CCE Computer Forensics Tools & Techniques 5

Question 1

During a cloud forensics investigation of an AWS environment, which log source provides API call history including the identity of who made each call?

Accepted Answer

AWS CloudTrail

Answer

AWS CloudTrail records all API calls including the caller's identity, time, source IP, and parameters for governance and forensic investigation.

Question 2

Which anti-forensic technique involves writing random data to all unallocated space on a drive to prevent file carving?

Accepted Answer

Disk wiping/slack space sanitization

Answer

Wiping unallocated space overwrites sectors not currently used by active files, destroying carved data that would otherwise be recoverable.

Question 3

What is the forensic significance of the $I30 file in NTFS directory analysis?

Accepted Answer

It is the directory index that may contain entries for deleted files

Answer

The $I30 attribute is the B-tree index for a directory and may contain slack entries revealing previously existing (deleted) files.

Question 4

In mobile forensics, what does a 'logical extraction' of an Android device typically capture?

Accepted Answer

Files accessible through the Android backup protocol or ADB

Answer

Logical extraction uses Android Debug Bridge (ADB) or backup protocols to copy accessible files and databases without raw flash access.

Question 5

Which Volatility plugin would an examiner use to detect process injection by finding executable memory not backed by a file on disk?

Accepted Answer

malfind

Answer

The malfind plugin identifies memory regions marked executable/writable that lack a corresponding file on disk, a common indicator of code injection.

(CCE) Certified Computer Examiner Practice Test

(CCE) Certified Computer Examiner Practice Test

CCE Computer Forensics Tools & Techniques 5