CSX Evidence Collection & Preservation 3 — Questions and Answers
Question 1: In network forensics, which data source provides the most comprehensive record of packet-level communications?
- Firewall logs
- Full packet capture (PCAP) files (Correct answer)
- NetFlow records
- DNS query logs
Correct answer: Full packet capture (PCAP) files
Full packet capture files contain the complete contents of every network packet, providing the most detailed record of network communications.
Question 2: An investigator discovers that a suspect deleted files before the system was seized. Where should the investigator look to potentially recover these files?
- The system registry
- Unallocated disk space (Correct answer)
- The pagefile only
- Active directory logs
Correct answer: Unallocated disk space
Deleted files are often recoverable from unallocated disk space until that space is overwritten with new data.
Question 3: Which standard defines the Open Forensics format commonly used for storing forensic disk images?
- ISO/IEC 27037
- AFF4 (Correct answer)
- RFC 3227
- NIST SP 800-86
Correct answer: AFF4
AFF4 (Advanced Forensic Format 4) is a widely used open forensic container format for storing disk images and associated metadata.
Question 4: What is the significance of 'slack space' in a digital forensics investigation?
- It indicates free space available for new files
- It may contain remnants of previously stored data (Correct answer)
- It represents encrypted data sectors
- It is used to store file system metadata
Correct answer: It may contain remnants of previously stored data
Slack space is the unused area between the end of a file and the end of its last allocated cluster, which may contain fragments of previously deleted data.
Question 5: A CISO needs to ensure that cloud-stored evidence is legally admissible. Which document should be obtained from the cloud provider?
- Service Level Agreement (SLA)
- Data processing addendum
- Chain of custody affidavit (Correct answer)
- Terms of Service agreement
Correct answer: Chain of custody affidavit
A chain of custody affidavit from the cloud provider documents who had access to the data, supporting its admissibility in court.
Question 6: During triage, an analyst finds a suspicious USB device connected to a compromised workstation. What is the BEST immediate action?
- Remove and dispose of the USB device
- Image the USB device before removing it (Correct answer)
- Plug the USB into a clean system to examine it
- Delete suspicious files from the USB device
Correct answer: Image the USB device before removing it
The USB should be forensically imaged before removal to preserve any evidence it may contain without altering the original.
Question 7: Which RFC provides guidance on evidence collection and archiving for network-based incidents?
- RFC 2350
- RFC 3227 (Correct answer)
- RFC 4949
- RFC 5070
Correct answer: RFC 3227
RFC 3227 (Guidelines for Evidence Collection and Archiving) provides best practices for collecting and preserving digital evidence from networks.
CSX Evidence Collection & Preservation 3
In network forensics, which data source provides the most comprehensive record of packet-level communications?