ISA Digital Forensics & Investigation 3

Question 1

What is the primary legal standard for digital evidence to be admissible in a US court?

Accepted Answer

It must be relevant, authentic, and collected without alteration

Answer

For digital evidence to be admissible, it must be relevant to the case, authenticated as genuine, and proven to have been collected and preserved without alteration.

Question 2

An investigator discovers that log files on a compromised server were deleted by the attacker. Which forensic technique could help recover them?

Accepted Answer

File carving from unallocated disk space

Answer

File carving can recover deleted log files from unallocated disk space by searching for known file headers and footers even after deletion.

Question 3

Which Windows Registry hive stores information about USB devices that have been connected to a system?

Accepted Answer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR

Answer

The USBSTOR key in the SYSTEM hive records information about USB storage devices that have been connected, including device identifiers and first/last connection times.

Question 4

What is 'anti-forensics' and why is it a concern for investigators?

Accepted Answer

Techniques used to destroy, hide, or falsify digital evidence to impede investigations

Answer

Anti-forensics encompasses techniques like log wiping, timestamp modification, steganography, and file encryption used by attackers to hinder or mislead forensic investigations.

Question 5

During a forensic investigation, an analyst finds timestamps that appear inconsistent with the suspected attack timeline. What should the analyst consider?

Accepted Answer

Consider time zone differences, clock skew, and possible timestamp manipulation

Answer

Timestamp inconsistencies can result from time zone differences, system clock drift, or deliberate anti-forensic manipulation, all of which must be accounted for during analysis.

ISA - Information Security Analyst Certification Practice Test

ISA - Information Security Analyst Certification Practice Test

ISA Digital Forensics & Investigation 3