CHFI Anti-Forensics Techniques 2

Question 1

Which US Department of Defense standard specifies a data sanitization method using multiple overwrite passes with specific data patterns?

Accepted Answer

DoD 5220.22-M

Answer

ISO 27001

Answer

NIST SP 800-88

Answer

PCI DSS

Question 2

What is the forensic significance of 'slack space' that makes it relevant to anti-forensics investigations?

Accepted Answer

It is the unused space between the end of a file and the end of its allocated cluster that may contain remnant data

Answer

It stores encrypted data that cannot be accessed without a key

Answer

It is a dedicated area for storing deleted files before final purge

Answer

It refers to RAM not used by running processes

Question 3

Which anti-forensics technique involves modifying or deleting system log files to erase evidence of an attacker's activities?

Accepted Answer

Log tampering (log sanitization)

Answer

Data carving

Answer

Timestomping

Answer

Steganography

Question 4

What is a rootkit in the context of anti-forensics?

Accepted Answer

Malware that hides its presence and other malicious activity from the OS and forensic tools

Answer

A tool for recovering deleted files from damaged media

Answer

A network packet analyzer used for traffic interception

Answer

A password cracking utility targeting system accounts

Question 5

Which open-source full disk encryption tool is considered a major challenge for digital forensic investigators due to its strong encryption?

Accepted Answer

VeraCrypt

Answer

MD5sum

Answer

SHA-256

Answer

Wireshark

Question 6

Which anti-forensics technique involves an attacker deliberately planting false digital evidence to mislead forensic investigators?

Accepted Answer

Evidence fabrication (anti-forensic deception)

Answer

Secure deletion

Answer

Log rotation

Answer

Data carving

Question 7

Which Windows artifact records information about recently executed programs including execution count and last run time, even after the program is deleted?

Accepted Answer

Prefetch files

Answer

Recycle Bin metadata

Answer

Desktop shortcut .lnk files

Answer

Start menu entries