CCE Digital Evidence Collection & Preservation 4 — Questions and Answers
Question 1: What does the acronym 'MACB' refer to in NTFS timestamp analysis?
- Modified, Accessed, Changed, Born (Correct answer)
- Metadata, Allocation, Checksum, Backup
- Modified, Archived, Created, Backed-up
- Master, Attributed, Cached, Backed-up
Correct answer: Modified, Accessed, Changed, Born
MACB stands for Modified, Accessed, Changed (MFT entry changed), and Born (created), representing the four timestamps stored in NTFS MFT entries for each file.
Question 2: An investigator is collecting evidence from a crime scene involving cryptocurrency transactions. Which type of storage media is most critical to locate?
- Optical discs containing wallet backups
- Hardware wallets and devices storing private keys (Correct answer)
- Standard USB drives with transaction logs
- Cloud storage accounts linked to exchange accounts
Correct answer: Hardware wallets and devices storing private keys
Hardware wallets store private keys in dedicated secure chips and represent direct control over cryptocurrency funds, making them the highest priority item in cryptocurrency investigations.
Question 3: What is 'timestamp manipulation' and why is it forensically significant?
- Automatically updating file dates when accessed, which is normal OS behavior
- The deliberate alteration of file system timestamps to obscure when files were created or modified (Correct answer)
- Using NTP synchronization to correct system clock errors
- Daylight saving time adjustments that shift log file times
Correct answer: The deliberate alteration of file system timestamps to obscure when files were created or modified
Timestamp manipulation is the intentional changing of file system timestamps to hide or alter the timeline of events, which is forensically significant as it represents evidence tampering.
Question 4: During evidence packaging, what should be used to package hard drives to protect against electrostatic discharge?
- Bubble wrap and cardboard boxes
- Anti-static bags and foam padding (Correct answer)
- Aluminum foil wrapping
- Standard evidence bags with desiccant packets
Correct answer: Anti-static bags and foam padding
Hard drives must be packaged in anti-static bags to prevent electrostatic discharge damage, combined with foam padding for physical shock protection during transport.
Question 5: What is the primary difference between a logical acquisition and a physical acquisition of a mobile device?
- Logical acquisition is faster but only captures allocated files; physical acquisition captures the entire memory chip including deleted data (Correct answer)
- Physical acquisition requires the device to be powered on; logical acquisition can be done powered off
- Logical acquisition requires specialized chip-off equipment; physical acquisition uses standard cables
- Physical acquisition only works on Android devices; logical acquisition works on all platforms
Correct answer: Logical acquisition is faster but only captures allocated files; physical acquisition captures the entire memory chip including deleted data
Logical acquisition extracts only allocated, accessible files through the OS, while physical acquisition captures a bit-for-bit image of the memory including deleted and unallocated space.
Question 6: When collecting RAM from a live system using a tool like WinPmem or DumpIt, what critical information must be recorded about the acquisition?
- The RAM manufacturer and production date
- The system time, running processes, and tool version used during capture (Correct answer)
- The BIOS version and boot sequence order
- The RAM clock speed and latency settings
Correct answer: The system time, running processes, and tool version used during capture
Documenting the system time, running processes, and acquisition tool version during RAM capture establishes context for later analysis and satisfies chain of custody requirements.
Question 7: A forensic examiner finds that a suspect used CCleaner before law enforcement arrived. What is the most likely forensic impact?
- All data on the drive is permanently unrecoverable
- Temporary files, browser history, and some deleted file remnants may have been wiped from free space (Correct answer)
- Only the Windows registry was affected by the cleaning
- System restore points were deleted but all user files remain intact
Correct answer: Temporary files, browser history, and some deleted file remnants may have been wiped from free space
CCleaner typically wipes temporary files, browser artifacts, and may overwrite free space, but a thorough forensic examination may still recover data from unaffected areas and log files.
CCE Digital Evidence Collection & Preservation 4
What does the acronym 'MACB' refer to in NTFS timestamp analysis?