CFE Forensic Analysis and Investigation Techniques 2 — Questions and Answers
Question 1: During a forensic investigation, an examiner discovers that log files on a suspect's server have been selectively deleted. Which technique is most appropriate to recover metadata about deleted log entries?
- Restore from the most recent full backup
- Analyze journal or transaction logs from the file system (Correct answer)
- Reinstall the operating system to regenerate logs
- Query the application's live database for missing entries
Correct answer: Analyze journal or transaction logs from the file system
File system journals and transaction logs record metadata about file operations, including deletions, and can reveal information about deleted log entries.
Question 2: A forensic examiner is analyzing volatile memory captured from a running system. Which artifact is LEAST likely to be found in a RAM dump?
- Encryption keys currently in use
- Network socket connection details
- Recently executed process list
- Historical browser cookies stored on disk (Correct answer)
Correct answer: Historical browser cookies stored on disk
Browser cookies stored on disk are persistent artifacts and are not part of volatile memory; they reside in the file system rather than RAM.
Question 3: When reconstructing a timeline of events in a fraud investigation, which timestamp attribute on NTFS file systems is most commonly manipulated by anti-forensic tools?
- $STANDARD_INFORMATION timestamps (Correct answer)
- $FILE_NAME timestamps
- MFT entry sequence numbers
- Volume serial numbers
Correct answer: $STANDARD_INFORMATION timestamps
$STANDARD_INFORMATION timestamps are easily modified by user-mode tools, while $FILE_NAME timestamps require kernel-level access and are harder to alter.
Question 4: An investigator is examining a suspect's smartphone and finds encrypted messaging app data. The encryption keys are stored in the device's Secure Enclave. What is the most effective approach to access the plaintext messages?
- Perform a physical extraction and brute-force the encryption
- Obtain a lawful order compelling the suspect to provide the passcode (Correct answer)
- Use a chip-off technique to extract the Secure Enclave firmware
- Apply frequency analysis to the encrypted message corpus
Correct answer: Obtain a lawful order compelling the suspect to provide the passcode
When encryption keys are protected by a Secure Enclave tied to the user's passcode, compelling the user via legal process is often the most practical avenue.
Question 5: During network forensics, an examiner finds that an attacker used DNS tunneling to exfiltrate data. Which characteristic of the captured DNS traffic best confirms this technique?
- Unusually high volume of MX record lookups
- Abnormally long subdomain strings in DNS queries (Correct answer)
- Repeated PTR (reverse lookup) queries for the same IP
- DNS responses with very short TTL values
Correct answer: Abnormally long subdomain strings in DNS queries
DNS tunneling encodes data within subdomain labels, resulting in unusually long, high-entropy subdomain strings in query traffic.
Question 6: A CFE is reconstructing financial transactions from a hard drive where the file allocation table has been corrupted. Which carving technique should be used first?
- Header-footer carving based on known file signatures (Correct answer)
- Keyword searching for dollar amounts
- Logical file system parsing using the corrupted FAT
- Sector-by-sector comparison with a clean disk image
Correct answer: Header-footer carving based on known file signatures
Header-footer carving identifies files by their known magic bytes and file signatures, bypassing the need for a functional file allocation table.
Question 7: In an investigation involving insider trading, a forensic examiner reviews email metadata. Which metadata field is most useful for proving that an email was sent before a specific market event?
- The 'From' header field
- The 'X-Originating-IP' header
- The 'Date' header with server-stamped Received timestamps (Correct answer)
- The 'Message-ID' field
Correct answer: The 'Date' header with server-stamped Received timestamps
The 'Date' header combined with Received timestamps added by mail servers provides a verifiable chronological record that is difficult to falsify across multiple servers.
CFE Forensic Analysis and Investigation Techniques 2
During a forensic investigation, an examiner discovers that log files on a suspect's server have been selectively deleted.
Which technique is most appropriate to recover metadata about deleted log entries?