BSFS Digital Forensics and Cybercrime Investigation 2 — Questions and Answers
Question 1: Steganography as it relates to digital forensics involves:
- Hiding secret data within ordinary-looking digital files such as images or audio (Correct answer)
- Encrypting hard drive contents with a passphrase
- Permanently overwriting data to prevent recovery
- Creating fake file system structures to mislead investigators
Correct answer: Hiding secret data within ordinary-looking digital files such as images or audio
Steganography conceals information within a carrier file so the existence of the hidden message is not apparent, making it a counter-forensic technique used by criminals.
Question 2: Which federal law primarily governs the investigation of computer crimes and unauthorized access in the United States?
- Computer Fraud and Abuse Act (CFAA) (Correct answer)
- Electronic Communications Privacy Act (ECPA) only
- Digital Millennium Copyright Act (DMCA)
- USA PATRIOT Act
Correct answer: Computer Fraud and Abuse Act (CFAA)
The CFAA (18 U.S.C. § 1030) is the primary federal statute criminalizing unauthorized access to computer systems and data theft.
Question 3: In digital forensics, 'carving' refers to:
- Recovering files from unallocated disk space based on file signatures, without relying on the file system (Correct answer)
- Physically extracting a hard drive from its casing
- Parsing log files to identify user activity
- Removing malware code from infected system files
Correct answer: Recovering files from unallocated disk space based on file signatures, without relying on the file system
File carving searches raw disk data for known file headers and footers (signatures) to reconstruct deleted or fragmented files that are no longer referenced by the file system.
Question 4: Cloud forensics presents unique challenges primarily because:
- Evidence may be distributed across multiple jurisdictions and servers outside law enforcement's direct control (Correct answer)
- Cloud providers always encrypt data in ways investigators cannot decrypt
- Cloud systems do not store any logs or metadata
- Accessing cloud data requires physical seizure of hardware in all cases
Correct answer: Evidence may be distributed across multiple jurisdictions and servers outside law enforcement's direct control
Cloud data may reside on servers in multiple countries, requiring international legal cooperation and compliance with varying privacy laws before evidence can be obtained.
Question 5: MAC times in digital forensics refer to:
- Modified, Accessed, and Changed (or Created) timestamps associated with files (Correct answer)
- Media Access Control addresses stored in system logs
- Memory Allocation Code times for RAM forensics
- Maximum Access Count limits on file retrieval
Correct answer: Modified, Accessed, and Changed (or Created) timestamps associated with files
MAC timestamps record when a file was last modified, accessed, and when its metadata was changed, providing a chronological record of file activity on a system.
Question 6: A Faraday bag or cage is used during digital evidence collection to:
- Isolate a mobile device from cellular and Wi-Fi signals, preventing remote wiping or data changes (Correct answer)
- Protect electronic devices from static electricity damage
- Maintain chain of custody documentation for digital items
- Cool devices that have overheated during extended use
Correct answer: Isolate a mobile device from cellular and Wi-Fi signals, preventing remote wiping or data changes
A Faraday enclosure blocks electromagnetic signals so a seized device cannot receive commands to remotely wipe data or continue syncing to cloud storage.
BSFS Digital Forensics and Cybercrime Investigation 2
Steganography as it relates to digital forensics involves: