CFC Digital Forensics & Cybercrime 4 — Questions and Answers
Question 1: An investigator finds an encrypted TrueCrypt/VeraCrypt container on a suspect's device. The suspect refuses to provide the password. Which legal doctrine may compel password disclosure in a US federal case?
- Fifth Amendment protection always prevents compelled disclosure
- The foregone conclusion doctrine may allow a court to compel decryption (Correct answer)
- The Fourth Amendment requires disclosure upon seizure
- Passwords are always protected as attorney-client privilege
Correct answer: The foregone conclusion doctrine may allow a court to compel decryption
Under the foregone conclusion doctrine, a court may compel decryption if the government can independently establish the existence, location, and authenticity of the encrypted files, limiting Fifth Amendment protection.
Question 2: Which type of cyberattack involves sending specially crafted DNS responses to redirect a victim's legitimate domain queries to a malicious IP address?
- DNS cache poisoning (Kaminsky attack) (Correct answer)
- ARP spoofing
- BGP hijacking
- SSL stripping
Correct answer: DNS cache poisoning (Kaminsky attack)
DNS cache poisoning injects fraudulent DNS records into a resolver's cache so that subsequent queries for a legitimate domain resolve to an attacker-controlled IP address.
Question 3: In forensic timeline analysis, which Windows artifact is most valuable for reconstructing a comprehensive timeline of file system activity including file creation, modification, access, and MFT entry changes?
- Windows Event Log (EVTX)
- NTFS $MFT with MACB timestamps (Correct answer)
- Prefetch files (.pf)
- Browser history SQLite databases
Correct answer: NTFS $MFT with MACB timestamps
The NTFS Master File Table contains four timestamps per file entry (Modified, Accessed, Changed/$MFT Entry Modified, Born/Created) enabling MACB timeline reconstruction of all file system activity.
Question 4: A cybercriminal uses a botnet to conduct a distributed denial-of-service (DDoS) attack. Under federal law, which statute most directly criminalizes operating such a botnet?
- 18 U.S.C. § 1030 (CFAA) — transmission of programs causing damage (Correct answer)
- 18 U.S.C. § 2511 (Wiretap Act) — intercepting communications
- 18 U.S.C. § 1343 (Wire Fraud)
- 18 U.S.C. § 875 (Interstate Threats)
Correct answer: 18 U.S.C. § 1030 (CFAA) — transmission of programs causing damage
18 U.S.C. § 1030(a)(5) of the CFAA criminalizes knowingly transmitting programs or commands that intentionally cause damage to protected computers, directly covering botnet-driven DDoS operations.
Question 5: During mobile forensic examination, an analyst uses 'ADB pull' to retrieve files from an Android device. Which extraction type does this represent?
- Physical extraction
- Chip-off extraction
- Logical extraction (Correct answer)
- JTAG extraction
Correct answer: Logical extraction
ADB (Android Debug Bridge) pull commands retrieve files through the operating system layer, making it a logical extraction that returns files as the OS presents them rather than raw disk sectors.
Question 6: Which anti-forensics technique involves overwriting file metadata timestamps to mislead investigators about when a file was created or modified?
- Timestomping (Correct answer)
- Data diddling
- Steganography
- Log truncation
Correct answer: Timestomping
Timestomping is the deliberate manipulation of file system timestamps (MACB times) to conceal the true timeline of file activity and impede forensic investigation.
Question 7: A forensic consultant is called to testify as an expert witness. Under Federal Rule of Evidence 702, which criterion is NOT a requirement for admissibility of expert testimony?
- The testimony is based on sufficient facts or data
- The expert's opinion is shared by a majority of practitioners in the field (Correct answer)
- The testimony is the product of reliable principles and methods
- The expert has reliably applied the principles and methods to the facts
Correct answer: The expert's opinion is shared by a majority of practitioners in the field
FRE 702 does not require majority agreement in the field (general acceptance is a Frye standard element); under Daubert/FRE 702, reliability and methodological soundness are the key criteria.
CFC Digital Forensics & Cybercrime 4
An investigator finds an encrypted TrueCrypt/VeraCrypt container on a suspect's device.
The suspect refuses to provide the password.
Which legal doctrine may compel password disclosure in a US federal case?