CCE Computer Forensics Tools & Techniques 2 — Questions and Answers
Question 1: Which Autopsy feature allows investigators to identify files that have been deliberately hidden by renaming their extensions?
- File signature analysis (Correct answer)
- Keyword search indexing
- Timeline analysis
- Hash set lookup
Correct answer: File signature analysis
File signature analysis compares a file's magic bytes against its extension to detect mismatches indicating hidden content.
Question 2: When using FTK Imager to acquire a live system, which artifact is most critical to capture before shutting down the machine?
- Hibernation file
- Volatile RAM contents (Correct answer)
- Windows registry hives
- Browser cache
Correct answer: Volatile RAM contents
Volatile RAM contains active processes, network connections, encryption keys, and running malware that are lost upon shutdown.
Question 3: In Wireshark, which display filter would isolate only DNS query traffic?
- tcp.port == 53
- dns.flags.response == 0 (Correct answer)
- udp.port == 53
- ip.proto == 17
Correct answer: dns.flags.response == 0
The filter dns.flags.response == 0 specifically isolates DNS query packets, excluding responses.
Question 4: What is the primary purpose of the $MFT file in NTFS forensics?
- Store file content for small files
- Track all file and directory metadata on the volume (Correct answer)
- Maintain the recycle bin index
- Record Windows event log entries
Correct answer: Track all file and directory metadata on the volume
The Master File Table ($MFT) contains metadata records for every file and directory on an NTFS volume.
Question 5: A suspect used CCleaner before seizure. Which forensic artifact is MOST likely to survive CCleaner's default cleaning?
- Browser cookies
- Windows prefetch files
- VSS shadow copies (Correct answer)
- Temporary internet files
Correct answer: VSS shadow copies
Volume Shadow Copy Service (VSS) snapshots are typically not touched by CCleaner's default cleaning routines.
Question 6: Which steganography detection technique analyzes statistical anomalies in the least significant bits of image pixels?
- Metadata stripping
- RS (Regular-Singular) analysis (Correct answer)
- Hash comparison
- File carving
Correct answer: RS (Regular-Singular) analysis
RS analysis detects LSB steganography by measuring statistical regularities that become disturbed when data is hidden in pixel values.
Question 7: When examining a suspect's iPhone using Cellebrite UFED, which extraction method provides the most complete data including deleted records?
- Logical extraction
- File system extraction
- Physical extraction (Correct answer)
- Cloud extraction
Correct answer: Physical extraction
Physical extraction acquires a bit-for-bit image of the device's flash memory, enabling recovery of deleted data and unallocated space.
CCE Computer Forensics Tools & Techniques 2
Which Autopsy feature allows investigators to identify files that have been deliberately hidden by renaming their extensions?