A forensic team is about to acquire evidence from a suspect's computer that is currently running. The suspect is known to have anti-forensics tools that can wipe data upon shutdown. To preserve the evidence, which action should the team take FIRST?

Boot from a forensic live CD and create a disk image without touching the original system.

Run a full disk wipe utility on the suspect's drive to ensure no hidden data remains.

Perform a live acquisition of volatile data and then safely shut down the system before creating a disk image.

Immediately pull the power plug to prevent any anti-forensics software from executing.

During an investigation, you suspect that a suspect has hidden incriminating files on a Windows 10 system. The suspect is known to be technically savvy and has used NTFS features to conceal data. Which action would be MOST effective in uncovering hidden data on the suspect's drive?

Use a hex editor to manually scan the entire raw disk image for readable text strings.

Run a file system forensic analysis that enumerates NTFS alternate data streams and checks slack space for residual data.

Perform a simple directory listing of all user folders and review file names for suspicious entries.

Check the Recycle Bin and temporary folders for recently deleted files.

An investigator discovers that a suspect changed the system clock before performing certain actions to make the timestamps of those actions appear to occur at a different time. Which anti-forensics technique does this represent?

Data hiding in alternate data streams

An investigator is analyzing a disk image and suspects that anti-forensics techniques may have been used. Which of the following is an effective countermeasure to uncover hidden data?

Examining unallocated space and slack space

Formatting the drive before analysis

An investigator is examining a Windows system where the suspect is believed to have used steganography to hide data in image files. The investigator also notices that the system's registry shows evidence of a tool that can modify file timestamps. Which combination of forensic techniques would BEST uncover the hidden data and confirm timestamp manipulation?

Run a keyword search across all files for common steganography passwords.

Examine the NTFS Master File Table for entries with unusual sizes or names.

Use steganography detection tools to analyze image files for embedded data and compare file metadata against the system's event logs.

Check the Windows Prefetch files to see which applications were run recently.

EC-CouncilComputer Hacking Forensic Investigator

Domain 2Objective 3

Defeating Anti-Forensics Techniques CHFI Practice Questions (Page 6)

Part of the Storage Media, Acquisition and Anti-Forensics domain, which makes up ~18% of our current practice bank.

43questions here

9free pages

6concepts

Questions 26–30

26application · medium
A forensic team is about to acquire evidence from a suspect's computer that is currently running. The suspect is known to have anti-forensics tools that can wipe data upon shutdown. To preserve the evidence, which action should the team take FIRST?
Select an answer first
27application · medium
During an investigation, you suspect that a suspect has hidden incriminating files on a Windows 10 system. The suspect is known to be technically savvy and has used NTFS features to conceal data. Which action would be MOST effective in uncovering hidden data on the suspect's drive?
Select an answer first
28foundation · easy
An investigator discovers that a suspect changed the system clock before performing certain actions to make the timestamps of those actions appear to occur at a different time. Which anti-forensics technique does this represent?
Select an answer first
29foundation · easy
An investigator is analyzing a disk image and suspects that anti-forensics techniques may have been used. Which of the following is an effective countermeasure to uncover hidden data?
Select an answer first
30application · medium
An investigator is examining a Windows system where the suspect is believed to have used steganography to hide data in image files. The investigator also notices that the system's registry shows evidence of a tool that can modify file timestamps. Which combination of forensic techniques would BEST uncover the hidden data and confirm timestamp manipulation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CHFI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CHFI” is a trademark of its owner, used for identification only.