CFC Digital Forensics & Cybercrime 2 — Questions and Answers
Question 1: Which file system artifact is most useful for identifying files that were deleted but previously accessed on an NTFS volume?
- $MFT records with zero file size
- $LogFile transaction journal
- $Recycle Bin INFO2 or $I files (Correct answer)
- Volume shadow copies
Correct answer: $Recycle Bin INFO2 or $I files
The $Recycle Bin contains $I files (Windows Vista+) or INFO2 records that store the original path, deletion timestamp, and file size of deleted items.
Question 2: A forensic examiner discovers a 'slack space' artifact. What does this term specifically refer to?
- Unallocated clusters at the end of a partition
- The space between the end of a file's logical size and the end of its last allocated cluster (Correct answer)
- Free space between the MBR and the first partition
- Metadata stored outside normal file system structures
Correct answer: The space between the end of a file's logical size and the end of its last allocated cluster
File slack (also called RAM slack + drive slack) is the unused space between the logical end of a file and the physical end of the last cluster allocated to it.
Question 3: Under the Computer Fraud and Abuse Act (CFAA), which element is NOT required to establish criminal liability for unauthorized computer access?
- Access to a protected computer
- Intent to cause damage or obtain information
- Proof the defendant received financial gain (Correct answer)
- Knowledge that the access was unauthorized
Correct answer: Proof the defendant received financial gain
Financial gain is not required for all CFAA offenses; some subsections only require unauthorized access with intent to defraud or to obtain information.
Question 4: When analyzing a Windows registry hive for forensic evidence, which hive contains user-specific settings such as recently accessed files and installed software per user?
- SYSTEM
- SOFTWARE
- NTUSER.DAT (Correct answer)
- SAM
Correct answer: NTUSER.DAT
NTUSER.DAT is the per-user registry hive located in each user's profile folder and stores personalized settings, MRU lists, and user-specific software keys.
Question 5: In network forensics, what is the primary purpose of capturing pcap (packet capture) files at the time of an incident?
- To log user authentication attempts in plaintext
- To preserve full packet-level evidence of network communications for later analysis (Correct answer)
- To automatically block malicious IP addresses
- To decrypt SSL/TLS traffic in real time
Correct answer: To preserve full packet-level evidence of network communications for later analysis
Pcap files capture raw network traffic including headers and payloads, providing a complete record of communications that can be replayed and analyzed forensically.
Question 6: Which volatile data source should be collected FIRST during live forensic acquisition of a compromised system, before any other action?
- Swap/page file contents
- Running process list and network connections (Correct answer)
- Browser history and cookies
- Event logs stored on disk
Correct answer: Running process list and network connections
Running processes and active network connections are the most volatile data and will be lost immediately upon shutdown, making them the highest priority in live acquisition.
Question 7: A forensic analyst is examining mobile device data. Which extraction method provides the deepest level of access, including deleted data and unallocated space, but requires specialized hardware?
- Logical extraction
- File system extraction
- Physical extraction (JTAG/chip-off) (Correct answer)
- Manual acquisition via UI screenshots
Correct answer: Physical extraction (JTAG/chip-off)
Physical extraction methods such as JTAG and chip-off bypass the operating system to read raw NAND flash memory, enabling recovery of deleted data and unallocated space.
CFC Digital Forensics & Cybercrime 2
Which file system artifact is most useful for identifying files that were deleted but previously accessed on an NTFS volume?