ACE Digital Forensic Principles & Methodologies 3 — Questions and Answers
Question 1: When acquiring a forensic image of a hard drive, the investigator calculates an MD5 hash before and after the process. The hashes match. What does this confirm?
- The image was compressed successfully
- The acquisition was completed without altering the original data (Correct answer)
- The drive has no bad sectors
- The image is encrypted
Correct answer: The acquisition was completed without altering the original data
Matching pre- and post-acquisition hashes confirm that the original evidence was not modified during the imaging process.
Question 2: Which file system artifact stores the last eight files deleted from the Windows desktop or Windows Explorer?
- Prefetch files
- The Recycle Bin ($I and $R files) (Correct answer)
- Windows Event Logs
- LNK (shortlink) files
Correct answer: The Recycle Bin ($I and $R files)
The Windows Recycle Bin stores deleted files as $R (content) and $I (metadata) pairs until they are permanently deleted.
Question 3: In AccessData FTK, what does the 'Known File Filter' (KFF) feature help an examiner do?
- Decrypt encrypted files automatically
- Identify and filter known good and known bad files by hash values (Correct answer)
- Recover files from unallocated space
- Generate a chain of custody report
Correct answer: Identify and filter known good and known bad files by hash values
The KFF compares file hashes against databases of known good (OS/application) and known bad (contraband) files to quickly prioritize evidence.
Question 4: What is the purpose of documenting the 'chain of custody' for digital evidence?
- To prove the evidence was encrypted during transport
- To track who had possession of evidence and when, ensuring its integrity (Correct answer)
- To verify the hash value of the evidence
- To identify the format of the forensic image
Correct answer: To track who had possession of evidence and when, ensuring its integrity
Chain of custody documentation ensures evidence integrity by recording every person who handled the evidence and when, defending against tampering allegations.
Question 5: During examination, an investigator finds a file in unallocated disk space. What technique was most likely used to recover it?
- Steganography analysis
- Data carving (Correct answer)
- Registry analysis
- Metadata extraction
Correct answer: Data carving
Data carving recovers files from unallocated space by searching for known file headers and footers without relying on file system structures.
Question 6: A forensic examiner is analyzing Windows artifacts and wants to determine what USB devices were previously connected to a system. Which registry hive should they examine?
- HKEY_LOCAL_MACHINE\SOFTWARE
- HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR (Correct answer)
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
- HKEY_LOCAL_MACHINE\SAM
Correct answer: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR
The USBSTOR registry key records details about USB storage devices that have been connected to the system, including device identifiers.
Question 7: What is the main difference between logical and physical forensic acquisition of a hard drive?
- Logical acquisition is faster and captures only active file system data; physical captures every bit including deleted and slack space (Correct answer)
- Physical acquisition only captures active files; logical captures the entire disk
- Logical acquisition requires a write blocker; physical does not
- Physical acquisition creates a smaller image file than logical acquisition
Correct answer: Logical acquisition is faster and captures only active file system data; physical captures every bit including deleted and slack space
Logical acquisition captures only the visible file system contents, while physical acquisition copies every bit of the drive including deleted files, slack space, and unallocated areas.
ACE Digital Forensic Principles & Methodologies 3
When acquiring a forensic image of a hard drive, the investigator calculates an MD5 hash before and after the process.
The hashes match.
What does this confirm?