A forensic examiner is investigating a suspect's Windows 10 laptop. The suspect is known to have used a file-wiping tool. The examiner finds that the $MFT entries for several files have been cleared, but the $LogFile still contains records of those files' creation. The examiner also finds that the Volume Shadow Copies (VSS) contain an older version of the $MFT. Which of the following is the most reliable way to recover the file names and contents?

Run a data recovery tool that scans for deleted files

Extract the $MFT from the VSS and use it to locate the file data clusters

Use the $LogFile to reconstruct the file names

Carve the unallocated space for file signatures

A forensic examiner is investigating a suspect who used a tool to wipe the free space on a hard drive. The examiner has a forensic image taken before the wiping, but the image is of a different drive model. Which factor is most important when comparing the pre-wipe and post-wipe images?

The operating system version, as it determines the wiping tool's behavior

The drive's serial number, as it must match for comparison

The file system type and cluster size, as they affect the layout of free space

The amount of RAM in the system, as it affects the wiping process

A forensic team is investigating a case where the suspect used a tool to wipe free space on the hard drive. The team has a forensic image of the drive taken before the wiping occurred. Which approach is most effective for detecting the wiping activity?

Check the Windows Prefetch files for the wiping tool

Compare the pre-wipe image with a post-wipe image to identify changes in free space patterns

Analyze the $MFT for deleted file entries

Search for hidden partitions on the drive

A company's security team suspects an employee of using a disk-wiping tool to erase evidence of unauthorized data transfers. The employee's workstation has been seized, and the forensic examiner needs to determine whether wiping occurred. Which approach is most effective for detecting the wiping activity?

Examine the browser history for downloads of wiping tools

Check the Recycle Bin for deleted files

Analyze the $LogFile and $UsnJrnl for gaps or anomalies that indicate deletion of journal entries

Search for hidden partitions on the disk

A forensic examiner is analyzing a USB drive that was used to transfer confidential files. The examiner finds that the drive's free space has been overwritten with zeros, but the MFT still shows the names of the deleted files. Which artifact wiping technique was likely used?

File deletion using the Shift+Delete command

Secure erase that overwrites data clusters but not the MFT

Quick format that only clears the file system index

EC-CouncilDigital Forensics Essentials

Domain 3Objective 4

Artifact Wiping and Trail Obfuscation DFE Practice Questions (Page 1)

Part of the Defeating Anti-Forensics Techniques domain, which makes up ~13% of our current practice bank.

34questions here

7free pages

3concepts

Questions 1–5

1expert · hard
A forensic examiner is investigating a suspect's Windows 10 laptop. The suspect is known to have used a file-wiping tool. The examiner finds that the $MFT entries for several files have been cleared, but the $LogFile still contains records of those files' creation. The examiner also finds that the Volume Shadow Copies (VSS) contain an older version of the $MFT. Which of the following is the most reliable way to recover the file names and contents?
Select an answer first
2expert · hard
A forensic examiner is investigating a suspect who used a tool to wipe the free space on a hard drive. The examiner has a forensic image taken before the wiping, but the image is of a different drive model. Which factor is most important when comparing the pre-wipe and post-wipe images?
Select an answer first
3application · medium
A forensic team is investigating a case where the suspect used a tool to wipe free space on the hard drive. The team has a forensic image of the drive taken before the wiping occurred. Which approach is most effective for detecting the wiping activity?
Select an answer first
4application · medium
A company's security team suspects an employee of using a disk-wiping tool to erase evidence of unauthorized data transfers. The employee's workstation has been seized, and the forensic examiner needs to determine whether wiping occurred. Which approach is most effective for detecting the wiping activity?
Select an answer first
5application · medium
A forensic examiner is analyzing a USB drive that was used to transfer confidential files. The examiner finds that the drive's free space has been overwritten with zeros, but the MFT still shows the names of the deleted files. Which artifact wiping technique was likely used?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DFE” is a trademark of its owner, used for identification only.

Artifact Wiping and Trail Obfuscation DFE Practice Questions (Page 1)

Questions 1–5

A forensic examiner is investigating a suspect who used a tool to wipe the free space on a hard drive. The examiner has a forensic image taken before the wiping, but the image is of a different drive model. Which factor is most important when comparing the pre-wipe and post-wipe images?

A forensic team is investigating a case where the suspect used a tool to wipe free space on the hard drive. The team has a forensic image of the drive taken before the wiping occurred. Which approach is most effective for detecting the wiping activity?

A forensic examiner is analyzing a USB drive that was used to transfer confidential files. The examiner finds that the drive's free space has been overwritten with zeros, but the MFT still shows the names of the deleted files. Which artifact wiping technique was likely used?

Keep studying — Defeating Anti-Forensics Techniques