CCE Computer Forensics Tools & Techniques 2

Question 1

Which Autopsy feature allows investigators to identify files that have been deliberately hidden by renaming their extensions?

Accepted Answer

File signature analysis

Answer

File signature analysis compares a file's magic bytes against its extension to detect mismatches indicating hidden content.

Question 2

When using FTK Imager to acquire a live system, which artifact is most critical to capture before shutting down the machine?

Accepted Answer

Volatile RAM contents

Answer

Volatile RAM contains active processes, network connections, encryption keys, and running malware that are lost upon shutdown.

Question 3

In Wireshark, which display filter would isolate only DNS query traffic?

Accepted Answer

dns.flags.response == 0

Answer

The filter dns.flags.response == 0 specifically isolates DNS query packets, excluding responses.

Question 4

What is the primary purpose of the $MFT file in NTFS forensics?

Accepted Answer

Track all file and directory metadata on the volume

Answer

The Master File Table ($MFT) contains metadata records for every file and directory on an NTFS volume.

Question 5

A suspect used CCleaner before seizure. Which forensic artifact is MOST likely to survive CCleaner's default cleaning?

Accepted Answer

VSS shadow copies

Answer

Volume Shadow Copy Service (VSS) snapshots are typically not touched by CCleaner's default cleaning routines.

(CCE) Certified Computer Examiner Practice Test