CCE File Systems & Data Recovery 3 — Questions and Answers
Question 1: What term describes the area on a hard disk between the end of one partition and the start of the next, which may contain hidden or deleted data?
- Slack space
- Unpartitioned space (Correct answer)
- Volume shadow
- Bad sector pool
Correct answer: Unpartitioned space
Unpartitioned space (also called inter-partition space) is the area on a disk not assigned to any partition and can be used to hide data or may contain remnants of old partitions.
Question 2: Which Windows artifact stores up to the last 1,000 commands typed into the command prompt during a session?
- Prefetch files
- ConsoleHost history (Correct answer)
- LNK files
- MUI cache
Correct answer: ConsoleHost history
PowerShell/ConsoleHost_history.txt and the in-memory console command history store recently executed commands, which can provide evidence of attacker or user activity.
Question 3: In a GUID Partition Table (GPT) disk, where is the primary partition table header located?
- Sector 0
- Sector 1 (Correct answer)
- Sector 2
- Last sector of the disk
Correct answer: Sector 1
In GPT, sector 0 holds a Protective MBR for legacy compatibility, and the primary GPT header is stored in sector 1 (LBA 1), with a backup at the last sector.
Question 4: What is the purpose of the $LogFile in NTFS?
- Stores user login events
- Provides transaction journaling for metadata changes (Correct answer)
- Tracks bad clusters
- Caches recently accessed files
Correct answer: Provides transaction journaling for metadata changes
$LogFile is NTFS's transaction log that records metadata changes, allowing the file system to recover from crashes by replaying or rolling back incomplete transactions.
Question 5: During data carving, a forensic tool identifies a file header signature but cannot find a footer signature. What is the most likely outcome?
- The file will not be recovered at all
- The tool will carve a file up to a maximum size limit (Correct answer)
- The tool will skip to the next partition
- The carved file will be flagged as encrypted
Correct answer: The tool will carve a file up to a maximum size limit
When no footer is found, most carving tools recover data up to a configurable maximum file size, which may result in a larger-than-actual file or truncated output.
Question 6: Which of the following best describes the concept of 'time stomping' in a forensic investigation?
- Synchronizing system clocks across networked devices
- Deliberately modifying file timestamps to obscure activity (Correct answer)
- Recovering overwritten timestamps from the MFT
- Adjusting timestamps for time zone differences
Correct answer: Deliberately modifying file timestamps to obscure activity
Time stomping is an anti-forensics technique where an attacker alters MAC(E) timestamps on files to disguise when they were created, modified, or accessed.
Question 7: What Windows file system feature can store alternate versions of a file's $DATA attribute under a different name, sometimes used to hide data?
- Symbolic links
- Alternate Data Streams (Correct answer)
- Sparse files
- Reparse points
Correct answer: Alternate Data Streams
NTFS Alternate Data Streams (ADS) allow additional data to be associated with a file under a colon-separated name (e.g., file.txt:hidden), which is invisible in standard directory listings.
CCE File Systems & Data Recovery 3
What term describes the area on a hard disk between the end of one partition and the start of the next, which may contain hidden or deleted data?