To counteract anti-forensics techniques, an investigator should perform a thorough examination that includes checking for hidden data and verifying the integrity of evidence. Which of the following is a key countermeasure to ensure evidence integrity?

Deleting original files after imaging

Computing cryptographic hashes of acquired images

Using only GUI-based forensic tools

Relying solely on the suspect's explanations

During a forensic examination of a Windows system, you find that the 'LastWriteTime' of a critical document is earlier than the 'CreationTime' of the same file. This is logically impossible under normal circumstances. What anti-forensics technique does this indicate?

Artifact wiping of the file's metadata

Timestamp manipulation to mislead the investigation

Steganography embedded in the document

During a forensic investigation of a compromised server, you find that the attacker used a rootkit to hide processes and modified system logs to remove traces of their activity. Which countermeasure would be MOST effective in detecting the rootkit and recovering the true evidence?

Run a standard antivirus scan on the live system to detect the rootkit.

Boot the server from a trusted forensic environment and compare the live system's process list and file system with the offline analysis.

Use the 'tasklist' command to list all running processes and look for unusual names.

Check the Windows Event Log for any entries that mention 'rootkit' or 'hidden process'.

You are investigating a case where the suspect used a file-wiping tool to overwrite free space on the hard drive. The tool was run multiple times with different patterns. You have a forensic image of the drive. What is the most effective way to attempt to recover evidence that may have been overwritten?

Perform a deep analysis of the drive's magnetic remnants using specialized hardware.

Analyze the file system journal for metadata about the wiped files.

Use a file recovery tool to scan for deleted files in the unallocated space.

Examine the slack space of existing files for remnants of the wiped data.

EC-CouncilComputer Hacking Forensic Investigator

Domain 2Objective 3

Defeating Anti-Forensics Techniques CHFI Practice Questions (Page 2)

Part of the Storage Media, Acquisition and Anti-Forensics domain, which makes up ~18% of our current practice bank.

43questions here

9free pages

6concepts

Questions 6–10

6foundation · easy
To counteract anti-forensics techniques, an investigator should perform a thorough examination that includes checking for hidden data and verifying the integrity of evidence. Which of the following is a key countermeasure to ensure evidence integrity?
Select an answer first
7application · medium
During a forensic examination of a Windows system, you find that the 'LastWriteTime' of a critical document is earlier than the 'CreationTime' of the same file. This is logically impossible under normal circumstances. What anti-forensics technique does this indicate?
Select an answer first
8foundation · easy
An investigator wants to verify that a forensic image has not been altered since acquisition. Which tool or technique is commonly used for this purpose?
Select an answer first
9application · medium
During a forensic investigation of a compromised server, you find that the attacker used a rootkit to hide processes and modified system logs to remove traces of their activity. Which countermeasure would be MOST effective in detecting the rootkit and recovering the true evidence?
Select an answer first
10application · hard
You are investigating a case where the suspect used a file-wiping tool to overwrite free space on the hard drive. The tool was run multiple times with different patterns. You have a forensic image of the drive. What is the most effective way to attempt to recover evidence that may have been overwritten?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CHFI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CHFI” is a trademark of its owner, used for identification only.

Defeating Anti-Forensics Techniques CHFI Practice Questions (Page 2)

Questions 6–10

To counteract anti-forensics techniques, an investigator should perform a thorough examination that includes checking for hidden data and verifying the integrity of evidence. Which of the following is a key countermeasure to ensure evidence integrity?

During a forensic examination of a Windows system, you find that the 'LastWriteTime' of a critical document is earlier than the 'CreationTime' of the same file. This is logically impossible under normal circumstances. What anti-forensics technique does this indicate?

An investigator wants to verify that a forensic image has not been altered since acquisition. Which tool or technique is commonly used for this purpose?

During a forensic investigation of a compromised server, you find that the attacker used a rootkit to hide processes and modified system logs to remove traces of their activity. Which countermeasure would be MOST effective in detecting the rootkit and recovering the true evidence?

Keep studying — Storage Media, Acquisition and Anti-Forensics