Defeating Anti-Forensics Techniques ECSS Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   An investigator is examining a seized smartphone and finds an app that creates encrypted vaults. The investigator needs to access the data inside the vault for evidence. Which approach is most appropriate?

   • AIgnore the vault and focus on other evidence
   • BAttempt to brute-force the vault password using a dictionary attack
   • CLook for the password in the device's memory dump or in the app's configuration files
   • DPerform a factory reset to remove the encryption
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   During a forensic examination of a Windows 10 workstation, you notice that the NTFS volume has a large amount of unallocated space that does not match the expected slack based on the cluster size. The user is suspected of hiding sensitive documents. Which technique should you use to check for hidden data in the slack space?

   • ACheck the Master File Table (MFT) for resident data in file records
   • BRun a file carving tool that scans unallocated clusters for file signatures
   • CEnumerate alternate data streams on all files using a stream listing tool
   • DUse a forensic tool that reads the raw disk and extracts the slack space of each cluster for analysis
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which type of file is commonly used as a carrier for steganographic data?

   • AAudio files
   • BSystem log files
   • CExecutable files
   • DConfiguration files
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A forensic examiner is analyzing a USB drive that is suspected of containing encrypted files. The examiner finds a file with a .enc extension and no other files on the drive. Which step should the examiner take to determine if the file is encrypted?

   • AOpen the file in a text editor to look for readable text
   • BCheck the file's entropy to see if it is high, which indicates encryption
   • CChange the file extension to .txt and open it
   • DRun a virus scan on the file
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What is a primary goal of anti-forensics?

   • ATo increase the time and effort required for forensic analysis
   • BTo ensure evidence is preserved in its original state
   • CTo make data more accessible to forensic tools
   • DTo simplify the chain of custody process
   Reveal Solution Discussion Select an answer first