   • BArtifact wiping
   • CSteganography
   • DData hiding in slack space
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A forensic examiner is reviewing web server logs and finds that the logs contain entries with timestamps that are out of chronological order. Some entries have timestamps in the future, and others have timestamps that are hours old. The examiner suspects log tampering. What is the best way to validate whether the logs have been tampered with?

   • ACompare the logs against a remote log server that receives copies in real time.
   • BCheck the file system timestamps of the log file to see when it was last modified.
   • CLook for gaps in the log sequence numbers.
   • DUse a log analysis tool to parse the logs and generate a report.
   Reveal Solution Discussion Select an answer first