CCE Computer Forensics Tools & Techniques 5 — Questions and Answers
Question 1: During a cloud forensics investigation of an AWS environment, which log source provides API call history including the identity of who made each call?
- VPC Flow Logs
- AWS CloudTrail (Correct answer)
- CloudWatch Metrics
- S3 Access Logs
Correct answer: AWS CloudTrail
AWS CloudTrail records all API calls including the caller's identity, time, source IP, and parameters for governance and forensic investigation.
Question 2: Which anti-forensic technique involves writing random data to all unallocated space on a drive to prevent file carving?
- Secure deletion
- Disk wiping/slack space sanitization (Correct answer)
- Metadata stripping
- Encryption
Correct answer: Disk wiping/slack space sanitization
Wiping unallocated space overwrites sectors not currently used by active files, destroying carved data that would otherwise be recoverable.
Question 3: What is the forensic significance of the $I30 file in NTFS directory analysis?
- It tracks NTFS journal transactions
- It is the directory index that may contain entries for deleted files (Correct answer)
- It stores alternate data streams
- It records file encryption certificates
Correct answer: It is the directory index that may contain entries for deleted files
The $I30 attribute is the B-tree index for a directory and may contain slack entries revealing previously existing (deleted) files.
Question 4: In mobile forensics, what does a 'logical extraction' of an Android device typically capture?
- Raw NAND flash chip data
- Files accessible through the Android backup protocol or ADB (Correct answer)
- Baseband processor firmware
- SIM card raw data
Correct answer: Files accessible through the Android backup protocol or ADB
Logical extraction uses Android Debug Bridge (ADB) or backup protocols to copy accessible files and databases without raw flash access.
Question 5: Which Volatility plugin would an examiner use to detect process injection by finding executable memory not backed by a file on disk?
- pslist
- malfind (Correct answer)
- dlllist
- cmdline
Correct answer: malfind
The malfind plugin identifies memory regions marked executable/writable that lack a corresponding file on disk, a common indicator of code injection.
Question 6: When analyzing a JPEG image for metadata, which tool and metadata type would reveal the GPS coordinates where a photo was taken?
- Strings tool, ASCII text extraction
- ExifTool, EXIF GPS metadata (Correct answer)
- Binwalk, embedded file analysis
- Foremost, file header signatures
Correct answer: ExifTool, EXIF GPS metadata
ExifTool parses EXIF metadata embedded in JPEG files, including GPS latitude/longitude coordinates recorded by camera-enabled devices.
Question 7: A forensic investigator is analyzing a TrueCrypt/VeraCrypt container. Without the password, which technique may still yield useful evidence?
- Brute-force decryption of the container
- Searching RAM dumps for encryption keys using memory forensics (Correct answer)
- Running fsck on the container
- Analyzing the container's file system metadata
Correct answer: Searching RAM dumps for encryption keys using memory forensics
Encryption keys loaded into RAM during active use can sometimes be recovered from memory dumps using tools like Volatility's truecryptmaster plugin.
CCE Computer Forensics Tools & Techniques 5
During a cloud forensics investigation of an AWS environment, which log source provides API call history including the identity of who made each call?