CSX Forensic Science & Analysis 2

Question 1

Which file system artifact records the last time a file was accessed on an NTFS volume?

Accepted Answer

$MFT entry timestamps

Answer

The $MFT (Master File Table) entry for each file stores MACB timestamps including the last access time on NTFS volumes.

Question 2

A forensic examiner discovers a file with a .jpg extension but the hex header reads '50 4B 03 04'. What does this indicate?

Accepted Answer

The file is actually a ZIP archive with a renamed extension

Answer

The magic bytes '50 4B 03 04' are the ZIP file signature, indicating the file is a ZIP archive regardless of its .jpg extension.

Question 3

During network forensics, which protocol would you analyze to reconstruct web browsing sessions from a packet capture?

Accepted Answer

HTTP/HTTPS

Answer

HTTP and HTTPS traffic carries web browsing sessions, including request/response headers and body content used to reconstruct user activity.

Question 4

What is the purpose of Autopsy in digital forensics?

Accepted Answer

It is an open-source digital forensics platform for analyzing disk images

Answer

Autopsy is an open-source digital forensics platform built on The Sleuth Kit that allows investigators to analyze disk images and extract artifacts.

Question 5

An investigator is analyzing Windows Event Logs and finds Event ID 4625. What does this indicate?

Accepted Answer

A failed logon attempt occurred

Answer

Windows Event ID 4625 logs a failed account logon attempt, including the account name, failure reason, and source network address.

(CSX) Cybersecurity Nexus Certification Practice Test