CFE Digital Evidence Collection and Preservation 3

Question 1

When imaging a suspect's SSD, a forensic examiner should be aware that SSDs may alter data through a process called:

Accepted Answer

Wear leveling and TRIM operations

Answer

SSDs use wear leveling to distribute writes evenly and TRIM to erase unused blocks, which can destroy deleted data before or during imaging.

Question 2

In the context of cloud forensics, which challenge is most unique compared to traditional digital forensics?

Accepted Answer

Data may be stored across multiple jurisdictions on shared infrastructure

Answer

Cloud data is often distributed across multiple geographic locations and shared hardware, creating jurisdictional and data segregation challenges unique to cloud forensics.

Question 3

A forensic examiner discovers a file with a .jpg extension but analysis reveals it is actually a ZIP archive. This technique is known as:

Accepted Answer

File signature spoofing or file masquerading

Answer

File masquerading involves changing a file's extension to disguise its true type; file signature (magic bytes) analysis reveals the actual format.

Question 4

Which Windows artifact is most useful for determining which USB devices were previously connected to a system?

Accepted Answer

SYSTEM registry hive (USBSTOR key)

Answer

The USBSTOR key in the Windows SYSTEM registry hive records details about every USB storage device that has been connected to the system.

Question 5

During network forensics, a packet capture shows traffic encrypted with TLS. Without the private key, the examiner should focus on:

Accepted Answer

Metadata such as IP addresses, ports, timestamps, and session duration

Answer

Even without decrypting TLS content, metadata like endpoints, timing, and volume can provide significant investigative value.

(CFE) Certified Forensic Examiner Practice Test

(CFE) Certified Forensic Examiner Practice Test

CFE Digital Evidence Collection and Preservation 3