Anti-Forensics Countermeasures DFE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   An organization suspects that an employee used a disk sanitization tool to wipe a company laptop before returning it. The IT team has a forensic image of the drive. Which analysis should be performed to confirm that wiping occurred and to identify the tool used?

   • ACheck the Windows registry for entries related to disk sanitization software installations.
   • BAnalyze the drive image for patterns of overwritten data, such as repeated byte sequences or specific fill patterns, and compare them to known signatures of sanitization tools.
   • CRun a data recovery tool to restore deleted files, assuming that the sanitization tool did not overwrite all data.
   • DExamine the file system timestamps to identify when files were deleted, and correlate with the employee's last day of work.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   Your company is implementing a forensic readiness program to counter anti-forensics techniques. You need to ensure that evidence of suspicious activities is preserved and available for investigation. Which measure should you implement first?

   • ACreate a response team that is on call 24/7 to respond to any suspected anti-forensics activity.
   • BDeploy endpoint protection software that automatically blocks anti-forensics tools.
   • CEstablish a policy that requires centralized logging of all security-relevant events, with logs retained for a defined period and protected from modification.
   • DPurchase advanced forensic analysis software and train all IT staff on its use.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which anti-forensics technique is specifically used to make data unreadable without a key, thereby obstructing forensic examination?

   • AFile hashing
   • BData carving
   • CLog tampering
   • DEncryption
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is the primary goal of forensic readiness as a countermeasure to anti-forensics techniques?

   • ATo ensure that an organization can effectively collect and preserve evidence before an incident occurs
   • BTo delete all logs after an incident to protect privacy
   • CTo perform forensic analysis only after a legal warrant is issued
   • DTo encrypt all data at rest to prevent unauthorized access
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A forensic examiner is analyzing a drive image and finds that a suspect used steganography to hide data in the slack space of files. Which method should be used to detect and recover this hidden data?

   • AUse a tool that analyzes slack space for anomalies, such as non-zero data where zeros are expected, and extract any suspicious content for further analysis.
   • BRun a file signature search across the entire image to identify known file types that might be hidden in slack space.
   • CCheck the file system's master file table (MFT) for entries that reference slack space locations.
   • DRebuild the file system from scratch and compare the new structure to the original to identify differences in slack space.
   Reveal Solution Discussion Select an answer first