During a forensic acquisition of a Linux system, the investigator discovers that the suspect used a tool to overwrite free space on the disk. The investigator needs to recover deleted files that may have been overwritten. Which approach is most likely to yield evidence?

Run a filesystem journal analysis to recover the deleted files

Use a file carving tool on the raw disk image to recover files based on file signatures

Ask the suspect for the password to the encryption tool

Restore the system from a backup taken after the overwriting occurred

During a forensic acquisition of a Windows 10 workstation, the investigator notices that the NTFS volume has an unusually large amount of unallocated space relative to the total number of files on the disk. The suspect is known to have used a file-wiping tool. Which action should the investigator take to ensure that hidden data in slack space is not missed?

Use a file recovery tool on the active filesystem only

Run a quick format on the drive before imaging to clear slack space

Perform a logical acquisition of only active files and folders

Perform a physical acquisition of the entire disk and analyze unallocated and slack space

Which of the following is an objective of anti-forensics?

Avoiding detection by forensic investigators

Facilitating the recovery of deleted files

Ensuring data is stored in a forensically sound manner

Improving the accuracy of forensic timelines

A forensic team is investigating a case where the suspect used a tool to securely delete files and then cleared the event logs. The team has a forensic image of the disk and needs to recover evidence. Which technique is most likely to recover deleted files?

Restoring the system from a backup taken before the deletion

Using a password recovery tool to decrypt the deleted files

File carving on the unallocated space of the forensic image

Analyzing the event logs for traces of the deleted files

A forensic examiner is analyzing a set of images from a suspect's camera. The images appear normal, but the examiner suspects steganography. The examiner has limited time and must decide which technique to use to detect hidden data. The images are JPEG format and vary in size. Which technique is most likely to reveal steganographic content?

Analyze the images for statistical anomalies, such as unusual color distribution or noise patterns

Check the images' EXIF data for hidden messages

Compare the images to known clean versions using hash analysis

Use a hex editor to look for readable text in the image files

EC-CouncilCertified Security Specialist

Domain 5Objective 5

Defeating Anti-Forensics Techniques ECSS Practice Questions (Page 6)

Part of the Digital Forensics Fundamentals and Acquisition domain, which makes up ~12% of our current practice bank.

45questions here

9free pages

8concepts

Questions 26–30

26application · medium
During a forensic acquisition of a Linux system, the investigator discovers that the suspect used a tool to overwrite free space on the disk. The investigator needs to recover deleted files that may have been overwritten. Which approach is most likely to yield evidence?
Select an answer first
27application · medium
During a forensic acquisition of a Windows 10 workstation, the investigator notices that the NTFS volume has an unusually large amount of unallocated space relative to the total number of files on the disk. The suspect is known to have used a file-wiping tool. Which action should the investigator take to ensure that hidden data in slack space is not missed?
Select an answer first
28foundation · easy
Which of the following is an objective of anti-forensics?
Select an answer first
29expert · hard
A forensic team is investigating a case where the suspect used a tool to securely delete files and then cleared the event logs. The team has a forensic image of the disk and needs to recover evidence. Which technique is most likely to recover deleted files?
Select an answer first
30expert · hard
A forensic examiner is analyzing a set of images from a suspect's camera. The images appear normal, but the examiner suspects steganography. The examiner has limited time and must decide which technique to use to detect hidden data. The images are JPEG format and vary in size. Which technique is most likely to reveal steganographic content?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECSS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECSS” is a trademark of its owner, used for identification only.

Defeating Anti-Forensics Techniques ECSS Practice Questions (Page 6)

Questions 26–30

During a forensic acquisition of a Linux system, the investigator discovers that the suspect used a tool to overwrite free space on the disk. The investigator needs to recover deleted files that may have been overwritten. Which approach is most likely to yield evidence?

Which of the following is an objective of anti-forensics?

A forensic team is investigating a case where the suspect used a tool to securely delete files and then cleared the event logs. The team has a forensic image of the disk and needs to recover evidence. Which technique is most likely to recover deleted files?

Keep studying — Digital Forensics Fundamentals and Acquisition