ISA Digital Forensics & Investigation 2

Question 1

Which forensic tool is widely used for creating forensic images and analyzing disk evidence?

Accepted Answer

FTK (Forensic Toolkit)

Answer

Nessus

Answer

Metasploit

Answer

Wireshark

Question 2

In memory forensics, what does the term 'process injection' indicate?

Accepted Answer

Malicious code running within the address space of another process

Answer

A legitimate OS process updating its configuration

Answer

A forensic tool loading analysis modules into memory

Answer

Encrypted malware stored in the page file

Question 3

What is a 'dead box' forensic investigation?

Accepted Answer

Forensic analysis of a powered-off or powered-down system

Answer

Investigation of a network device with no active connections

Answer

Analysis of encrypted files with no known key

Answer

Examination of a system after its logs have been deleted

Question 4

Which file system artifact is most useful for reconstructing a timeline of file activity on a Windows system?

Accepted Answer

The $MFT (Master File Table)

Answer

The Windows Registry hive files

Answer

The pagefile.sys

Answer

The hiberfil.sys

Question 5

What is 'file carving' in digital forensics?

Accepted Answer

Recovering files based on file headers and footers without file system metadata

Answer

Extracting embedded files from encrypted containers

Answer

Splitting large evidence files for easier analysis

Answer

Digitally signing evidence files for integrity

Question 6

When analyzing Windows Event Logs for forensic purposes, which log primarily contains security-related events such as logon attempts?

Accepted Answer

Security.evtx

Answer

System.evtx

Answer

Application.evtx

Answer

Setup.evtx

Question 7

In network forensics, which tool is best suited for capturing and analyzing full packet data?

Accepted Answer

Wireshark / tcpdump

Answer

Splunk

Answer

Nmap

Answer

Snort