CCD CCD Digital Forensics & Evidence Handling 2

Question 1

Which file system artifact in Windows records metadata about files including creation, modification, and access times?

Accepted Answer

Master File Table (MFT)

Answer

The NTFS Master File Table (MFT) contains metadata for every file on the volume, including timestamps, file size, and attributes critical for forensic timelines.

Question 2

What type of forensic analysis examines RAM to find running processes, network connections, and encryption keys?

Accepted Answer

Memory forensics (volatile forensics)

Answer

Memory forensics analyzes RAM dumps to uncover running processes, open network connections, decrypted data, and malware that may not appear on disk.

Question 3

Which open-source framework is the standard tool for performing memory forensics analysis?

Accepted Answer

Volatility

Answer

Volatility is the industry-standard open-source framework for extracting digital artifacts from volatile memory (RAM) dumps.

Question 4

A forensic investigator finds a file with a `.jpg` extension but the hex signature shows `4D 5A`. What does this indicate?

Accepted Answer

The file is a Windows executable (PE file) with a disguised extension

Answer

The hex signature `4D 5A` (MZ) is the magic number for Windows PE (Portable Executable) files, indicating the file is an executable disguised with a .jpg extension.

Question 5

What is 'slack space' in the context of digital forensics?

Accepted Answer

The space between the end of a file and the end of its allocated disk cluster that may contain residual data

Answer

Slack space is the unused portion of a disk cluster after a file ends, which can contain remnants of previously stored data valuable to forensic investigators.

(CCD) Certified Cyber Defender Practice Test

(CCD) Certified Cyber Defender Practice Test

CCD CCD Digital Forensics & Evidence Handling 2