Defeating Anti-Forensics Techniques CHFI Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A forensic examiner is investigating a Windows system where the user's Recycle Bin is empty, but the 'INFO2' file (or the $I files) shows entries for recently deleted files. The examiner also finds that the 'Recent' folder has been cleared. What is the most likely anti-forensics technique?

   • AData hiding using alternate data streams
   • BSteganography to hide deleted files in other files
   • CArtifact wiping to delete traces of file deletion
   • DTrail obfuscation by changing file timestamps
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A forensic examiner is analyzing a Windows system where the suspect is believed to have used a tool to modify the timestamps of files and also used steganography to hide data in images. The examiner has identified several images with suspicious characteristics. Which combination of forensic techniques would BEST confirm both the timestamp manipulation and the steganography?

   • AUse a steganography detection tool on the images and compare the file's MAC times with the system's USN journal.
   • BCheck the file's hash value against a known-good database to see if it matches a legitimate image.
   • CRun a keyword search across the images for hidden text strings.
   • DLook at the file's owner and permissions to see if they were changed.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   You are examining a USB drive that was used by a suspect. The drive is formatted with FAT32 and contains several image files. You notice that the 'file size' of one image is 2 MB, but when you open it in a hex editor, the data after the JPEG end-of-image marker (FF D9) contains a large amount of non-image data. What is the most likely anti-forensics technique?

   • AHiding data in slack space
   • BEncrypting the image file
   • CAppending hidden data after the end of the file
   • DUsing alternate data streams (ADS)
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A forensic examiner is analyzing a disk image and finds a file that appears to be a JPEG image. The file's header is correct, but the file's footer (FF D9) is missing. The examiner also notices that the file's size is larger than the sum of its visible data. What is the most likely explanation?

   • AThe file has hidden data appended after the legitimate image data, and the footer was removed to conceal it.
   • BThe file is corrupted and cannot be analyzed further.
   • CThe file uses a non-standard JPEG format that does not require a footer.
   • DThe file has been truncated, and the missing footer indicates data loss.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   During a forensic examination of a Windows 10 workstation, you find a suspicious file named 'notes.txt' in the C:\Users\Public\Documents folder. The file's size on disk is 4 KB, but the file's logical size is only 12 bytes. You suspect hidden data. Which technique should you use to check for hidden data in this file?

   • ARun a hash comparison against a known-good copy of the file.
   • BUse a tool like 'streams.exe' to enumerate alternate data streams (ADS) associated with the file.
   • CCheck the file's NTFS permissions and ownership to see if it was modified by an unauthorized user.
   • DExamine the file's MAC times to determine when it was last accessed.
   Reveal Solution Discussion Select an answer first