CCP Disk & Memory Forensics 2

Question 1

Which file system artifact stores metadata about deleted files in Windows NTFS volumes?

Accepted Answer

$Recycle.Bin

Answer

$Recycle.Bin retains metadata (original path, deletion time) about deleted files until they are permanently purged.

Question 2

An investigator finds a memory dump where the EPROCESS list appears intact but scanning with a pool-tag tool reveals hidden processes. Which technique was most likely used?

Accepted Answer

DKOM (Direct Kernel Object Manipulation)

Answer

DKOM unlinks EPROCESS entries from the doubly-linked list, hiding processes from list-based tools while pool allocations remain.

Question 3

When imaging a hard drive using dd, which flag ensures that read errors do not halt the acquisition?

Accepted Answer

conv=noerror

Answer

conv=noerror instructs dd to continue past read errors, typically paired with conv=sync to pad bad blocks.

Question 4

Which Windows registry hive contains the most recently accessed files and applications for a specific user?

Accepted Answer

HKCU\NTUSER.DAT

Answer

NTUSER.DAT is the per-user hive loaded into HKCU; it contains RecentDocs, UserAssist, and other user-activity artifacts.

Question 5

A forensic analyst needs to recover timestamps that were altered by anti-forensic timestomping. Which NTFS artifact is most useful for comparison?

Accepted Answer

$MFT File Name attribute

Answer

The $FILE_NAME attribute timestamps are harder to modify via user-mode tools and often differ from the $STANDARD_INFORMATION timestamps after timestomping.

(CCP) Certified Cyber Professional Practice Test

(CCP) Certified Cyber Professional Practice Test

CCP Disk & Memory Forensics 2