CFE Forensic Analysis and Investigation Techniques

Question 1

Which type of analysis is used to examine deleted files on a hard drive?

Accepted Answer

File carving

Answer

File carving is a forensic technique used to recover deleted or fragmented files from raw disk images. It works by searching for known file headers and footers (signatures) to reconstruct files, even when file system metadata has been lost or overwritten. This method is crucial for recovering data that has been intentionally or accidentally deleted.

Question 2

What does a hash value indicate in forensic analysis?

Accepted Answer

The file's unique digital fingerprint

Answer

A hash value is a fixed-size alphanumeric string generated by a mathematical algorithm from a file's content. It acts as a unique digital fingerprint, meaning any change to the file, even a single bit, will result in a completely different hash value. This property is crucial in forensics for verifying data integrity and identifying known files.

Question 3

Which tool is commonly used to analyze Windows registry artifacts?

Accepted Answer

Registry Viewer

Answer

Registry Viewer is a specialized tool designed to parse and display the contents of the Windows Registry, which stores configuration settings and system information. It allows forensic examiners to analyze various artifacts like user activity, installed software, and connected devices by navigating through the registry's hierarchical structure. Other options like FTK Imager are for disk imaging, Wireshark for network analysis, and Autopsy is a broader forensic suite.

Question 4

What type of evidence is volatile and must be collected immediately?

Accepted Answer

RAM contents

Answer

RAM (Random Access Memory) contents are considered volatile evidence because the data stored within them is lost once the power is removed from the system. Therefore, it must be collected immediately using specialized tools before the system is shut down or rebooted. This data can contain crucial information like running processes, open files, and decrypted data that would otherwise be lost.

Question 5

What does a timeline analysis help investigators determine?

Accepted Answer

Sequence of system events

Answer

Timeline analysis involves compiling and correlating various timestamps from different sources (e.g., file system metadata, log files, registry entries) into a chronological sequence. This helps investigators reconstruct the order of events that occurred on a system, providing a clear picture of user activities, system changes, and potential malicious actions over time. It's essential for understanding the 'when' of an incident.

(CFE) Certified Forensic Examiner Practice Test

(CFE) Certified Forensic Examiner Practice Test

CFE Forensic Analysis and Investigation Techniques