Artifact Wiping and Trail Obfuscation DFE Practice Questions (Page 7)

Questions 31–34

1. 31expert · hard

   A security team is investigating a compromised Linux server. The attacker deleted the /var/log/auth.log and cleared the bash history. However, the team finds that the system was configured with auditd and the audit logs are stored in /var/log/audit/audit.log. The attacker also attempted to delete the audit.log but failed because the file was immutable (chattr +i). Which of the following is the most reliable source of evidence?

   • AThe syslog server logs if configured
   • BThe /var/log/auth.log recovered from unallocated space
   • CRecovered bash history from unallocated space
   • DThe immutable audit.log file
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A forensic examiner is investigating a suspect who used a disk-wiping tool to erase the entire hard drive. The examiner has a forensic image of the drive taken after the wiping. The examiner notices that the first few sectors of the drive contain a pattern that is not typical of a wiped drive. Which conclusion is most appropriate?

   • AThe pattern indicates that the drive was not fully wiped
   • BThe pattern is random and has no forensic value
   • CThe pattern is a result of the forensic imaging process
   • DThe pattern may be a remnant of the wiping tool's installation or configuration, which can be used to identify the tool
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A forensic investigator is examining a Windows system where the user has cleared the Prefetch files and the UserAssist registry key. The investigator wants to determine which applications were executed. Which of the following artifacts would be most useful?

   • AThe $MFT and $LogFile
   • BThe Recycle Bin
   • CThe Windows Registry 'Run' keys
   • DThe pagefile.sys
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   An administrator notices that the Windows Event Logs on a critical server have been cleared, and the system time was changed back by two hours during the same period. The administrator suspects an attacker is trying to hide their activities. Which anti-forensic technique is being used, and what should the administrator do to preserve evidence?

   • AArtifact wiping via disk cleaning; use a write blocker to image the disk
   • BData hiding via steganography; search for hidden files on the server
   • CTrail obfuscation via log manipulation and timestamp alteration; preserve the original logs by enabling audit policies and forwarding logs to a remote collector
   • DTrail obfuscation via data hiding; restore the system from backup
   Reveal Solution Discussion Select an answer first