Defeating Anti-Forensics Techniques CHFI Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   An organization suspects that an employee deleted incriminating emails and then ran a disk-cleaning utility to overwrite free space. The forensic examiner has a forensic image of the employee's hard drive. Which approach would BEST help determine whether the disk-cleaning utility was used?

   • AAnalyze the file system journal and metadata for patterns of writes to free space that are consistent with a wiping tool.
   • BSearch the image for the email client's database file and try to recover deleted emails from it.
   • CCheck the system's Recycle Bin for the deleted emails.
   • DLook for the presence of the disk-cleaning utility in the Windows registry uninstall entries.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A forensic examiner is investigating a case where the suspect is believed to have hidden data in the slack space of a USB drive. The examiner has created a forensic image of the drive. Which step should the examiner take to extract data from slack space?

   • AUse a forensic tool that can carve data from unallocated space and slack space, such as a file carver that scans raw sectors.
   • BMount the image as a read-only drive and use a standard file explorer to browse for hidden files.
   • CRun a checksum on the image to verify its integrity, then delete the image to free up space.
   • DUse a hex editor to manually search for file signatures in the slack space.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   An investigator notices that a system's event logs stop abruptly and that the last entries are followed by large gaps in the log file. Which sign of deliberate artifact wiping does this indicate?

   • ATimestamp manipulation
   • BLog file truncation
   • CSteganographic embedding
   • DAlternate data stream creation
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   A forensic examiner finds that a file's metadata, such as the last access time and creation time, has been overwritten with random values. Which anti-forensics technique is indicated by this finding?

   • AMetadata wiping
   • BData hiding in slack space
   • CTrail obfuscation via timestamp manipulation
   • DLog tampering
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A forensic examiner is analyzing a Linux system and finds that the 'bash_history' file is empty, but the 'history' command shows entries. The examiner also notices that the system's 'syslog' file has a gap during the suspected intrusion. What is the most likely anti-forensics technique?

   • AThe user cleared the bash_history file, and the syslog gap indicates log tampering.
   • BThe user used 'history -c' to clear the history, and the syslog gap is due to normal log rotation.
   • CThe user used 'unset HISTFILE' to disable history, and the syslog gap is due to a network issue.
   • DThe user used a shell that does not write to bash_history, and the syslog gap is due to a system crash.
   Reveal Solution Discussion Select an answer first