CFE Forensic Analysis and Investigation Techniques 3 — Questions and Answers
Question 1: A forensic examiner is asked to analyze a suspect's cloud storage account. Which legal instrument is typically required to compel a US-based cloud provider to disclose a foreign national's data?
- A subpoena issued under the Foreign Intelligence Surveillance Act
- A warrant under the Stored Communications Act (18 U.S.C. § 2703) (Correct answer)
- An administrative summons from a federal regulatory agency
- A mutual legal assistance treaty (MLAT) request only
Correct answer: A warrant under the Stored Communications Act (18 U.S.C. § 2703)
The Stored Communications Act governs compelled disclosure of stored electronic communications from US-based providers, including data belonging to foreign nationals.
Question 2: During a fraud investigation, an examiner applies Benford's Law to a dataset of expense reimbursements. Which finding would be MOST suspicious?
- A leading-digit distribution closely matching Benford's expected curve
- An unusually high frequency of entries beginning with the digit 9 (Correct answer)
- A slight overrepresentation of entries starting with digit 1
- Random variation across all leading digits with no consistent pattern
Correct answer: An unusually high frequency of entries beginning with the digit 9
Benford's Law predicts that digit 1 leads most frequently; an excess of entries starting with 9 suggests fabricated or manipulated figures.
Question 3: When conducting a forensic examination of a Linux system, which command provides the most reliable list of recently executed commands, even after the bash history file has been cleared?
- cat /var/log/auth.log | grep bash
- Examine the .bash_history file in each user's home directory
- Review auditd logs configured to capture execve system calls (Correct answer)
- Check the /proc filesystem for running process arguments
Correct answer: Review auditd logs configured to capture execve system calls
When Linux auditd is configured to log execve system calls, it captures command execution records in a tamper-evident audit log independent of bash history.
Question 4: An examiner is analyzing a financial fraud case where the suspect used shell companies across multiple jurisdictions. Which investigative technique is most effective for tracing the ultimate beneficial owner?
- Reviewing the shell companies' publicly filed articles of incorporation
- Analyzing correspondent banking records and SWIFT message trails (Correct answer)
- Issuing subpoenas directly to the shell companies' registered agents
- Conducting open-source searches on the companies' websites
Correct answer: Analyzing correspondent banking records and SWIFT message trails
Correspondent banking records and SWIFT message trails document the movement of funds between institutions and can reveal the true controlling parties behind shell structures.
Question 5: A forensic examiner receives a hard drive that may contain evidence of child exploitation. Before beginning analysis, what is the most critical first step?
- Run antivirus software to sanitize the drive
- Create a forensic image and verify it with a cryptographic hash (Correct answer)
- Search the drive for known file signatures using a hex editor
- Power on the drive and browse the directory structure
Correct answer: Create a forensic image and verify it with a cryptographic hash
Creating a verified forensic image preserves the original evidence in a legally defensible state and ensures that all subsequent analysis is performed on the copy.
Question 6: During a corporate espionage investigation, a forensic examiner finds evidence that a suspect printed sensitive documents. Which artifact on a Windows system is most useful for identifying recently printed documents?
- The Windows Event Log (System category)
- The print spool directory and associated shadow copy metadata (Correct answer)
- The Windows Registry key HKCU\Software\Microsoft\Office\Recent
- The browser download history
Correct answer: The print spool directory and associated shadow copy metadata
The print spool directory retains spool files and metadata for recent print jobs, and shadow copies may preserve this data even after spool files are deleted.
Question 7: An investigator is analyzing a suspect's web browser artifacts. Which browser artifact provides the strongest evidence that the suspect intentionally visited a specific URL rather than arriving there through a redirect?
- The browser's cache files for the target page
- A typed URL entry in the browser's address bar history (Correct answer)
- A cookie set by the target domain
- A reference to the URL in the browser's download history
Correct answer: A typed URL entry in the browser's address bar history
Typed URL history specifically records URLs that the user manually typed into the address bar, distinguishing intentional navigation from redirects or link clicks.
CFE Forensic Analysis and Investigation Techniques 3
A forensic examiner is asked to analyze a suspect's cloud storage account.
Which legal instrument is typically required to compel a US-based cloud provider to disclose a foreign national's data?