CFC Digital Forensics & Cybercrime 5 — Questions and Answers
Question 1: Which memory forensics artifact can reveal the full command-line arguments used to launch a malicious process, even after the process has terminated?
- Windows Event ID 4688 (process creation) in Security logs (Correct answer)
- The process's PEB (Process Environment Block) in RAM
- File system prefetch records (.pf files)
- Registry Run keys
Correct answer: Windows Event ID 4688 (process creation) in Security logs
Windows Security Event ID 4688 logs process creation events including full command-line arguments when process auditing is enabled, persisting on disk even after the process ends.
Question 2: A social engineering attack where criminals call employees posing as IT support to obtain credentials is best classified as which type of attack?
- Spear phishing
- Vishing (voice phishing) (Correct answer)
- Smishing
- Pretexting via email
Correct answer: Vishing (voice phishing)
Vishing (voice phishing) uses telephone calls where attackers impersonate trusted entities such as IT support to manipulate victims into revealing credentials or sensitive information.
Question 3: During forensic analysis of a Linux system, which log file typically contains authentication failures, SSH login attempts, and sudo usage?
- /var/log/messages
- /var/log/auth.log (or /var/log/secure on RHEL) (Correct answer)
- /var/log/syslog
- /var/log/kern.log
Correct answer: /var/log/auth.log (or /var/log/secure on RHEL)
/var/log/auth.log (Debian/Ubuntu) or /var/log/secure (RHEL/CentOS) records PAM authentication events, SSH sessions, and privilege escalation attempts via sudo.
Question 4: What is 'living off the land' (LotL) in the context of cybercrime investigations, and why does it complicate digital forensics?
- Attackers deploy custom malware compiled on the victim's machine
- Attackers use legitimate built-in system tools (e.g., PowerShell, WMI) to carry out attacks, reducing malware artifacts (Correct answer)
- Attackers store stolen data in cloud services only
- Attackers physically access servers rather than using network intrusion
Correct answer: Attackers use legitimate built-in system tools (e.g., PowerShell, WMI) to carry out attacks, reducing malware artifacts
Living off the land attacks leverage native OS utilities and signed binaries, leaving minimal malware artifacts and making detection harder because the tools themselves are legitimate.
Question 5: A chain of custody document for digital evidence must include which MINIMUM set of information for each transfer?
- File hash values and the examiner's personal opinion of relevance
- Date/time, transferring party, receiving party, and purpose of transfer (Correct answer)
- Originating IP address and MAC address of the seized device
- Judge's signature and court case number at every step
Correct answer: Date/time, transferring party, receiving party, and purpose of transfer
A valid chain of custody record must capture when the transfer occurred, who released the evidence, who received it, and the reason for the transfer at each handoff.
Question 6: Which technique allows an attacker to execute arbitrary code by overflowing a buffer in the stack and overwriting the saved return address?
- Heap spraying
- Stack-based buffer overflow (Correct answer)
- Use-after-free exploit
- Format string attack
Correct answer: Stack-based buffer overflow
A stack-based buffer overflow overwrites adjacent stack memory including the saved return address, redirecting execution flow to attacker-controlled shellcode or a ROP gadget chain.
Question 7: In cryptocurrency forensic investigations, which analytical technique clusters multiple Bitcoin addresses into a single entity based on their co-spending patterns in transactions?
- Zero-knowledge proof analysis
- Common-input ownership heuristic (co-spending clustering) (Correct answer)
- Merkle root tracing
- Block reward attribution
Correct answer: Common-input ownership heuristic (co-spending clustering)
The common-input ownership heuristic groups addresses that appear together as inputs in the same transaction, inferring they are controlled by the same wallet or entity.
CFC Digital Forensics & Cybercrime 5
Which memory forensics artifact can reveal the full command-line arguments used to launch a malicious process, even after the process has terminated?