CFS Digital Forensics & Cyber Fraud 2 — Questions and Answers
Question 1: Which file system artifact is MOST valuable for establishing a timeline of when files were created, accessed, or modified on a Windows NTFS volume?
- Prefetch files
- $MFT (Master File Table) (Correct answer)
- Registry hives
- Event logs
Correct answer: $MFT (Master File Table)
The $MFT stores metadata for every file on an NTFS volume including MAC (Modified, Accessed, Created) timestamps, making it essential for timeline analysis.
Question 2: A fraudster uses a cryptocurrency tumbler (mixer) to launder proceeds. What is the PRIMARY purpose of this technique?
- To convert cryptocurrency to fiat currency without taxes
- To obfuscate the transaction trail by mixing funds from multiple sources (Correct answer)
- To increase the value of the cryptocurrency holdings
- To avoid cryptocurrency exchange KYC requirements
Correct answer: To obfuscate the transaction trail by mixing funds from multiple sources
Cryptocurrency tumblers break the transaction chain by pooling coins from many users and redistributing different coins, making blockchain tracing significantly harder.
Question 3: During a phishing investigation, you identify a spoofed email domain 'paypa1.com' used instead of 'paypal.com'. This technique is called:
- DNS poisoning
- Typosquatting (Correct answer)
- Man-in-the-middle attack
- Domain hijacking
Correct answer: Typosquatting
Typosquatting (also called URL hijacking) involves registering domains that are common misspellings or visual substitutions of legitimate brand names to deceive users.
Question 4: When conducting forensic analysis of cloud-based storage (e.g., Google Drive, OneDrive), which challenge is UNIQUE compared to local storage forensics?
- Files cannot be recovered once deleted
- Evidence may be stored across multiple jurisdictions with varying legal requirements (Correct answer)
- Cloud metadata is never available to investigators
- Encryption always prevents access to cloud files
Correct answer: Evidence may be stored across multiple jurisdictions with varying legal requirements
Cloud data often resides on servers in multiple countries simultaneously, creating complex legal jurisdiction issues requiring proper legal process in each relevant country.
Question 5: A business email compromise (BEC) scheme typically involves which initial step before executing a fraudulent wire transfer?
- Installing ransomware on the target's servers
- Gaining unauthorized access to or spoofing a trusted executive's email account (Correct answer)
- Conducting a DDoS attack to distract IT personnel
- Deploying keyloggers on accounting department workstations
Correct answer: Gaining unauthorized access to or spoofing a trusted executive's email account
BEC schemes typically begin with compromising or impersonating a high-level executive's email to issue fraudulent payment instructions that appear legitimate to employees.
Question 6: Which of the following BEST describes 'steganography' in the context of cyber fraud?
- Encrypting financial records with a symmetric key algorithm
- Hiding data within ordinary files (images, audio) to conceal fraudulent communications (Correct answer)
- Using anonymizing proxy networks to hide IP addresses
- Creating fake digital signatures on fraudulent documents
Correct answer: Hiding data within ordinary files (images, audio) to conceal fraudulent communications
Steganography conceals the existence of a message by embedding it within an innocuous carrier file like an image, making it invisible to casual inspection.
Question 7: When a suspect's hard drive is seized, the FIRST action a digital forensics examiner should take is:
- Power on the system to check running processes
- Create a forensic bit-for-bit image of the drive before any analysis (Correct answer)
- Search the drive for documents containing financial data
- Install forensic software directly onto the suspect drive
Correct answer: Create a forensic bit-for-bit image of the drive before any analysis
Creating a verified forensic image preserves the original evidence in its exact state, allowing all analysis to be performed on copies without risking alteration of the original.
CFS Digital Forensics & Cyber Fraud 2
Which file system artifact is MOST valuable for establishing a timeline of when files were created, accessed, or modified on a Windows NTFS volume?