CHFI Anti-Forensics Techniques 2

Question 1

Which US Department of Defense standard specifies a data sanitization method using multiple overwrite passes with specific data patterns?

Accepted Answer

DoD 5220.22-M

Answer

The DoD 5220.22-M standard specifies a data sanitization method with multiple overwrite passes using defined patterns, widely implemented in secure wiping tools.

Question 2

What is the forensic significance of 'slack space' that makes it relevant to anti-forensics investigations?

Accepted Answer

It is the unused space between the end of a file and the end of its allocated cluster that may contain remnant data

Answer

Slack space is the unused portion between the end of a file and the end of its allocated storage cluster, which may retain remnant data from previously stored files.

Question 3

Which anti-forensics technique involves modifying or deleting system log files to erase evidence of an attacker's activities?

Accepted Answer

Log tampering (log sanitization)

Answer

Log tampering involves modifying or deleting system, application, or security log files to erase records of an attacker's actions and prevent forensic reconstruction of events.

Question 4

What is a rootkit in the context of anti-forensics?

Accepted Answer

Malware that hides its presence and other malicious activity from the OS and forensic tools

Answer

A rootkit is malicious software designed to hide its own presence and the presence of other malware from the operating system, security software, and forensic investigation tools.

Question 5

Which open-source full disk encryption tool is considered a major challenge for digital forensic investigators due to its strong encryption?

Accepted Answer

VeraCrypt

Answer

VeraCrypt provides strong full-disk or volume encryption that makes encrypted data completely inaccessible without the correct passphrase or key, presenting a significant obstacle to forensic access.

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI Anti-Forensics Techniques 2