Forensic Science & Analysis Flashcards

A forensic examiner needs to analyze a RAID 5 array where one disk has failed. What is the minimum number of remaining disks needed to reconstruct the data?

Answer: All disks minus one (n-1)

RAID 5 can tolerate the failure of one disk because parity data is distributed across all disks, allowing data reconstruction from the remaining n-1 disks.

Which technique allows an attacker to hide malicious code inside a legitimate Windows process, making forensic detection more difficult?

Answer: Process hollowing

Process hollowing involves creating a legitimate process in a suspended state, replacing its memory with malicious code, then resuming execution, making the malware appear as a trusted process.

What is the role of a write blocker in digital forensics?

Answer: It prevents any write operations to the evidence media during acquisition

A write blocker is a hardware or software device that allows read access to storage media while preventing any writes, ensuring the original evidence is not modified during acquisition.

In cloud forensics, what is a significant challenge compared to traditional on-premises forensics?

Answer: Evidence may be distributed across multiple jurisdictions and controlled by a third party

Cloud forensics is complicated by data being distributed across servers in multiple geographic jurisdictions and controlled by cloud service providers, creating legal and technical access challenges.

What does analyzing the $I30 index attribute in NTFS reveal to a forensic investigator?

Answer: Directory contents including potentially deleted file entries

The $I30 index attribute stores directory index entries, and when files are deleted, their entries may persist in the slack space of this attribute, revealing previously deleted filenames.

During incident response, an analyst captures network traffic and identifies C2 communication using DNS tunneling. What is the key indicator of this technique?

Answer: Abnormally long DNS query strings or high frequency of DNS TXT record requests

DNS tunneling encodes data within DNS queries and responses, characterized by abnormally long subdomains, frequent TXT record queries, and high DNS query volume to a single domain.

What is the forensic significance of the Windows 'LNK' shortcut file format?

Answer: LNK files contain metadata about the target file including MAC timestamps and volume serial number, even if the target has been deleted

Windows LNK shortcut files preserve metadata about the target file including creation/modification timestamps, file size, and volume information that can remain even after the target is deleted.