ISA Digital Forensics & Investigation 2 — Questions and Answers
Question 1: Which forensic tool is widely used for creating forensic images and analyzing disk evidence?
- Nessus
- FTK (Forensic Toolkit) (Correct answer)
- Metasploit
- Wireshark
Correct answer: FTK (Forensic Toolkit)
FTK (Forensic Toolkit) by AccessData is a widely used digital forensics platform for disk imaging, file analysis, and evidence processing.
Question 2: In memory forensics, what does the term 'process injection' indicate?
- A legitimate OS process updating its configuration
- Malicious code running within the address space of another process (Correct answer)
- A forensic tool loading analysis modules into memory
- Encrypted malware stored in the page file
Correct answer: Malicious code running within the address space of another process
Process injection is a technique where malicious code is inserted into the memory space of a legitimate running process to evade detection.
Question 3: What is a 'dead box' forensic investigation?
- Forensic analysis of a powered-off or powered-down system (Correct answer)
- Investigation of a network device with no active connections
- Analysis of encrypted files with no known key
- Examination of a system after its logs have been deleted
Correct answer: Forensic analysis of a powered-off or powered-down system
Dead box forensics involves examining a system that is powered off, typically by imaging the hard drive and analyzing it offline, avoiding changes to the live system.
Question 4: Which file system artifact is most useful for reconstructing a timeline of file activity on a Windows system?
- The $MFT (Master File Table) (Correct answer)
- The Windows Registry hive files
- The pagefile.sys
- The hiberfil.sys
Correct answer: The $MFT (Master File Table)
The $MFT on NTFS file systems records metadata for every file including creation, modification, and access timestamps, making it essential for timeline reconstruction.
Question 5: What is 'file carving' in digital forensics?
- Extracting embedded files from encrypted containers
- Recovering files based on file headers and footers without file system metadata (Correct answer)
- Splitting large evidence files for easier analysis
- Digitally signing evidence files for integrity
Correct answer: Recovering files based on file headers and footers without file system metadata
File carving recovers files from raw data by identifying known file signatures (headers/footers), even when file system metadata has been deleted or corrupted.
Question 6: When analyzing Windows Event Logs for forensic purposes, which log primarily contains security-related events such as logon attempts?
- System.evtx
- Security.evtx (Correct answer)
- Application.evtx
- Setup.evtx
Correct answer: Security.evtx
The Security.evtx log records security-related events including successful and failed logon attempts, account management changes, and privilege use.
Question 7: In network forensics, which tool is best suited for capturing and analyzing full packet data?
- Splunk
- Wireshark / tcpdump (Correct answer)
- Nmap
- Snort
Correct answer: Wireshark / tcpdump
Wireshark and tcpdump are packet capture tools that record full network packet data, enabling detailed analysis of network communications during an investigation.
