CCP Disk & Memory Forensics 2 — Questions and Answers
Question 1: Which file system artifact stores metadata about deleted files in Windows NTFS volumes?
- $MFT
- $LogFile
- $Recycle.Bin (Correct answer)
- $Bitmap
Correct answer: $Recycle.Bin
$Recycle.Bin retains metadata (original path, deletion time) about deleted files until they are permanently purged.
Question 2: An investigator finds a memory dump where the EPROCESS list appears intact but scanning with a pool-tag tool reveals hidden processes. Which technique was most likely used?
- Process hollowing
- DKOM (Direct Kernel Object Manipulation) (Correct answer)
- DLL injection
- APC injection
Correct answer: DKOM (Direct Kernel Object Manipulation)
DKOM unlinks EPROCESS entries from the doubly-linked list, hiding processes from list-based tools while pool allocations remain.
Question 3: When imaging a hard drive using dd, which flag ensures that read errors do not halt the acquisition?
- conv=sync
- conv=noerror (Correct answer)
- bs=512
- skip=1
Correct answer: conv=noerror
conv=noerror instructs dd to continue past read errors, typically paired with conv=sync to pad bad blocks.
Question 4: Which Windows registry hive contains the most recently accessed files and applications for a specific user?
- HKLM\SYSTEM
- HKLM\SOFTWARE
- HKCU\NTUSER.DAT (Correct answer)
- HKLM\SAM
Correct answer: HKCU\NTUSER.DAT
NTUSER.DAT is the per-user hive loaded into HKCU; it contains RecentDocs, UserAssist, and other user-activity artifacts.
Question 5: A forensic analyst needs to recover timestamps that were altered by anti-forensic timestomping. Which NTFS artifact is most useful for comparison?
- $I30 directory index
- $MFT Standard Information attribute
- $MFT File Name attribute (Correct answer)
- $LogFile transaction log
Correct answer: $MFT File Name attribute
The $FILE_NAME attribute timestamps are harder to modify via user-mode tools and often differ from the $STANDARD_INFORMATION timestamps after timestomping.
Question 6: In a Windows memory image, which Volatility plugin is best for detecting injected code in a process that has no corresponding file on disk?
- pslist
- malfind (Correct answer)
- dlllist
- handles
Correct answer: malfind
malfind scans process VAD entries for executable memory regions that lack a mapped file on disk, a strong indicator of code injection.
Question 7: Which hash algorithm is preferred over MD5 for forensic evidence integrity verification in modern investigations?
- SHA-1
- SHA-256 (Correct answer)
- CRC32
- LM Hash
Correct answer: SHA-256
SHA-256 is collision-resistant and cryptographically stronger than MD5 or SHA-1, making it the current standard for evidence hashing.
CCP Disk & Memory Forensics 2
Which file system artifact stores metadata about deleted files in Windows NTFS volumes?