CCE Computer Forensics Tools & Techniques 3

Question 1

Which tool is specifically designed to parse and analyze Windows Registry hives for forensic evidence?

Accepted Answer

RegRipper

Answer

RegRipper automates the extraction of forensically relevant data from Windows Registry hives using plugin-based analysis.

Question 2

In a Windows system, the ShellBags registry key primarily records evidence of:

Accepted Answer

Folder browsing history including deleted folders

Answer

ShellBags store Windows Explorer folder view settings and persist even after the folder is deleted, revealing browsing history.

Question 3

What does the Volatility framework's 'pslist' plugin enumerate during memory forensics?

Accepted Answer

Active processes from the EPROCESS doubly linked list

Answer

The pslist plugin walks the EPROCESS doubly linked list in memory to enumerate active processes at the time of the memory capture.

Question 4

Which file carving technique reconstructs files based on header and footer signatures rather than file system metadata?

Accepted Answer

Signature-based carving

Answer

Signature-based carving identifies file boundaries using known magic bytes (headers) and terminators (footers) to reconstruct files from raw disk data.

Question 5

An investigator finds a file with MAC times all identical and very recent. This most likely indicates:

Accepted Answer

Timestomping was used to obscure the file's true age

Answer

Timestomping is an anti-forensic technique that modifies file timestamps; all-identical recent times often indicate deliberate manipulation.

(CCE) Certified Computer Examiner Practice Test

(CCE) Certified Computer Examiner Practice Test

CCE Computer Forensics Tools & Techniques 3