ACFE Digital Forensics and Evidence 3 — Questions and Answers
Question 1: What is 'anti-forensics' and why is it relevant to fraud examiners?
- Techniques used to authenticate digital evidence in court
- Methods used to destroy, hide, or alter digital evidence to impede investigations (Correct answer)
- Software that automates evidence collection
- Chain-of-custody documentation procedures
Correct answer: Methods used to destroy, hide, or alter digital evidence to impede investigations
Anti-forensics encompasses techniques like data wiping, timestamp manipulation, and encryption that suspects use to obstruct forensic examination.
Question 2: Which Windows registry hive contains information about recently accessed USB devices?
- HKEY_LOCAL_MACHINE\SOFTWARE
- HKEY_CURRENT_USER\Software\Microsoft\Office
- HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR (Correct answer)
- HKEY_LOCAL_MACHINE\SECURITY
Correct answer: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR
The USBSTOR key records the vendor, product, and serial number of every USB storage device ever connected to the system.
Question 3: In digital evidence handling, what is a 'forensic image' as opposed to a simple file copy?
- A screenshot of the suspect's desktop
- A sector-by-sector duplicate that captures all data including unallocated space (Correct answer)
- A compressed archive of the user's document folder
- A log file generated by antivirus software
Correct answer: A sector-by-sector duplicate that captures all data including unallocated space
A forensic image is a bit-for-bit copy of every sector on a storage device, preserving deleted files, slack space, and other artifacts a file copy would miss.
Question 4: A fraud examiner finds that critical log files on a corporate server were deleted two hours after an internal audit was announced. What forensic concept is most relevant?
- Spoliation of evidence (Correct answer)
- Chain of custody
- Hearsay exception
- Best evidence rule
Correct answer: Spoliation of evidence
Spoliation is the intentional or negligent destruction of evidence, which can result in adverse inference instructions or sanctions against the spoliating party.
Question 5: What type of data exists in a storage device's unallocated space?
- Only the operating system files
- Fragments of previously deleted files that have not been overwritten (Correct answer)
- Real-time process memory snapshots
- Current user session cookies
Correct answer: Fragments of previously deleted files that have not been overwritten
Unallocated space contains remnants of deleted files whose sectors have not yet been reused, making it a rich source of recoverable evidence.
Question 6: Which of the following is an example of volatile data that must be collected first at a live fraud scene?
- Documents stored on an external hard drive
- Contents of RAM including running processes and open network connections (Correct answer)
- Emails archived in a PST file
- Database backup files on a NAS device
Correct answer: Contents of RAM including running processes and open network connections
RAM is volatile and its contents are lost when a system is powered off, so live system memory must be captured before any shutdown.
Question 7: How can metadata embedded in a Microsoft Word document assist a fraud examiner?
- It reveals the document's encryption key
- It can expose the author's name, revision history, and creation date (Correct answer)
- It contains a digital signature verifiable by ACFE
- It shows which printer was used to produce the document
Correct answer: It can expose the author's name, revision history, and creation date
Word document metadata (stored in document properties) often includes the original author, last editor, total editing time, and revision dates that can contradict a suspect's claims.
ACFE Digital Forensics and Evidence 3
What is 'anti-forensics' and why is it relevant to fraud examiners?