CSX Forensic Science & Analysis 3 — Questions and Answers
Question 1: In a forensic investigation of an Android device, which directory typically stores app-specific databases including SMS messages?
- /proc/
- /data/data/<package>/databases/ (Correct answer)
- /sys/class/
- /etc/hosts
Correct answer: /data/data/<package>/databases/
On Android, app-specific data including SQLite databases for SMS, contacts, and other content is stored under /data/data/<package_name>/databases/.
Question 2: What does the term 'anti-forensics' refer to in cybersecurity investigations?
- Techniques used to speed up forensic analysis
- Methods used to prevent or hinder forensic examination of digital evidence (Correct answer)
- Tools that automate evidence collection
- Standards for admissible digital evidence
Correct answer: Methods used to prevent or hinder forensic examination of digital evidence
Anti-forensics encompasses techniques such as data wiping, timestamp manipulation, steganography, and encryption used by attackers to destroy or obscure digital evidence.
Question 3: A forensic analyst finds that Windows Prefetch files exist on a suspect machine. What information can these files provide?
- A list of installed hardware devices
- Evidence of program execution including executable name and last run time (Correct answer)
- Network connections made by the system
- Encryption keys used by BitLocker
Correct answer: Evidence of program execution including executable name and last run time
Windows Prefetch files (.pf) record application execution history including the executable name, run count, and last execution timestamp, helping prove a program was run.
Question 4: Which hashing algorithm is currently recommended by NIST for integrity verification of digital evidence?
- MD5
- SHA-1
- SHA-256 (Correct answer)
- CRC32
Correct answer: SHA-256
NIST recommends SHA-256 (part of the SHA-2 family) for evidence integrity verification as MD5 and SHA-1 have known collision vulnerabilities.
Question 5: During a forensic investigation, an examiner finds the Windows Registry key 'HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR'. What artifact does this reveal?
- Installed software history
- USB storage devices that have been connected to the system (Correct answer)
- Recently accessed network shares
- Scheduled tasks executed on the system
Correct answer: USB storage devices that have been connected to the system
The USBSTOR registry key records information about USB storage devices that have been connected, including device type, serial number, and timestamps.
Question 6: What is the primary difference between a logical acquisition and a physical acquisition of a mobile device?
- Logical acquisition is faster and captures only file system data, while physical acquisition captures a bit-for-bit image of the full storage (Correct answer)
- Physical acquisition only captures call logs, while logical captures all data
- Logical acquisition requires rooting the device, while physical does not
- Physical acquisition is less forensically sound than logical acquisition
Correct answer: Logical acquisition is faster and captures only file system data, while physical acquisition captures a bit-for-bit image of the full storage
Logical acquisition extracts data through the OS file system layer, while physical acquisition creates a complete bit-for-bit copy of the storage chip including deleted data and unallocated space.
Question 7: A forensic investigator is analyzing a Linux system and wants to identify recently executed commands. Which file should they examine first?
- /var/log/syslog
- /etc/passwd
- ~/.bash_history (Correct answer)
- /proc/cmdline
Correct answer: ~/.bash_history
The .bash_history file in a user's home directory stores a history of commands executed in the Bash shell, making it a key artifact for command execution analysis.
CSX Forensic Science & Analysis 3
In a forensic investigation of an Android device, which directory typically stores app-specific databases including SMS messages?