CFE Forensic Analysis and Investigation Techniques

Question 1

Which type of analysis is used to examine deleted files on a hard drive?

Accepted Answer

File carving

Answer

Registry analysis

Answer

Timeline analysis

Answer

Volatile memory capture

Question 2

What does a hash value indicate in forensic analysis?

Accepted Answer

The file's unique digital fingerprint

Answer

The file location on disk

Answer

The file size in bytes

Answer

The last modified date

Question 3

Which tool is commonly used to analyze Windows registry artifacts?

Accepted Answer

Registry Viewer

Answer

FTK Imager

Answer

Wireshark

Answer

Autopsy

Question 4

What type of evidence is volatile and must be collected immediately?

Accepted Answer

RAM contents

Answer

System logs

Answer

Browser history

Answer

Hard disk images

Question 5

What does a timeline analysis help investigators determine?

Accepted Answer

Sequence of system events

Answer

Password strength

Answer

Encryption method used

Answer

Network traffic direction

Question 6

Which artifact is best for identifying external devices connected to a system?

Accepted Answer

USBSTOR registry key

Answer

Pagefile.sys

Answer

USN Journal

Answer

Recycle Bin