CSX Forensic Science & Analysis 3

Question 1

In a forensic investigation of an Android device, which directory typically stores app-specific databases including SMS messages?

Accepted Answer

/data/data/<package>/databases/

Answer

On Android, app-specific data including SQLite databases for SMS, contacts, and other content is stored under /data/data/<package_name>/databases/.

Question 2

What does the term 'anti-forensics' refer to in cybersecurity investigations?

Accepted Answer

Methods used to prevent or hinder forensic examination of digital evidence

Answer

Anti-forensics encompasses techniques such as data wiping, timestamp manipulation, steganography, and encryption used by attackers to destroy or obscure digital evidence.

Question 3

A forensic analyst finds that Windows Prefetch files exist on a suspect machine. What information can these files provide?

Accepted Answer

Evidence of program execution including executable name and last run time

Answer

Windows Prefetch files (.pf) record application execution history including the executable name, run count, and last execution timestamp, helping prove a program was run.

Question 4

Which hashing algorithm is currently recommended by NIST for integrity verification of digital evidence?

Accepted Answer

SHA-256

Answer

NIST recommends SHA-256 (part of the SHA-2 family) for evidence integrity verification as MD5 and SHA-1 have known collision vulnerabilities.

Question 5

During a forensic investigation, an examiner finds the Windows Registry key 'HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR'. What artifact does this reveal?

Accepted Answer

USB storage devices that have been connected to the system

Answer

The USBSTOR registry key records information about USB storage devices that have been connected, including device type, serial number, and timestamps.

(CSX) Cybersecurity Nexus Certification Practice Test

(CSX) Cybersecurity Nexus Certification Practice Test

CSX Forensic Science & Analysis 3