CCE Computer Forensics Tools & Techniques 4

Question 1

Which SQLite forensics technique allows recovery of records that were deleted from a database but not yet overwritten?

Accepted Answer

Freelist page parsing

Answer

SQLite stores deleted records in freelist pages until they are reused, allowing forensic recovery through freelist page parsing.

Question 2

What is the forensic significance of the Windows.edb file found in %ProgramData%\Microsoft\Search?

Accepted Answer

It contains the Windows Search index including content previews

Answer

Windows.edb is the Windows Search index database that may contain indexed content, metadata, and previews of files even after deletion.

Question 3

Which artifact would best establish a timeline of USB device connections on a Windows 10 system?

Accepted Answer

SYSTEM\CurrentControlSet\Enum\USBSTOR

Answer

The USBSTOR registry key records device class identifiers, serial numbers, and first/last connection times for USB storage devices.

Question 4

In email forensics, which header field is MOST reliable for determining the true origin of a message?

Accepted Answer

The earliest Received: header

Answer

The earliest (innermost) Received header is added by the originating mail server and is hardest to forge compared to other headers.

Question 5

Which technique does the tool Xways Forensics use to identify files in unallocated space that span multiple non-contiguous clusters?

Accepted Answer

Fragmented file carving with block reassembly

Answer

Fragmented file carving attempts to reassemble files spread across non-contiguous disk sectors using header/footer matching and content validation.

(CCE) Certified Computer Examiner Practice Test