CCD Digital Forensics & Evidence Handling Flashcards

Which file system artifact in Windows records metadata about files including creation, modification, and access times?

Answer: Master File Table (MFT)

The NTFS Master File Table (MFT) contains metadata for every file on the volume, including timestamps, file size, and attributes critical for forensic timelines.

What type of forensic analysis examines RAM to find running processes, network connections, and encryption keys?

Answer: Memory forensics (volatile forensics)

Memory forensics analyzes RAM dumps to uncover running processes, open network connections, decrypted data, and malware that may not appear on disk.

Which open-source framework is the standard tool for performing memory forensics analysis?

Answer: Volatility

Volatility is the industry-standard open-source framework for extracting digital artifacts from volatile memory (RAM) dumps.

A forensic investigator finds a file with a `.jpg` extension but the hex signature shows `4D 5A`. What does this indicate?

Answer: The file is a Windows executable (PE file) with a disguised extension

The hex signature `4D 5A` (MZ) is the magic number for Windows PE (Portable Executable) files, indicating the file is an executable disguised with a .jpg extension.

What is 'slack space' in the context of digital forensics?

Answer: The space between the end of a file and the end of its allocated disk cluster that may contain residual data

Slack space is the unused portion of a disk cluster after a file ends, which can contain remnants of previously stored data valuable to forensic investigators.

Which Windows Registry hive contains information about recently run programs, USB device history, and user activity?

Answer: NTUSER.DAT (user-specific hive) and SYSTEM hive

NTUSER.DAT contains per-user registry data including recent documents and program execution, while the SYSTEM hive records device connection history including USB devices.