Anti-Forensics Countermeasures DFE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A forensic investigator encounters a laptop with BitLocker-encrypted drives. The suspect is known to have used the laptop recently, but it is now powered off. Which approach should the investigator take to access the encrypted data?

   • ACheck the Active Directory domain for a BitLocker recovery key, if the device was domain-joined, and use it to unlock the drive.
   • BSearch the suspect's desk for a written copy of the BitLocker recovery key.
   • CRemove the hard drive and connect it to another computer to bypass BitLocker encryption.
   • DPerform a brute-force attack on the BitLocker password using a high-performance GPU cluster.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which forensic technique is used to recover residual data from storage media after an anti-forensics attempt to wipe or overwrite files?

   • ALog analysis
   • BLive memory analysis
   • CNetwork packet analysis
   • DData carving
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   An organization suspects that an employee used a disk wiping tool to destroy evidence of data exfiltration. The IT team has a forensic image of the drive, but the image was taken after the wiping occurred. Which analysis technique is most likely to reveal evidence of the exfiltration?

   • APerform a deep scan of the drive image for remnants of the exfiltrated data in unallocated space.
   • BCheck the Windows Prefetch files for evidence of the wiping tool's execution, and assume that the exfiltration tool was also run.
   • CReview the system's event logs for failed login attempts, assuming that the exfiltration involved unauthorized access.
   • DAnalyze the file system journal and metadata for records of file access and deletion, and correlate with network logs to identify data transfer patterns.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the primary purpose of using write blockers during forensic evidence acquisition?

   • ATo compress the evidence image
   • BTo encrypt the evidence during transfer
   • CTo prevent any modification to the original evidence
   • DTo speed up the acquisition process
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A forensic examiner is investigating a case where the suspect used multiple anti-forensics techniques, including data hiding, artifact wiping, and encryption. The examiner has a forensic image of the drive. Which combination of techniques should the examiner use to maximize the recovery of evidence?

   • AAttempt to crack the encryption password first, then analyze the drive for hidden data and wiping signs.
   • BFocus only on recovering deleted files from unallocated space, assuming that the wiping technique was not fully effective.
   • CAnalyze slack space and ADS for hidden data, examine file system metadata for signs of wiping, and use memory analysis or key recovery for encrypted files.
   • DUse a single forensic tool that claims to handle all anti-forensics techniques automatically.
   Reveal Solution Discussion Select an answer first