CFE Forensic Analysis and Investigation Techniques 2

Question 1

During a forensic investigation, an examiner discovers that log files on a suspect's server have been selectively deleted. Which technique is most appropriate to recover metadata about deleted log entries?

Accepted Answer

Analyze journal or transaction logs from the file system

Answer

File system journals and transaction logs record metadata about file operations, including deletions, and can reveal information about deleted log entries.

Question 2

A forensic examiner is analyzing volatile memory captured from a running system. Which artifact is LEAST likely to be found in a RAM dump?

Accepted Answer

Historical browser cookies stored on disk

Answer

Browser cookies stored on disk are persistent artifacts and are not part of volatile memory; they reside in the file system rather than RAM.

Question 3

When reconstructing a timeline of events in a fraud investigation, which timestamp attribute on NTFS file systems is most commonly manipulated by anti-forensic tools?

Accepted Answer

$STANDARD_INFORMATION timestamps

Answer

$STANDARD_INFORMATION timestamps are easily modified by user-mode tools, while $FILE_NAME timestamps require kernel-level access and are harder to alter.

Question 4

An investigator is examining a suspect's smartphone and finds encrypted messaging app data. The encryption keys are stored in the device's Secure Enclave. What is the most effective approach to access the plaintext messages?

Accepted Answer

Obtain a lawful order compelling the suspect to provide the passcode

Answer

When encryption keys are protected by a Secure Enclave tied to the user's passcode, compelling the user via legal process is often the most practical avenue.

Question 5

During network forensics, an examiner finds that an attacker used DNS tunneling to exfiltrate data. Which characteristic of the captured DNS traffic best confirms this technique?

Accepted Answer

Abnormally long subdomain strings in DNS queries

Answer

DNS tunneling encodes data within subdomain labels, resulting in unusually long, high-entropy subdomain strings in query traffic.

(CFE) Certified Forensic Examiner Practice Test

(CFE) Certified Forensic Examiner Practice Test

CFE Forensic Analysis and Investigation Techniques 2