CFE Virtual Facilitation & Technology 2 — Questions and Answers
Question 1: A forensic examiner is tasked with recovering deleted messages from a cloud-based collaboration platform like Microsoft Teams. Which artifact location is most likely to contain recoverable message data on a Windows endpoint?
- Windows Registry HKCU hive
- IndexedDB files in the application's local cache directory (Correct answer)
- Prefetch files in C:\Windows\Prefetch
- Browser cookies stored in AppData\Roaming
Correct answer: IndexedDB files in the application's local cache directory
Microsoft Teams stores message data locally in IndexedDB files within the app's local cache, making it a primary recovery target.
Question 2: When conducting a forensic investigation of a Zoom meeting recording stored in the cloud, which chain of custody step is most critical before downloading the file?
- Immediately rename the file to reflect the case number
- Capture a cryptographic hash of the file before downloading (Correct answer)
- Compress the file to reduce storage requirements
- Notify all meeting participants before accessing the recording
Correct answer: Capture a cryptographic hash of the file before downloading
Capturing a hash before download establishes the original file's integrity and protects against claims of tampering.
Question 3: A suspect allegedly exfiltrated confidential data via a virtual private network (VPN). What is the MOST reliable forensic artifact on the suspect's machine to confirm VPN usage?
- Browser history showing VPN provider website visits
- VPN connection logs and configuration files stored locally (Correct answer)
- RAM dump showing the VPN application was running
- Email records discussing VPN setup
Correct answer: VPN connection logs and configuration files stored locally
VPN configuration files and connection logs provide direct evidence of VPN use, including connection timestamps and server endpoints.
Question 4: During a virtual fraud investigation, an examiner needs to establish the timeline of a suspect's online activity. Which artifact provides the MOST precise timestamping across different time zones?
- File system MAC timestamps in local time
- Server-side logs with UTC timestamps (Correct answer)
- Screenshot metadata embedded by the operating system
- Email headers using the sender's local time zone
Correct answer: Server-side logs with UTC timestamps
Server-side logs use UTC timestamps, eliminating time zone ambiguity and providing a consistent, authoritative timeline.
Question 5: An investigator analyzing a video-conferencing tool on a corporate laptop discovers ephemeral (end-to-end encrypted) chat messages that were deleted. Which approach offers the BEST chance of recovery?
- Request plaintext logs from the vendor's servers
- Acquire a forensic image of the device and analyze unallocated space (Correct answer)
- Subpoena the other participants' devices
- Analyze DNS query logs from the corporate firewall
Correct answer: Acquire a forensic image of the device and analyze unallocated space
Deleted data may persist in unallocated disk space; a forensic image allows file carving and recovery before overwriting occurs.
Question 6: Which metadata field in a Zoom cloud recording is most useful for proving a specific participant was actively speaking at a given moment?
- Participant display name field
- Active speaker timeline embedded in the recording metadata (Correct answer)
- Meeting ID field
- Host email address field
Correct answer: Active speaker timeline embedded in the recording metadata
Zoom's active speaker timeline metadata logs which participant was speaking at each timestamp, providing strong attribution evidence.
Question 7: A forensic examiner is analyzing Slack workspace data exported by a corporate administrator. Which limitation must be disclosed when presenting this evidence?
- Slack exports do not include file attachments
- Administrator-exported data may exclude direct messages in free workspaces (Correct answer)
- Slack timestamps cannot be converted to UTC
- Exported JSON files are always corrupted during transit
Correct answer: Administrator-exported data may exclude direct messages in free workspaces
Slack's free-tier export does not include direct messages, meaning key communications may be absent from the evidence set.
CFE Virtual Facilitation & Technology 2
A forensic examiner is tasked with recovering deleted messages from a cloud-based collaboration platform like Microsoft Teams.
Which artifact location is most likely to contain recoverable message data on a Windows endpoint?