CFC Digital Forensics & Cybercrime 3 — Questions and Answers
Question 1: Which steganographic detection technique analyzes statistical irregularities in the least significant bits of image pixel values to identify hidden data?
- Chi-square analysis (Correct answer)
- Hex dump comparison
- Entropy coding
- Metadata stripping
Correct answer: Chi-square analysis
Chi-square analysis detects LSB steganography by comparing the expected statistical distribution of pixel values to the actual distribution, revealing anomalies caused by hidden data embedding.
Question 2: What is the legal significance of the 'plain view doctrine' in digital forensics searches?
- Examiners may search any file if a warrant exists for the device
- Evidence discovered inadvertently during a lawful search may be seized without an additional warrant (Correct answer)
- Digital evidence is always admissible if found on a seized device
- Law enforcement may expand a search scope based on anticipation of finding evidence
Correct answer: Evidence discovered inadvertently during a lawful search may be seized without an additional warrant
The plain view doctrine allows seizure of evidence that is immediately apparent as contraband or evidence when encountered during an otherwise lawful search, without requiring a separate warrant.
Question 3: In malware forensics, a sample repeatedly calls CreateRemoteThread() targeting other processes. This behavior most likely indicates which technique?
- Rootkit kernel patching
- Process injection (Correct answer)
- Polymorphic code mutation
- SQL injection
Correct answer: Process injection
CreateRemoteThread() is a Windows API call commonly used by malware to inject and execute code within the address space of another running process.
Question 4: A forensic examiner must authenticate a copy of a hard drive image. Which combination of hash values provides the strongest evidentiary integrity verification?
- CRC32 of the image file only
- MD5 of the original drive and SHA-256 of the image (Correct answer)
- MD5 alone, computed at acquisition
- SHA-1 of the image taken one week after acquisition
Correct answer: MD5 of the original drive and SHA-256 of the image
Computing both MD5 and SHA-256 on the original drive and the forensic image at the time of acquisition provides dual-algorithm verification that guards against collision attacks and confirms bit-for-bit accuracy.
Question 5: Under what legal authority can US law enforcement compel a third-party cloud provider to disclose stored communications content?
- The Electronic Communications Privacy Act (ECPA) via a search warrant (Correct answer)
- A subpoena alone, without judicial review
- The Fourth Amendment directly, without court order
- The Patriot Act Section 215 for all digital content
Correct answer: The Electronic Communications Privacy Act (ECPA) via a search warrant
Under the Stored Communications Act (part of ECPA), law enforcement must obtain a search warrant supported by probable cause to compel disclosure of stored content from third-party providers.
Question 6: During ransomware incident response, what is the MOST critical first step after confirming active ransomware encryption?
- Pay the ransom to stop encryption immediately
- Isolate affected systems from the network to prevent lateral spread (Correct answer)
- Run antivirus scans across all network shares
- Restore from backup without investigating the infection vector
Correct answer: Isolate affected systems from the network to prevent lateral spread
Immediate network isolation of infected systems stops ransomware from spreading to additional network resources and encrypting further files, limiting the damage footprint.
Question 7: Which artifact in macOS is analogous to the Windows Prefetch files and can reveal which applications were recently executed?
- .bash_history file
- Spotlight index (store.db) (Correct answer)
- QuarantineEventsV2 database
- Prior application execution in .plist launch agents
Correct answer: Spotlight index (store.db)
The Spotlight metadata store (store.db) on macOS records file metadata including last-used timestamps, and unified logs/audit logs can reveal application execution, though macOS lacks a direct Prefetch equivalent.
CFC Digital Forensics & Cybercrime 3
Which steganographic detection technique analyzes statistical irregularities in the least significant bits of image pixel values to identify hidden data?