CCE Computer Forensics Tools & Techniques 4 — Questions and Answers
Question 1: Which SQLite forensics technique allows recovery of records that were deleted from a database but not yet overwritten?
- WAL file analysis
- Freelist page parsing (Correct answer)
- Journal mode inspection
- Index traversal
Correct answer: Freelist page parsing
SQLite stores deleted records in freelist pages until they are reused, allowing forensic recovery through freelist page parsing.
Question 2: What is the forensic significance of the Windows.edb file found in %ProgramData%\Microsoft\Search?
- It stores Windows Update history
- It contains the Windows Search index including content previews (Correct answer)
- It logs failed login attempts
- It maintains the Windows firewall ruleset
Correct answer: It contains the Windows Search index including content previews
Windows.edb is the Windows Search index database that may contain indexed content, metadata, and previews of files even after deletion.
Question 3: Which artifact would best establish a timeline of USB device connections on a Windows 10 system?
- NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2
- SYSTEM\CurrentControlSet\Enum\USBSTOR (Correct answer)
- NTUSER.DAT\Software\Microsoft\Internet Explorer\TypedURLs
- SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Correct answer: SYSTEM\CurrentControlSet\Enum\USBSTOR
The USBSTOR registry key records device class identifiers, serial numbers, and first/last connection times for USB storage devices.
Question 4: In email forensics, which header field is MOST reliable for determining the true origin of a message?
- From:
- X-Originating-IP:
- Reply-To:
- The earliest Received: header (Correct answer)
Correct answer: The earliest Received: header
The earliest (innermost) Received header is added by the originating mail server and is hardest to forge compared to other headers.
Question 5: Which technique does the tool Xways Forensics use to identify files in unallocated space that span multiple non-contiguous clusters?
- Sequential file carving
- Fragmented file carving with block reassembly (Correct answer)
- Inode table reconstruction
- Partition recovery
Correct answer: Fragmented file carving with block reassembly
Fragmented file carving attempts to reassemble files spread across non-contiguous disk sectors using header/footer matching and content validation.
Question 6: A forensic examiner finds a .lnk file pointing to a removable drive that is no longer present. What forensic value does this provide?
- It proves the suspect intentionally deleted evidence
- It reveals the volume serial number and original file path of the accessed file (Correct answer)
- It contains a copy of the accessed file's content
- It logs the network location of the file
Correct answer: It reveals the volume serial number and original file path of the accessed file
Windows .lnk (shortcut) files store metadata including the target volume serial number, MAC times, and original file path of the accessed resource.
Question 7: Which tool is the industry standard for performing RAM acquisition on a live Windows system while minimizing forensic footprint?
- Volatility
- DumpIt (Magnet RAM Capture) (Correct answer)
- Wireshark
- Autopsy
Correct answer: DumpIt (Magnet RAM Capture)
DumpIt/Magnet RAM Capture is widely used for live Windows memory acquisition due to its minimal footprint and single-executable deployment.
CCE Computer Forensics Tools & Techniques 4
Which SQLite forensics technique allows recovery of records that were deleted from a database but not yet overwritten?