EnCE File Systems & Artifact Examination — Questions and Answers
Question 1: What is the role of a file system in digital storage?
- Plays music
- Boosts Wi-Fi
- Manages and organizes files (Correct answer)
- Increases RAM
Correct answer: Manages and organizes files
A file system is a method and data structure that an operating system uses to control how data is stored and retrieved on a storage device. It organizes files and directories, tracks their locations, manages access permissions, and ensures efficient storage and retrieval of information, making it fundamental to digital storage.
Question 2: Which file systems are commonly examined in forensic cases?
- PNG, JPEG
- HTML, CSS
- NTFS, FAT32, exFAT (Correct answer)
- AI, PSD
Correct answer: NTFS, FAT32, exFAT
NTFS, FAT32, and exFAT are common file systems encountered in digital forensic investigations because they are widely used across various operating systems and storage devices. NTFS is prevalent in Windows, FAT32 is common on older systems and removable media, and exFAT is often used for larger removable storage, each requiring specific forensic analysis techniques.
Question 3: What are file system artifacts?
- Wallpapers
- Music files
- Metadata and system records (Correct answer)
- Game folders
Correct answer: Metadata and system records
File system artifacts are remnants or records left behind by operating system activities and user actions on a storage device. These include crucial metadata, such as file creation/modification times, sizes, and permissions, as well as various system records like journal files and registry entries. They are invaluable in forensic investigations, providing contextual information about system usage and user behavior.
Question 4: What does the Master File Table (MFT) store?
- Web history
- Wi-Fi passwords
- File metadata in NTFS (Correct answer)
- Battery logs
Correct answer: File metadata in NTFS
The Master File Table (MFT) is a fundamental component of the NTFS file system, primarily used by Windows operating systems. It functions as a comprehensive database that stores critical metadata for every file and directory on the volume. This metadata encompasses essential details like file names, sizes, timestamps, security attributes, and the physical location of the file's data on the disk.
Question 5: What is slack space in a file system?
- Password field
- Compressed folder
- Unallocated leftover data (Correct answer)
- Search bar
Correct answer: Unallocated leftover data
Slack space refers to the unused portion of a disk cluster that remains after a file has been written to it. Since files rarely perfectly fill an entire cluster, the leftover space is termed 'slack.' This area can contain residual data from previously stored files or system processes, making it a significant source of potential forensic evidence for investigators.
Question 6: How are deleted files identified in EnCase?
- Color coding
- Search engine
- Unallocated space analysis (Correct answer)
- Audio alert
Correct answer: Unallocated space analysis
When a file is 'deleted' from a file system, its data is not immediately erased; instead, the operating system simply marks the space it occupied as 'unallocated' and available for new data. EnCase identifies these deleted files by meticulously analyzing this unallocated space. It searches for file signatures and remnants that indicate previously existing data, allowing investigators to recover or reconstruct files before they are overwritten.
Question 7: What is a Volume Shadow Copy?
- Screen brightness setting
- Cloud backup
- System snapshot backup (Correct answer)
- Antivirus
Correct answer: System snapshot backup
A Volume Shadow Copy (VSC) is a Microsoft Windows technology that creates snapshots of files or entire volumes, even while they are actively in use. These snapshots capture the state of the file system at a specific point in time, enabling users to recover previous versions of files or restore system states. In digital forensics, VSCs are invaluable for accessing historical data, including deleted files, and understanding past system configurations.
Question 8: Which artifact reveals recent USB activity?
- Screensavers
- Antivirus logs
- Registry entries (Correct answer)
- Screenshots
Correct answer: Registry entries
When a USB device is connected to a Windows computer, the operating system automatically creates and updates specific entries within the Windows Registry. These registry keys store vital information such as the device's vendor and product IDs, serial number, connection timestamps, and the user account that initiated the connection. Analyzing these registry entries is a primary method for forensic examiners to determine if and when a particular USB device was connected to a system.
Question 9: How can time stamps be manipulated?
- Increase brightness
- Log out of accounts
- Use timestamp editing tools (Correct answer)
- Delete wallpaper
Correct answer: Use timestamp editing tools
Timestamps, which record file creation, modification, and access times, are critical metadata in digital forensics. These values can be deliberately altered using specialized timestamp editing tools, potentially to obscure malicious activity or create a misleading timeline. Forensic examiners must be aware of this possibility and employ techniques to detect such manipulation, as it can significantly impact an investigation.
EnCE File Systems & Artifact Examination
What is the role of a file system in digital storage?