CCT Digital Forensics & Malware Analysis 1 — Questions and Answers
Question 1: Which principle ensures that digital evidence is not altered during a forensic investigation?
- Non-repudiation
- Chain of custody
- Write blocking (Correct answer)
- Order of volatility
Correct answer: Write blocking
Write blockers are hardware or software tools that prevent any write operations to storage media, ensuring evidence integrity during acquisition.
Question 2: What is the correct order of volatility when collecting digital evidence, starting with the most volatile?
- Hard disk, RAM, CPU registers, network traffic
- CPU registers, RAM, network traffic, hard disk (Correct answer)
- Network traffic, RAM, CPU registers, hard disk
- RAM, hard disk, CPU registers, network traffic
Correct answer: CPU registers, RAM, network traffic, hard disk
CPU registers and cache are lost instantly on power-off, followed by RAM, then active network connections, with persistent disk storage being least volatile.
Question 3: A forensic investigator uses the SHA-256 algorithm on a disk image immediately after acquisition and again after analysis. What is the purpose of this action?
- Encrypting the image for secure storage
- Verifying the image has not been tampered with (Correct answer)
- Compressing the image to save space
- Authenticating the investigator's identity
Correct answer: Verifying the image has not been tampered with
Hashing the image before and after analysis produces a cryptographic fingerprint; matching hashes prove the image was not altered, maintaining evidence integrity.
Question 4: Which type of malware disguises itself as legitimate software to trick users into installing it?
- Worm
- Rootkit
- Trojan horse (Correct answer)
- Ransomware
Correct answer: Trojan horse
A Trojan horse masquerades as a benign or useful application while secretly performing malicious actions once executed by the user.
Question 5: During static malware analysis, which technique is used to identify readable strings embedded in a binary without executing it?
- Dynamic instrumentation
- Strings extraction (Correct answer)
- Sandbox detonation
- Behavioral logging
Correct answer: Strings extraction
The 'strings' command extracts human-readable ASCII/Unicode text from a binary, revealing URLs, registry keys, and other indicators without running the malware.
Question 6: What is the primary purpose of a forensic disk image (e.g., an E01 or raw DD image)?
- To back up user files for recovery
- To create a bit-for-bit copy of storage media for analysis (Correct answer)
- To compress evidence for courtroom presentation
- To encrypt data before chain-of-custody transfer
Correct answer: To create a bit-for-bit copy of storage media for analysis
A forensic image captures every bit of the source media, including deleted files and slack space, allowing analysis without touching the original evidence.
Question 7: Which file system artifact is most useful for determining when files were created, modified, or accessed on an NTFS volume?
- Master Boot Record (MBR)
- $MFT (Master File Table) (Correct answer)
- Volume Boot Record (VBR)
- File Allocation Table (FAT)
Correct answer: $MFT (Master File Table)
The NTFS $MFT stores metadata for every file including MAC (Modified, Accessed, Created) timestamps, which are critical forensic artifacts.
CCT Digital Forensics & Malware Analysis 1
Which principle ensures that digital evidence is not altered during a forensic investigation?