ALISON Digital Forensics & Cybercrime Investigation 2 — Questions and Answers
Question 1: What does 'live forensics' refer to in digital investigations?
- Forensics performed on systems that are currently powered on and running (Correct answer)
- Analysing video footage from live security cameras
- Real-time analysis of network intrusion attempts
- Forensics performed in a live TV broadcast
Correct answer: Forensics performed on systems that are currently powered on and running
Live forensics involves collecting volatile data (RAM, running processes, network connections) from a powered-on system before shutting it down.
Question 2: Which Windows artifact stores recently accessed files and is valuable to forensic investigators?
- Pagefile.sys
- Registry hive NTUSER.DAT
- Windows Event Logs
- Link files (LNK files) (Correct answer)
Correct answer: Link files (LNK files)
Windows LNK (shortcut) files automatically created in Recent Items contain metadata about accessed files including timestamps and original file paths.
Question 3: What is the purpose of the Windows Registry in a forensic investigation?
- It stores temporary internet files and browser cache
- It records system configuration, user activity, and installed software that can reveal attacker behavior (Correct answer)
- It contains all email messages sent and received on the system
- It stores encrypted copies of all user passwords
Correct answer: It records system configuration, user activity, and installed software that can reveal attacker behavior
The Windows Registry contains keys tracking program execution, USB connections, recently accessed files, and persistence mechanisms used by malware.
Question 4: What type of file system artifact allows forensic investigators to recover deleted files on NTFS volumes?
- Master Boot Record
- Master File Table ($MFT) (Correct answer)
- Volume Shadow Copies
- Recycle Bin metadata
Correct answer: Master File Table ($MFT)
The NTFS Master File Table ($MFT) retains metadata about deleted files even after deletion, enabling partial or full file recovery.
Question 5: What is 'steganography' and why is it relevant to digital forensics?
- A technique for encrypting network traffic to avoid detection
- Hiding data within ordinary-looking files like images to conceal communications or exfiltrate data (Correct answer)
- A method for bypassing file system access controls
- A type of malware that hides in system firmware
Correct answer: Hiding data within ordinary-looking files like images to conceal communications or exfiltrate data
Steganography conceals data inside carrier files, and forensic investigators must detect and extract hidden content during investigations.
Question 6: Which log file in Linux systems is most useful for tracking user authentication events during a forensic investigation?
- /var/log/syslog
- /var/log/auth.log (Correct answer)
- /var/log/kern.log
- /var/log/dmesg
Correct answer: /var/log/auth.log
The /var/log/auth.log file on Debian/Ubuntu systems records all authentication attempts, sudo usage, SSH logins, and account changes.
ALISON Digital Forensics & Cybercrime Investigation 2
What does 'live forensics' refer to in digital investigations?