Defeating Anti-Forensics Techniques CHFI Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A forensic examiner is analyzing a Windows system and finds a file named 'report.pdf' that is 5 MB in size. The examiner opens the PDF and sees only one page of text. The examiner also notices that the PDF's metadata indicates it was created with a tool that is not commonly used for PDF creation. What is the most likely anti-forensics technique?

   • AThe PDF contains hidden data in its unused object streams or metadata.
   • BThe PDF is encrypted and the visible page is a decoy.
   • CThe PDF's timestamps have been manipulated to appear older.
   • DThe PDF has been wiped to remove hidden data.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   During a forensic examination of a Linux system, you find a file that appears to be a legitimate system binary, but its size is larger than the known-good version. You also notice that the binary's MD5 hash does not match the official package hash. What is the most likely anti-forensics technique?

   • AThe binary is using steganography to hide data in its unused sections.
   • BThe binary is stored in an alternate data stream.
   • CThe binary has been replaced with a trojanized version that hides malicious code.
   • DThe binary's timestamps have been manipulated to appear legitimate.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A forensic examiner is analyzing a disk image and finds a file that appears to be a legitimate system DLL, but its hash does not match the known-good version. The examiner also notices that the DLL's version info is identical to the legitimate version. What is the most likely anti-forensics technique?

   • AThe DLL's timestamps have been manipulated to match the legitimate version.
   • BThe DLL is encrypted and the version info is a decoy.
   • CThe DLL has been trojanized, and the version info was copied from the legitimate file to avoid detection.
   • DThe DLL is stored in an alternate data stream.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   A forensic examiner notices that a suspect has been modifying file timestamps and clearing event logs to hide their activities. Which category of anti-forensics techniques does this behavior represent?

   • ASteganography
   • BTrail obfuscation
   • CArtifact wiping
   • DData hiding
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A forensic examiner is analyzing a disk image and suspects that the suspect used a tool to wipe free space on the drive to destroy deleted files. The examiner wants to verify whether the wiping actually occurred and recover any remnants. Which tool or method would be MOST appropriate for this task?

   • ALook for the presence of the wiping tool's executable in the system's Program Files directory.
   • BPerform a simple file recovery using a standard undelete tool on the mounted image.
   • CCheck the Recycle Bin for any files that were deleted before the wipe.
   • DUse a forensic tool that analyzes the file system's journal and metadata to identify patterns consistent with a wiping tool.
   Reveal Solution Discussion Select an answer first