CFC Digital Forensics & Cybercrime 3

Question 1

Which steganographic detection technique analyzes statistical irregularities in the least significant bits of image pixel values to identify hidden data?

Accepted Answer

Chi-square analysis

Answer

Chi-square analysis detects LSB steganography by comparing the expected statistical distribution of pixel values to the actual distribution, revealing anomalies caused by hidden data embedding.

Question 2

What is the legal significance of the 'plain view doctrine' in digital forensics searches?

Accepted Answer

Evidence discovered inadvertently during a lawful search may be seized without an additional warrant

Answer

The plain view doctrine allows seizure of evidence that is immediately apparent as contraband or evidence when encountered during an otherwise lawful search, without requiring a separate warrant.

Question 3

In malware forensics, a sample repeatedly calls CreateRemoteThread() targeting other processes. This behavior most likely indicates which technique?

Accepted Answer

Process injection

Answer

CreateRemoteThread() is a Windows API call commonly used by malware to inject and execute code within the address space of another running process.

Question 4

A forensic examiner must authenticate a copy of a hard drive image. Which combination of hash values provides the strongest evidentiary integrity verification?

Accepted Answer

MD5 of the original drive and SHA-256 of the image

Answer

Computing both MD5 and SHA-256 on the original drive and the forensic image at the time of acquisition provides dual-algorithm verification that guards against collision attacks and confirms bit-for-bit accuracy.

Question 5

Under what legal authority can US law enforcement compel a third-party cloud provider to disclose stored communications content?

Accepted Answer

The Electronic Communications Privacy Act (ECPA) via a search warrant

Answer

Under the Stored Communications Act (part of ECPA), law enforcement must obtain a search warrant supported by probable cause to compel disclosure of stored content from third-party providers.

(CFC) Certified Forensic Consultant Practice Test

(CFC) Certified Forensic Consultant Practice Test

CFC Digital Forensics & Cybercrime 3