CFE Forensic Analysis and Investigation Techniques 1 — Questions and Answers
Question 1: Which type of analysis is used to examine deleted files on a hard drive?
- Registry analysis
- Timeline analysis
- File carving (Correct answer)
- Volatile memory capture
Correct answer: File carving
File carving is a forensic technique used to recover deleted or fragmented files from raw disk images. It works by searching for known file headers and footers (signatures) to reconstruct files, even when file system metadata has been lost or overwritten. This method is crucial for recovering data that has been intentionally or accidentally deleted.
Question 2: What does a hash value indicate in forensic analysis?
- The file location on disk
- The file size in bytes
- The last modified date
- The file's unique digital fingerprint (Correct answer)
Correct answer: The file's unique digital fingerprint
A hash value is a fixed-size alphanumeric string generated by a mathematical algorithm from a file's content. It acts as a unique digital fingerprint, meaning any change to the file, even a single bit, will result in a completely different hash value. This property is crucial in forensics for verifying data integrity and identifying known files.
Question 3: Which tool is commonly used to analyze Windows registry artifacts?
- FTK Imager
- Registry Viewer (Correct answer)
- Wireshark
- Autopsy
Correct answer: Registry Viewer
Registry Viewer is a specialized tool designed to parse and display the contents of the Windows Registry, which stores configuration settings and system information. It allows forensic examiners to analyze various artifacts like user activity, installed software, and connected devices by navigating through the registry's hierarchical structure. Other options like FTK Imager are for disk imaging, Wireshark for network analysis, and Autopsy is a broader forensic suite.
Question 4: What type of evidence is volatile and must be collected immediately?
- System logs
- Browser history
- RAM contents (Correct answer)
- Hard disk images
Correct answer: RAM contents
RAM (Random Access Memory) contents are considered volatile evidence because the data stored within them is lost once the power is removed from the system. Therefore, it must be collected immediately using specialized tools before the system is shut down or rebooted. This data can contain crucial information like running processes, open files, and decrypted data that would otherwise be lost.
Question 5: What does a timeline analysis help investigators determine?
- Password strength
- Encryption method used
- Sequence of system events (Correct answer)
- Network traffic direction
Correct answer: Sequence of system events
Timeline analysis involves compiling and correlating various timestamps from different sources (e.g., file system metadata, log files, registry entries) into a chronological sequence. This helps investigators reconstruct the order of events that occurred on a system, providing a clear picture of user activities, system changes, and potential malicious actions over time. It's essential for understanding the 'when' of an incident.
Question 6: Which artifact is best for identifying external devices connected to a system?
- Pagefile.sys
- USN Journal
- USBSTOR registry key (Correct answer)
- Recycle Bin
Correct answer: USBSTOR registry key
The USBSTOR registry key, located within the Windows Registry, specifically records information about USB mass storage devices that have been connected to a system. Analyzing this key allows forensic examiners to identify details such as the vendor ID, product ID, serial number, and the last time a specific USB device was connected. This makes it invaluable for tracking external device usage and potential data exfiltration.
CFE Forensic Analysis and Investigation Techniques 1
Which type of analysis is used to examine deleted files on a hard drive?