Defeating Anti-Forensics Techniques CHFI Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   An investigator is examining a Linux system where the suspect is believed to have used steganography to hide data in audio files. The investigator also suspects that the suspect manipulated the system's logs to remove traces of their activity. Which forensic tool or technique would be MOST effective in detecting the hidden data and the log tampering?

   • ACheck the system's bash history for commands related to steganography tools.
   • BRun a file system check to look for files with unusual permissions or ownership.
   • CUse a steganography detection tool on the audio files and analyze the system's audit logs for gaps or inconsistencies.
   • DUse a network analysis tool to capture traffic from the system to see if data was exfiltrated.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   You are a forensic examiner working on a case where the suspect used a file-wiping tool that overwrites free space with a single pass of zeros. You have a forensic image of the drive. What is the most realistic expectation regarding recovery of overwritten data?

   • AThe data is likely unrecoverable with standard software tools.
   • BThe data is completely unrecoverable under any circumstances.
   • CThe data can be fully recovered using file recovery software.
   • DThe data can be recovered from the file system journal.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   During a forensic examination, an investigator finds that a suspect used a technique to make deleted files less likely to be recovered by overwriting the storage areas where the files resided. Which anti-forensics technique does this describe?

   • AArtifact wiping
   • BEncryption
   • CTrail obfuscation
   • DData hiding
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A forensic examiner is analyzing a Linux server's logs after a suspected breach. The logs show a gap in the authentication records for a 30-minute window, and the file timestamps for the log files have been modified to appear older than the system's last reboot. Which approach would BEST confirm that the logs were deliberately tampered with?

   • ACheck the system's audit daemon configuration to see if logging was disabled during that window.
   • BCompare the log file's MAC times against the system's known uptime and check for inconsistencies in the log sequence numbers.
   • CSearch the entire disk for any file containing the word 'authentication' to find alternative logs.
   • DRestore the logs from the last known good backup and compare the restored content with the current logs.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which type of forensic tool is specifically designed to detect hidden data in alternate data streams and slack space on a disk image?

   • ADisk imaging tool
   • BSteganography detection tool
   • CForensic analysis suite
   • DLog analysis tool
   Reveal Solution Discussion Select an answer first