CCD CCD Digital Forensics & Evidence Handling 2 — Questions and Answers
Question 1: Which file system artifact in Windows records metadata about files including creation, modification, and access times?
- SAM database
- Master File Table (MFT) (Correct answer)
- Registry hive SOFTWARE
- Event log .evtx files
Correct answer: Master File Table (MFT)
The NTFS Master File Table (MFT) contains metadata for every file on the volume, including timestamps, file size, and attributes critical for forensic timelines.
Question 2: What type of forensic analysis examines RAM to find running processes, network connections, and encryption keys?
- Disk forensics
- Memory forensics (volatile forensics) (Correct answer)
- Network forensics
- Log forensics
Correct answer: Memory forensics (volatile forensics)
Memory forensics analyzes RAM dumps to uncover running processes, open network connections, decrypted data, and malware that may not appear on disk.
Question 3: Which open-source framework is the standard tool for performing memory forensics analysis?
- Autopsy
- Volatility (Correct answer)
- FTK Imager
- Rekall (deprecated, now Volatility)
Correct answer: Volatility
Volatility is the industry-standard open-source framework for extracting digital artifacts from volatile memory (RAM) dumps.
Question 4: A forensic investigator finds a file with a `.jpg` extension but the hex signature shows `4D 5A`. What does this indicate?
- A valid JPEG image
- The file is a Windows executable (PE file) with a disguised extension (Correct answer)
- A corrupt image file
- A compressed ZIP archive
Correct answer: The file is a Windows executable (PE file) with a disguised extension
The hex signature `4D 5A` (MZ) is the magic number for Windows PE (Portable Executable) files, indicating the file is an executable disguised with a .jpg extension.
Question 5: What is 'slack space' in the context of digital forensics?
- Unused disk space after formatting
- The space between the end of a file and the end of its allocated disk cluster that may contain residual data (Correct answer)
- Temporary file storage during analysis
- Free space on network shares
Correct answer: The space between the end of a file and the end of its allocated disk cluster that may contain residual data
Slack space is the unused portion of a disk cluster after a file ends, which can contain remnants of previously stored data valuable to forensic investigators.
Question 6: Which Windows Registry hive contains information about recently run programs, USB device history, and user activity?
- HKLM\SYSTEM only
- NTUSER.DAT (user-specific hive) and SYSTEM hive (Correct answer)
- HKLM\SECURITY only
- HKLM\SAM only
Correct answer: NTUSER.DAT (user-specific hive) and SYSTEM hive
NTUSER.DAT contains per-user registry data including recent documents and program execution, while the SYSTEM hive records device connection history including USB devices.
CCD CCD Digital Forensics & Evidence Handling 2
Which file system artifact in Windows records metadata about files including creation, modification, and access times?