CSI Cybersecurity & Digital Evidence Handling 3 — Questions and Answers
Question 1: During a corporate data breach investigation, investigators identify exfiltration via DNS tunneling. What characteristic best identifies DNS tunneling activity in log analysis?
- Unusually large number of HTTPS GET requests to known CDNs
- Abnormally long or high-frequency DNS queries to a single external domain (Correct answer)
- Multiple failed authentication attempts on the VPN gateway
- Large ICMP packet sizes from internal workstations
Correct answer: Abnormally long or high-frequency DNS queries to a single external domain
DNS tunneling encodes data inside DNS queries, resulting in unusually long subdomains or an abnormally high volume of queries to one domain.
Question 2: Which chain of custody principle ensures that digital evidence collected at a scene can be traced from collection through court presentation?
- Non-repudiation
- Continuity of evidence documentation (Correct answer)
- Data minimization
- Separation of duties
Correct answer: Continuity of evidence documentation
Continuity of evidence documentation (chain of custody) records every person who handled evidence and all transfers, ensuring traceability.
Question 3: A forensic image of a suspect hard drive differs in hash value from the original drive after acquisition. What does this MOST likely indicate?
- The forensic software used lossless compression
- The evidence may have been altered or the acquisition process was flawed (Correct answer)
- The drive uses a proprietary file system
- The investigator used SHA-256 instead of MD5
Correct answer: The evidence may have been altered or the acquisition process was flawed
A hash mismatch means the image does not exactly match the source, indicating possible evidence tampering or an acquisition error.
Question 4: In cybersecurity investigations, what does the term 'persistence mechanism' refer to?
- The time frame an investigator has to collect volatile data before it is lost
- A technique malware uses to survive system reboots and remain active (Correct answer)
- The legal obligation to preserve evidence for a set retention period
- Network packet retransmission after connection failure
Correct answer: A technique malware uses to survive system reboots and remain active
Persistence mechanisms (registry run keys, scheduled tasks, services) allow malicious code to re-execute after reboots.
Question 5: Which volatile data source should a CSI investigator capture FIRST on a live Windows system before powering it down?
- Recycle Bin contents
- Running processes and active network connections (Correct answer)
- Installed software registry keys
- Browser bookmarks
Correct answer: Running processes and active network connections
Running processes and network connections exist only in RAM and disappear when the system is shut down, making them the highest-priority volatile artifact.
Question 6: A suspect deleted files and then used a disk-wiping tool on a Windows NTFS volume. Which forensic artifact might still reveal what files existed before deletion?
- The Windows registry CurrentControlSet
- The $MFT (Master File Table) and $LogFile journal remnants (Correct answer)
- Event log entries in Security.evtx
- The pagefile.sys swap file
Correct answer: The $MFT (Master File Table) and $LogFile journal remnants
Even after wiping, MFT entry remnants and journal records can reveal file names, metadata, and timestamps of previously existing files.
Question 7: What is the legal significance of the 'plain view doctrine' in a digital forensic investigation?
- Investigators may read any file visible on the desktop screenshot
- Evidence discovered incidentally while conducting a lawful search may be seized without an additional warrant (Correct answer)
- All files on a seized device are automatically subject to review
- Digital evidence does not require a warrant if it is unencrypted
Correct answer: Evidence discovered incidentally while conducting a lawful search may be seized without an additional warrant
The plain view doctrine allows investigators to seize evidence found in plain view during a lawful search without needing a separate warrant.
CSI Cybersecurity & Digital Evidence Handling 3
During a corporate data breach investigation, investigators identify exfiltration via DNS tunneling.
What characteristic best identifies DNS tunneling activity in log analysis?