ACFE Digital Forensics and Evidence 2 — Questions and Answers
Question 1: What is the primary purpose of a write blocker in digital forensics?
- To encrypt the evidence drive
- To prevent any data from being written to the evidence drive during acquisition (Correct answer)
- To speed up the imaging process
- To verify the hash value of the evidence
Correct answer: To prevent any data from being written to the evidence drive during acquisition
A write blocker prevents the forensic tool from altering the evidence drive by blocking all write commands while allowing read operations.
Question 2: Which file system artifact is most useful for identifying when a file was deleted on a Windows NTFS volume?
- Prefetch files
- The $Recycle.Bin folder and $I files (Correct answer)
- The MFT $BITMAP attribute
- Windows Event Log entries
Correct answer: The $Recycle.Bin folder and $I files
The $Recycle.Bin folder stores $I files (index files) that contain the original path and deletion timestamp for each deleted file.
Question 3: In the context of email fraud investigations, what does 'email header analysis' primarily reveal?
- The content of attachments
- The routing path and originating server of a message (Correct answer)
- The recipient's read receipt status
- The encryption method used
Correct answer: The routing path and originating server of a message
Email headers contain 'Received' fields that trace the message's path through mail servers, helping identify the true originating IP address.
Question 4: A fraud examiner recovers a suspect's smartphone. Which extraction method yields the most comprehensive data, including deleted records?
- Logical extraction
- Manual (manual screen capture)
- Physical extraction (Correct answer)
- File system extraction
Correct answer: Physical extraction
Physical extraction creates a bit-for-bit image of the device's memory chip, allowing recovery of deleted data and unallocated space artifacts.
Question 5: What does 'MAC times' refer to in digital forensics?
- Media Access Control timestamps on network packets
- Modified, Accessed, and Created/Changed timestamps on files (Correct answer)
- Machine Authentication Certificate timestamps
- Master Allocation Chart time entries
Correct answer: Modified, Accessed, and Created/Changed timestamps on files
MAC times (Modified, Accessed, Changed/Created) are file system metadata timestamps that help establish a timeline of file activity.
Question 6: Which of the following best describes 'steganography' as it relates to fraud investigations?
- Encrypting financial records with a strong cipher
- Hiding data within innocuous files such as images or audio (Correct answer)
- Fragmenting files across multiple storage devices
- Using anonymizing networks to mask internet traffic
Correct answer: Hiding data within innocuous files such as images or audio
Steganography conceals secret data within ordinary-looking files, which fraudsters may use to covertly transfer stolen information.
Question 7: During a forensic investigation of cloud storage, which legal instrument is typically required to compel a US-based cloud provider to produce user data?
- A civil subpoena duces tecum
- A National Security Letter
- A search warrant or court order under the Stored Communications Act (SCA) (Correct answer)
- An administrative subpoena issued by the ACFE
Correct answer: A search warrant or court order under the Stored Communications Act (SCA)
The Stored Communications Act governs law enforcement access to electronic communications stored by third-party providers, generally requiring a warrant or court order.
ACFE Digital Forensics and Evidence 2
What is the primary purpose of a write blocker in digital forensics?