ISA Digital Forensics & Investigation 2

Question 1

Which forensic tool is widely used for creating forensic images and analyzing disk evidence?

Accepted Answer

FTK (Forensic Toolkit)

Answer

FTK (Forensic Toolkit) by AccessData is a widely used digital forensics platform for disk imaging, file analysis, and evidence processing.

Question 2

In memory forensics, what does the term 'process injection' indicate?

Accepted Answer

Malicious code running within the address space of another process

Answer

Process injection is a technique where malicious code is inserted into the memory space of a legitimate running process to evade detection.

Question 3

What is a 'dead box' forensic investigation?

Accepted Answer

Forensic analysis of a powered-off or powered-down system

Answer

Dead box forensics involves examining a system that is powered off, typically by imaging the hard drive and analyzing it offline, avoiding changes to the live system.

Question 4

Which file system artifact is most useful for reconstructing a timeline of file activity on a Windows system?

Accepted Answer

The $MFT (Master File Table)

Answer

The $MFT on NTFS file systems records metadata for every file including creation, modification, and access timestamps, making it essential for timeline reconstruction.

Question 5

What is 'file carving' in digital forensics?

Accepted Answer

Recovering files based on file headers and footers without file system metadata

Answer

File carving recovers files from raw data by identifying known file signatures (headers/footers), even when file system metadata has been deleted or corrupted.

ISA - Information Security Analyst Certification Practice Test

ISA - Information Security Analyst Certification Practice Test

ISA Digital Forensics & Investigation 2