Which technique is an example of trail obfuscation?

Copying a file to an external drive

Deleting a file using the Shift+Delete command

Changing the timestamp of a file to an earlier date

A forensic examiner is analyzing a suspect's laptop and finds that the $MFT has been partially overwritten, and the $LogFile has been cleared. The examiner also notices that the Last Modified timestamps of several files have been changed to a date in the future. Which combination of anti-forensic techniques is indicated, and what is the most important countermeasure?

Trail obfuscation via log manipulation and timestamp alteration; restore the system from backup

Artifact wiping and data hiding; use steganography detection tools

Artifact wiping and timestamp alteration; use file system journal analysis to recover original timestamps

Log manipulation and data hiding; search for hidden partitions

Which strategy is used to detect artifact wiping attempts during an investigation?

Reviewing the user's browser history

Counting the number of installed applications

Examining the file system for slack space and unallocated clusters

A forensic team is investigating a data breach. The attacker wiped the Windows Event Logs and deleted the $MFT entries for the malicious executable. However, the team finds that the Volume Shadow Copies (VSS) still contain an older version of the event logs. Which countermeasure would be most effective to preserve this evidence?

Disable the Volume Shadow Copy service to prevent further changes

Create a forensic image of the entire disk immediately

Copy the VSS files to a network share

Run a file recovery tool to restore the deleted event logs

A forensic examiner is analyzing a seized laptop from a terminated employee. The examiner notices that the NTFS $LogFile and $UsnJrnl are unusually small and contain no entries for the last two weeks, even though the user was active. The user had administrative rights and had installed a 'privacy cleaner' tool. Which action by the user most directly explains the missing journal entries?

Running a disk defragmentation utility

Using a file shredder on the user's document folder

Changing the system clock back two weeks

Deleting the $LogFile and $UsnJrnl files and recreating them

EC-CouncilDigital Forensics Essentials

Domain 3Objective 4

Artifact Wiping and Trail Obfuscation DFE Practice Questions (Page 6)

Part of the Defeating Anti-Forensics Techniques domain, which makes up ~13% of our current practice bank.

34questions here

7free pages

3concepts

Questions 26–30

26foundation · easy
Which technique is an example of trail obfuscation?
Select an answer first
27expert · hard
A forensic examiner is analyzing a suspect's laptop and finds that the $MFT has been partially overwritten, and the $LogFile has been cleared. The examiner also notices that the Last Modified timestamps of several files have been changed to a date in the future. Which combination of anti-forensic techniques is indicated, and what is the most important countermeasure?
Select an answer first
28foundation · easy
Which strategy is used to detect artifact wiping attempts during an investigation?
Select an answer first
29application · medium
A forensic team is investigating a data breach. The attacker wiped the Windows Event Logs and deleted the $MFT entries for the malicious executable. However, the team finds that the Volume Shadow Copies (VSS) still contain an older version of the event logs. Which countermeasure would be most effective to preserve this evidence?
Select an answer first
30application · medium
A forensic examiner is analyzing a seized laptop from a terminated employee. The examiner notices that the NTFS $LogFile and $UsnJrnl are unusually small and contain no entries for the last two weeks, even though the user was active. The user had administrative rights and had installed a 'privacy cleaner' tool. Which action by the user most directly explains the missing journal entries?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DFE” is a trademark of its owner, used for identification only.

Artifact Wiping and Trail Obfuscation DFE Practice Questions (Page 6)

Questions 26–30

Which technique is an example of trail obfuscation?

Which strategy is used to detect artifact wiping attempts during an investigation?

Keep studying — Defeating Anti-Forensics Techniques