Anti-Forensics Countermeasures DFE Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which area of a storage device is specifically examined to recover data that may have been hidden in the unused space between the end of a file and the end of the last allocated cluster?

   • APage file
   • BSlack space
   • CMaster boot record
   • DRegistry hive
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which of the following is an essential component of a comprehensive logging and monitoring system for detecting anti-forensics activities?

   • ACentralized log collection and analysis
   • BDisabling all logging to reduce system overhead
   • CStoring logs only on the local system
   • DUsing only manual log review
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A forensic examiner needs to analyze a drive image that contains both encrypted files and hidden data in slack space. The examiner has a limited time window and must prioritize actions to preserve evidence integrity. Which action should the examiner take first?

   • AAnalyze slack space for hidden data first, since it is a quick and easy win.
   • BCreate a cryptographic hash of the original image and document the chain of custody before any analysis begins.
   • CAttempt to decrypt the encrypted files first, since encryption is the more complex challenge.
   • DCopy the image to multiple backup locations before analysis, assuming that redundancy is more important than hashing.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which of the following is a proper evidence handling procedure to ensure the integrity of digital evidence during an investigation?

   • ADocumenting the chain of custody for all evidence
   • BCopying evidence to a shared network drive without encryption
   • CAllowing multiple investigators to handle evidence without logging
   • DStoring evidence on the original system after acquisition
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   You are investigating a case where the suspect used both NTFS alternate data streams (ADS) and steganography to hide data. You have a forensic image of the drive. Which approach should you use to uncover both types of hidden data while maintaining evidence integrity?

   • ABoot the original system and use a script to list all files and their ADS, then extract any suspicious streams.
   • BRun a file signature search across the entire image to identify all files, then manually inspect each one for hidden data.
   • CFirst, enumerate all ADS using a forensic tool that parses NTFS attributes, then run steganalysis on any suspicious files found in those streams.
   • DUse a data carving tool to recover deleted files from unallocated space, assuming that hidden data is stored there.
   Reveal Solution Discussion Select an answer first