EC-CouncilDigital Forensics Essentials
Domain 3Objective 4
Artifact Wiping and Trail Obfuscation DFE Practice Questions (Page 2)
Part of the Defeating Anti-Forensics Techniques domain, which makes up ~13% of our current practice bank.
34questions here
7free pages
3concepts
Questions 6–10
- 6
A forensic examiner is reviewing a suspect's Windows system and finds that the 'Last Access' timestamps on many files have been set to the same date, which is the date the suspect claims to have been on vacation. The examiner also notices that the NTFS $UsnJrnl has been cleared. Which trail obfuscation technique is indicated?
Select an answer first - 7
A network administrator discovers that a user has been hiding sensitive documents inside image files using steganography. The administrator also notices that the user has been changing the 'last accessed' timestamps on those image files to hide when they were opened. Which combination of techniques is the user employing?
Select an answer first - 8
During a forensic investigation, an examiner finds that the Last Modified timestamps of several critical system files have been changed to dates that predate the operating system installation. The file content hashes match known-good values. Which trail obfuscation technique is indicated, and what countermeasure should the examiner prioritize?
Select an answer first - 9
An employee is suspected of using a disk-cleaning utility to erase traces of downloaded files. The forensic examiner finds that the $LogFile and $UsnJrnl have been partially overwritten, and the Recycle Bin is empty. Which anti-forensic technique is most likely being used?
Select an answer first - 10
How can investigators mitigate trail obfuscation attempts involving timestamp alteration?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DFE” is a trademark of its owner, used for identification only.