ACFE Digital Forensics and Evidence 4

Question 1

What is the purpose of a MD5 or SHA-256 hash in digital forensics?

Accepted Answer

To verify that a forensic copy is identical to the original evidence

Answer

To compress evidence files for storage efficiency

Answer

To encrypt sensitive case notes

Answer

To index files for rapid keyword searching

Question 2

An examiner discovers that a suspect used a virtual machine (VM) for financial transactions. Where is the most valuable forensic data typically found?

Accepted Answer

The VM's .vmdk or .vhd disk image file on the host system

Answer

The host operating system's pagefile.sys only

Answer

The VM software's installation directory

Answer

The suspect's email client on the host machine

Question 3

In network forensics, what does 'pcap' data contain?

Accepted Answer

Full packet captures of network traffic including payloads

Answer

A log of user authentication failures

Answer

A summary report of bandwidth utilization

Answer

Encrypted VPN tunnel endpoints

Question 4

When examining browser history for evidence of fraud, which artifact reveals sites visited even after history was manually cleared in most Chromium-based browsers?

Accepted Answer

DNS cache entries and browser cache thumbnails

Answer

The browser's bookmarks file

Answer

The hosts file in the operating system

Answer

Browser extension manifests

Question 5

A suspect claims a financial spreadsheet was never modified after its creation date. What forensic technique can refute or support this claim?

Accepted Answer

Analyzing MFT timestamps, file metadata, and shadow copy versions

Answer

Reviewing the file's digital signature certificate

Answer

Checking the file's size against a known database

Answer

Running the file through antivirus software

Question 6

Which of the following best describes 'file slack space' in digital forensics?

Accepted Answer

The unused space between the end of a file's data and the end of its last allocated cluster

Answer

Empty sectors at the end of a hard drive partition

Answer

Temporary files created by the OS during file operations

Answer

Space reserved by the file system for metadata

Question 7

What is the forensic significance of the Windows 'LNK' (shortcut) files?

Accepted Answer

They can reveal the original path, creation date, and MAC address of files accessed even from removed devices

Answer

They store encrypted copies of recently accessed documents

Answer

They contain browser session cookies for linked websites

Answer

They log all failed login attempts on the system