CSX Forensic Science & Analysis 2 — Questions and Answers
Question 1: Which file system artifact records the last time a file was accessed on an NTFS volume?
- $MFT entry timestamps (Correct answer)
- $LogFile journal
- $Bitmap allocation
- $Secure descriptor
Correct answer: $MFT entry timestamps
The $MFT (Master File Table) entry for each file stores MACB timestamps including the last access time on NTFS volumes.
Question 2: A forensic examiner discovers a file with a .jpg extension but the hex header reads '50 4B 03 04'. What does this indicate?
- The file is corrupted beyond recovery
- The file is actually a ZIP archive with a renamed extension (Correct answer)
- The file uses a proprietary JPEG variant
- The file was encrypted with AES-256
Correct answer: The file is actually a ZIP archive with a renamed extension
The magic bytes '50 4B 03 04' are the ZIP file signature, indicating the file is a ZIP archive regardless of its .jpg extension.
Question 3: During network forensics, which protocol would you analyze to reconstruct web browsing sessions from a packet capture?
- SMTP
- DNS
- HTTP/HTTPS (Correct answer)
- ICMP
Correct answer: HTTP/HTTPS
HTTP and HTTPS traffic carries web browsing sessions, including request/response headers and body content used to reconstruct user activity.
Question 4: What is the purpose of Autopsy in digital forensics?
- It is a hardware write blocker
- It is an open-source digital forensics platform for analyzing disk images (Correct answer)
- It generates cryptographic hashes for evidence
- It is a network packet analyzer
Correct answer: It is an open-source digital forensics platform for analyzing disk images
Autopsy is an open-source digital forensics platform built on The Sleuth Kit that allows investigators to analyze disk images and extract artifacts.
Question 5: An investigator is analyzing Windows Event Logs and finds Event ID 4625. What does this indicate?
- A user account was created
- A failed logon attempt occurred (Correct answer)
- A service was stopped
- A file was deleted
Correct answer: A failed logon attempt occurred
Windows Event ID 4625 logs a failed account logon attempt, including the account name, failure reason, and source network address.
Question 6: What is 'slack space' in digital forensics?
- Unallocated space between partitions
- The unused space between the end of a file and the end of its last allocated cluster (Correct answer)
- Space reserved by the OS for paging
- The gap between MBR and the first partition
Correct answer: The unused space between the end of a file and the end of its last allocated cluster
Slack space is the unused area between a file's logical end and the end of its last allocated cluster, which may contain remnants of previously stored data.
Question 7: Which tool is commonly used to perform memory forensics on a Windows RAM dump?
- Wireshark
- Volatility (Correct answer)
- FTK Imager
- Nmap
Correct answer: Volatility
Volatility is an open-source memory forensics framework used to extract artifacts from RAM dumps, including running processes, network connections, and injected code.
CSX Forensic Science & Analysis 2
Which file system artifact records the last time a file was accessed on an NTFS volume?