ACFE Digital Forensics and Evidence 3

Question 1

What is 'anti-forensics' and why is it relevant to fraud examiners?

Accepted Answer

Methods used to destroy, hide, or alter digital evidence to impede investigations

Answer

Anti-forensics encompasses techniques like data wiping, timestamp manipulation, and encryption that suspects use to obstruct forensic examination.

Question 2

Which Windows registry hive contains information about recently accessed USB devices?

Accepted Answer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR

Answer

The USBSTOR key records the vendor, product, and serial number of every USB storage device ever connected to the system.

Question 3

In digital evidence handling, what is a 'forensic image' as opposed to a simple file copy?

Accepted Answer

A sector-by-sector duplicate that captures all data including unallocated space

Answer

A forensic image is a bit-for-bit copy of every sector on a storage device, preserving deleted files, slack space, and other artifacts a file copy would miss.

Question 4

A fraud examiner finds that critical log files on a corporate server were deleted two hours after an internal audit was announced. What forensic concept is most relevant?

Accepted Answer

Spoliation of evidence

Answer

Spoliation is the intentional or negligent destruction of evidence, which can result in adverse inference instructions or sanctions against the spoliating party.

Question 5

What type of data exists in a storage device's unallocated space?

Accepted Answer

Fragments of previously deleted files that have not been overwritten

Answer

Unallocated space contains remnants of deleted files whose sectors have not yet been reused, making it a rich source of recoverable evidence.

(ACFE) Association of Certified Fraud Examiners Practice Test

(ACFE) Association of Certified Fraud Examiners Practice Test

ACFE Digital Forensics and Evidence 3