Defeating Anti-Forensics Techniques ECSS Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   Which of the following is a sign that system logs may have been tampered with?

   • AGaps in the sequence of log entry timestamps
   • BLog entries are written in plain text
   • CLog files have a .log extension
   • DLog files are stored in a central server
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A forensic analyst is reviewing a set of JPEG images from a suspect's computer. One image has an unusually large file size compared to its resolution, and the color histogram shows an abnormal distribution. Which technique should the analyst use to determine if data is hidden inside the image?

   • ACompare the image's MD5 hash to a known database of clean images
   • BOpen the image in a text editor and search for the string 'steg'
   • CRun a steganography detection tool that analyzes LSB (least significant bit) patterns
   • DCheck the image's alternate data stream for hidden text
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A forensic analyst is examining a suspect's computer and finds a file that appears to be a normal image, but the analyst suspects that the file contains hidden data. The analyst also notices that the system has a tool that can create hidden partitions. Which anti-forensic technique is the suspect most likely using?

   • AData hiding in slack space
   • BEncryption to protect the image file
   • CLog tampering to hide the file's creation
   • DSteganography to hide data in the image
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   Which technique is used to hide a secret message inside a digital image by modifying the least significant bits of pixel data?

   • AHashing
   • BSalting
   • CTokenization
   • DLSB steganography
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   During a forensic examination of a Windows system, you notice that a file named 'notes.txt' has a size of 2 KB, but when you list its alternate data streams, you find a stream named 'hidden' with a size of 5 MB. What should you do to preserve this evidence?

   • AExtract the 'hidden' stream using a forensic tool that supports NTFS ADS
   • BCopy the file to a FAT32 USB drive to preserve it
   • CDelete the file and recreate it with the hidden data
   • DRename the file to 'hidden.txt' to make the stream visible
   Reveal Solution Discussion Select an answer first