Artifact Wiping and Trail Obfuscation DFE Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A forensic examiner is analyzing a Windows system where the suspect used a tool to clear the event logs and also changed the system time to confuse the timeline. The examiner has a memory dump taken before the system was shut down. Which approach is most effective for reconstructing the true timeline of events?

   • ARely on the Windows Event Logs, as they are the primary source of timeline information
   • BAnalyze the memory dump for network connections, process creation times, and open file handles
   • CUse file system timestamps, as they are not affected by system time changes
   • DCheck the Prefetch files for recently executed programs
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A forensic examiner is investigating a Windows system where the user has wiped the Prefetch files, cleared the $UsnJrnl, and changed the system clock to avoid detection. The examiner needs to determine the actual time of file access. Which of the following approaches would be most effective?

   • ACompare the timestamps in the $LogFile with the known time zone changes
   • BUse the file's 'Last Written' timestamps in the $MFT
   • CCheck the Windows Event Logs for logon events
   • DAnalyze the Volume Shadow Copies for file versions
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   An investigator is examining a suspect's computer and finds that the Last Access timestamps of many files have been changed to the same date and time. The files' content hashes are unchanged. Which technique is indicated, and what is the best way to verify the alteration?

   • ATimestamp alteration; compare the timestamps with the $MFT and $UsnJrnl records
   • BArtifact wiping; search for deleted files in unallocated space
   • CData hiding; look for hidden files in the same directory
   • DLog manipulation; check the Windows Event Logs for logon events
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A system administrator suspects that a user has been accessing sensitive files after hours. The admin checks the Windows Event Logs and finds that the 'Logon' events for the user's account show times that conflict with badge-access records. The admin also notices that the system's time zone is set to a different region than the company's. Which trail obfuscation technique is most likely being used?

   • ALog manipulation
   • BArtifact wiping of the event log files
   • CData hiding in alternate data streams
   • DSteganography in image files
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the primary purpose of artifact wiping in anti-forensics?

   • ATo permanently delete files from the recycle bin
   • BTo encrypt data so that it cannot be read without a key
   • CTo remove traces of digital activity from storage media
   • DTo create backups of important files for recovery
   Reveal Solution Discussion Select an answer first