A forensic examiner is investigating a suspect's computer. The examiner finds a file that appears to be encrypted, but the suspect claims it is just a random data file. The examiner has a memory dump from the suspect's computer. Which action is most likely to prove or disprove the claim?

Compare the file's hash to known random data files

Check the file's creation date to see if it matches the suspect's story

Search the memory dump for encryption keys or software artifacts associated with the file

Run a disk defragmentation to see if the file is fragmented

A forensic analyst is investigating a case involving child exploitation and finds a collection of audio files. The analyst suspects that hidden data may be embedded in the audio files using steganography. Which tool or technique is most appropriate to detect this?

Convert the audio files to a different format and compare file sizes

Listen to the audio files in their entirety to detect hidden messages

Check the audio files' ID3 tags for hidden messages

Use an audio steganography detection tool that analyzes the frequency spectrum for anomalies

A system administrator notices that the Windows Event Logs on a server have gaps in the timeline, and the last entry before the gap is followed by a log entry with a timestamp that is earlier than the previous one. What does this indicate, and what should the administrator do?

The system clock was adjusted; the administrator should reset the clock and move on

The logs were likely cleared or tampered with; the administrator should preserve the logs and analyze them for evidence of tampering

The logs are simply rotated; the administrator should ignore the gap and continue normal operations

The logs are corrupted; the administrator should delete them and start fresh

EC-CouncilCertified Security Specialist

Domain 5Objective 5

Defeating Anti-Forensics Techniques ECSS Practice Questions (Page 1)

Part of the Digital Forensics Fundamentals and Acquisition domain, which makes up ~12% of our current practice bank.

45questions here

9free pages

8concepts

Questions 1–5

1expert · hard
A forensic examiner is investigating a suspect's computer. The examiner finds a file that appears to be encrypted, but the suspect claims it is just a random data file. The examiner has a memory dump from the suspect's computer. Which action is most likely to prove or disprove the claim?
Select an answer first
2application · easy
A forensic examiner is analyzing a Windows system and finds a file that appears to be a normal text file, but its size is larger than expected. The examiner suspects that data is hidden in an alternate data stream (ADS). Which command should the examiner use to list all ADS associated with the file?
Select an answer first
3application · medium
A forensic analyst is investigating a case involving child exploitation and finds a collection of audio files. The analyst suspects that hidden data may be embedded in the audio files using steganography. Which tool or technique is most appropriate to detect this?
Select an answer first
4foundation · easy
Which file system feature allows data to be hidden in a file without being visible in normal directory listings?
Select an answer first
5application · medium
A system administrator notices that the Windows Event Logs on a server have gaps in the timeline, and the last entry before the gap is followed by a log entry with a timestamp that is earlier than the previous one. What does this indicate, and what should the administrator do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECSS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECSS” is a trademark of its owner, used for identification only.

Defeating Anti-Forensics Techniques ECSS Practice Questions (Page 1)

Questions 1–5

A forensic examiner is investigating a suspect's computer. The examiner finds a file that appears to be encrypted, but the suspect claims it is just a random data file. The examiner has a memory dump from the suspect's computer. Which action is most likely to prove or disprove the claim?

A forensic analyst is investigating a case involving child exploitation and finds a collection of audio files. The analyst suspects that hidden data may be embedded in the audio files using steganography. Which tool or technique is most appropriate to detect this?

Which file system feature allows data to be hidden in a file without being visible in normal directory listings?

A system administrator notices that the Windows Event Logs on a server have gaps in the timeline, and the last entry before the gap is followed by a log entry with a timestamp that is earlier than the previous one. What does this indicate, and what should the administrator do?

Keep studying — Digital Forensics Fundamentals and Acquisition