Defeating Anti-Forensics Techniques ECSS Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A forensic examiner is investigating a case where the attacker used multiple anti-forensic techniques, including log tampering and data hiding. The examiner has a limited time budget and must decide which technique to analyze first to maximize the chance of identifying the attacker. Which approach is most effective?

   • AAnalyze the memory dump first, as it may contain encryption keys and running processes related to the attack
   • BAnalyze the event logs first, as they may show the attacker's actions
   • CAnalyze the network traffic first, as it may show the attacker's communication
   • DAnalyze the file system for hidden data first
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A forensic examiner is about to acquire a hard drive from a suspect's computer. The suspect is known to use anti-forensic tools that wipe free space. What should the examiner do FIRST to preserve evidence?

   • ACreate a forensic image of the drive using a write-blocker
   • BRun a disk cleanup utility to remove temporary files
   • CCopy only the user's documents folder to an external drive
   • DBoot the computer normally to check if it still works
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   What is the purpose of hashing a forensic image after acquisition?

   • ATo verify that the image is an exact copy of the original evidence
   • BTo compress the image to save storage space
   • CTo encrypt the image to protect it from unauthorized access
   • DTo index the image for faster searching
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   An investigator is examining a seized laptop and finds a folder named 'Documents' that appears empty, but the folder's size on disk is several megabytes. The investigator suspects encryption or password protection. Which step should be taken first to confirm this suspicion?

   • AUse a hex editor to search the entire disk for the folder name
   • BExamine the folder's file system metadata and look for encrypted file system (EFS) or container file indicators
   • CCheck the folder's alternate data streams (ADS) for hidden content
   • DImmediately perform a full disk wipe to prevent data loss
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A forensic investigator is acquiring evidence from a computer that is suspected of containing hidden data in slack space. The investigator wants to ensure that the acquisition process does not alter the evidence. Which tool or method should the investigator use?

   • AA software imaging tool that runs on the suspect system
   • BA hardware write-blocker connected to the suspect drive
   • CA network-based acquisition tool that reads the disk over the network
   • DA file copy of the active files to an external drive
   Reveal Solution Discussion Select an answer first