ACFE Digital Forensics and Evidence 4

Question 1

What is the purpose of a MD5 or SHA-256 hash in digital forensics?

Accepted Answer

To verify that a forensic copy is identical to the original evidence

Answer

Cryptographic hashes create a unique digital fingerprint of data; matching hashes between original and copy confirm that no bits were altered during acquisition.

Question 2

An examiner discovers that a suspect used a virtual machine (VM) for financial transactions. Where is the most valuable forensic data typically found?

Accepted Answer

The VM's .vmdk or .vhd disk image file on the host system

Answer

The virtual disk image file (.vmdk, .vhd) contains the entire guest OS file system and can be mounted and examined like a physical drive.

Question 3

In network forensics, what does 'pcap' data contain?

Accepted Answer

Full packet captures of network traffic including payloads

Answer

PCAP (Packet Capture) files store raw network packets, allowing examiners to reconstruct sessions, recover transmitted files, and identify communications.

Question 4

When examining browser history for evidence of fraud, which artifact reveals sites visited even after history was manually cleared in most Chromium-based browsers?

Accepted Answer

DNS cache entries and browser cache thumbnails

Answer

DNS cache and thumbnail/favicon databases may retain visited site evidence even when browsing history is manually deleted from within the browser.

Question 5

A suspect claims a financial spreadsheet was never modified after its creation date. What forensic technique can refute or support this claim?

Accepted Answer

Analyzing MFT timestamps, file metadata, and shadow copy versions

Answer

NTFS MFT timestamps, embedded document metadata, and Volume Shadow Copies can collectively establish the true modification history of a file.

(ACFE) Association of Certified Fraud Examiners Practice Test

(ACFE) Association of Certified Fraud Examiners Practice Test

ACFE Digital Forensics and Evidence 4