CFE Digital Evidence Collection and Preservation 3 — Questions and Answers
Question 1: When imaging a suspect's SSD, a forensic examiner should be aware that SSDs may alter data through a process called:
- Defragmentation
- Wear leveling and TRIM operations (Correct answer)
- Bad sector reallocation only
- Index rebuilding
Correct answer: Wear leveling and TRIM operations
SSDs use wear leveling to distribute writes evenly and TRIM to erase unused blocks, which can destroy deleted data before or during imaging.
Question 2: In the context of cloud forensics, which challenge is most unique compared to traditional digital forensics?
- Inability to create forensic images
- Data may be stored across multiple jurisdictions on shared infrastructure (Correct answer)
- Cloud data cannot be hashed for integrity
- Metadata is never available from cloud providers
Correct answer: Data may be stored across multiple jurisdictions on shared infrastructure
Cloud data is often distributed across multiple geographic locations and shared hardware, creating jurisdictional and data segregation challenges unique to cloud forensics.
Question 3: A forensic examiner discovers a file with a .jpg extension but analysis reveals it is actually a ZIP archive. This technique is known as:
- Steganography
- File signature spoofing or file masquerading (Correct answer)
- Encryption
- Data carving
Correct answer: File signature spoofing or file masquerading
File masquerading involves changing a file's extension to disguise its true type; file signature (magic bytes) analysis reveals the actual format.
Question 4: Which Windows artifact is most useful for determining which USB devices were previously connected to a system?
- Event Log Application hive
- SYSTEM registry hive (USBSTOR key) (Correct answer)
- SAM database
- Prefetch files
Correct answer: SYSTEM registry hive (USBSTOR key)
The USBSTOR key in the Windows SYSTEM registry hive records details about every USB storage device that has been connected to the system.
Question 5: During network forensics, a packet capture shows traffic encrypted with TLS. Without the private key, the examiner should focus on:
- Brute-forcing the encryption key
- Metadata such as IP addresses, ports, timestamps, and session duration (Correct answer)
- Disregarding the traffic as unexaminable
- Requesting a new capture with a protocol downgrade attack
Correct answer: Metadata such as IP addresses, ports, timestamps, and session duration
Even without decrypting TLS content, metadata like endpoints, timing, and volume can provide significant investigative value.
Question 6: The 'order of volatility' principle in digital forensics dictates that examiners should collect:
- Archived data before live system data
- The most volatile data first, proceeding to less volatile sources (Correct answer)
- Physical media before any logical data
- External storage before internal storage
Correct answer: The most volatile data first, proceeding to less volatile sources
The order of volatility requires collecting the most transient data (RAM, CPU registers) first because it is lost soonest, before moving to less volatile sources like hard drives.
Question 7: What does 'chain of custody' documentation for digital evidence primarily establish?
- The technical specifications of the evidence device
- A chronological record of who controlled, handled, or transferred the evidence (Correct answer)
- The cost of the forensic investigation
- The encryption method used to protect the evidence
Correct answer: A chronological record of who controlled, handled, or transferred the evidence
Chain of custody documentation creates an unbroken record of every person who accessed or handled evidence, ensuring its admissibility and integrity in legal proceedings.
CFE Digital Evidence Collection and Preservation 3
When imaging a suspect's SSD, a forensic examiner should be aware that SSDs may alter data through a process called: