ACFE Digital Forensics and Evidence 4 — Questions and Answers
Question 1: What is the purpose of a MD5 or SHA-256 hash in digital forensics?
- To compress evidence files for storage efficiency
- To encrypt sensitive case notes
- To verify that a forensic copy is identical to the original evidence (Correct answer)
- To index files for rapid keyword searching
Correct answer: To verify that a forensic copy is identical to the original evidence
Cryptographic hashes create a unique digital fingerprint of data; matching hashes between original and copy confirm that no bits were altered during acquisition.
Question 2: An examiner discovers that a suspect used a virtual machine (VM) for financial transactions. Where is the most valuable forensic data typically found?
- The VM's .vmdk or .vhd disk image file on the host system (Correct answer)
- The host operating system's pagefile.sys only
- The VM software's installation directory
- The suspect's email client on the host machine
Correct answer: The VM's .vmdk or .vhd disk image file on the host system
The virtual disk image file (.vmdk, .vhd) contains the entire guest OS file system and can be mounted and examined like a physical drive.
Question 3: In network forensics, what does 'pcap' data contain?
- A log of user authentication failures
- Full packet captures of network traffic including payloads (Correct answer)
- A summary report of bandwidth utilization
- Encrypted VPN tunnel endpoints
Correct answer: Full packet captures of network traffic including payloads
PCAP (Packet Capture) files store raw network packets, allowing examiners to reconstruct sessions, recover transmitted files, and identify communications.
Question 4: When examining browser history for evidence of fraud, which artifact reveals sites visited even after history was manually cleared in most Chromium-based browsers?
- The browser's bookmarks file
- DNS cache entries and browser cache thumbnails (Correct answer)
- The hosts file in the operating system
- Browser extension manifests
Correct answer: DNS cache entries and browser cache thumbnails
DNS cache and thumbnail/favicon databases may retain visited site evidence even when browsing history is manually deleted from within the browser.
Question 5: A suspect claims a financial spreadsheet was never modified after its creation date. What forensic technique can refute or support this claim?
- Reviewing the file's digital signature certificate
- Analyzing MFT timestamps, file metadata, and shadow copy versions (Correct answer)
- Checking the file's size against a known database
- Running the file through antivirus software
Correct answer: Analyzing MFT timestamps, file metadata, and shadow copy versions
NTFS MFT timestamps, embedded document metadata, and Volume Shadow Copies can collectively establish the true modification history of a file.
Question 6: Which of the following best describes 'file slack space' in digital forensics?
- Empty sectors at the end of a hard drive partition
- The unused space between the end of a file's data and the end of its last allocated cluster (Correct answer)
- Temporary files created by the OS during file operations
- Space reserved by the file system for metadata
Correct answer: The unused space between the end of a file's data and the end of its last allocated cluster
File slack is the area between the end of a file's logical content and the end of its last storage cluster, which may contain remnants of previously stored data.
Question 7: What is the forensic significance of the Windows 'LNK' (shortcut) files?
- They store encrypted copies of recently accessed documents
- They can reveal the original path, creation date, and MAC address of files accessed even from removed devices (Correct answer)
- They contain browser session cookies for linked websites
- They log all failed login attempts on the system
Correct answer: They can reveal the original path, creation date, and MAC address of files accessed even from removed devices
Windows LNK files record metadata about the target file including timestamps, volume serial number, and network share details, revealing access to files on now-absent drives.
ACFE Digital Forensics and Evidence 4
What is the purpose of a MD5 or SHA-256 hash in digital forensics?