A forensic examiner is investigating a suspect's SSD. The suspect used a wiping tool that overwrites free space with zeros. However, the examiner finds that some deleted files are still recoverable. Which of the following is the most likely reason?

The wiping tool only overwrote the MFT entries, not the data clusters

The files were stored in the Recycle Bin and not actually deleted

The wiping tool did not account for the SSD's wear-leveling and over-provisioning

The wiping tool was not run with administrative privileges

A user is suspected of using a secure deletion tool to wipe individual files. The forensic examiner finds that the files' MFT entries are gone, but the clusters that contained the data show patterns of multiple overwrites. Which conclusion is most appropriate?

The file content can be recovered by carving from unallocated space

The MFT entries are recoverable from the $LogFile

The files were simply moved to the Recycle Bin

The file content is likely unrecoverable, but the overwrite patterns may indicate the use of a specific wiping tool

During an investigation, an examiner finds that a suspect used a tool to wipe the unallocated space on a hard drive. The examiner also notices that the partition table has been modified to hide a small partition. Which countermeasure is most effective for detecting the hidden partition?

Analyze the $MFT for deleted files

Perform a full disk image and analyze the raw disk layout for anomalies

Run a file recovery tool on the visible partitions

Check the Windows Registry for recently used tools

What is the goal of log manipulation as a trail obfuscation technique?

To increase the size of log files

To remove or alter entries that record user activity

To back up logs to a remote server

To encrypt log files for secure storage

Which method is commonly used to wipe storage media to prevent data recovery?

Moving files to a different directory

Overwriting the media with patterns of data

Compressing files to reduce their size

Renaming files to obscure their contents

EC-CouncilDigital Forensics Essentials

Domain 3Objective 4

Artifact Wiping and Trail Obfuscation DFE Practice Questions (Page 4)

Part of the Defeating Anti-Forensics Techniques domain, which makes up ~13% of our current practice bank.

34questions here

7free pages

3concepts

Questions 16–20

16expert · hard
A forensic examiner is investigating a suspect's SSD. The suspect used a wiping tool that overwrites free space with zeros. However, the examiner finds that some deleted files are still recoverable. Which of the following is the most likely reason?
Select an answer first
17application · medium
A user is suspected of using a secure deletion tool to wipe individual files. The forensic examiner finds that the files' MFT entries are gone, but the clusters that contained the data show patterns of multiple overwrites. Which conclusion is most appropriate?
Select an answer first
18application · medium
During an investigation, an examiner finds that a suspect used a tool to wipe the unallocated space on a hard drive. The examiner also notices that the partition table has been modified to hide a small partition. Which countermeasure is most effective for detecting the hidden partition?
Select an answer first
19foundation · easy
What is the goal of log manipulation as a trail obfuscation technique?
Select an answer first
20foundation · easy
Which method is commonly used to wipe storage media to prevent data recovery?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DFE” is a trademark of its owner, used for identification only.