CCE Computer Forensics Tools & Techniques 3 — Questions and Answers
Question 1: Which tool is specifically designed to parse and analyze Windows Registry hives for forensic evidence?
- Volatility
- RegRipper (Correct answer)
- NetworkMiner
- Bulk Extractor
Correct answer: RegRipper
RegRipper automates the extraction of forensically relevant data from Windows Registry hives using plugin-based analysis.
Question 2: In a Windows system, the ShellBags registry key primarily records evidence of:
- Network share connections
- Folder browsing history including deleted folders (Correct answer)
- Recently opened documents
- Installed software history
Correct answer: Folder browsing history including deleted folders
ShellBags store Windows Explorer folder view settings and persist even after the folder is deleted, revealing browsing history.
Question 3: What does the Volatility framework's 'pslist' plugin enumerate during memory forensics?
- Physical memory page table entries
- Active processes from the EPROCESS doubly linked list (Correct answer)
- Network socket connections
- Loaded kernel modules
Correct answer: Active processes from the EPROCESS doubly linked list
The pslist plugin walks the EPROCESS doubly linked list in memory to enumerate active processes at the time of the memory capture.
Question 4: Which file carving technique reconstructs files based on header and footer signatures rather than file system metadata?
- Inode recovery
- Journal replay
- Signature-based carving (Correct answer)
- Logical file recovery
Correct answer: Signature-based carving
Signature-based carving identifies file boundaries using known magic bytes (headers) and terminators (footers) to reconstruct files from raw disk data.
Question 5: An investigator finds a file with MAC times all identical and very recent. This most likely indicates:
- The file is a system file
- Timestomping was used to obscure the file's true age (Correct answer)
- The file was recently accessed
- The drive is failing
Correct answer: Timestomping was used to obscure the file's true age
Timestomping is an anti-forensic technique that modifies file timestamps; all-identical recent times often indicate deliberate manipulation.
Question 6: Which Bulk Extractor scanner would be most useful for finding credit card numbers in a disk image?
- email scanner
- ccn scanner (Correct answer)
- url scanner
- domain scanner
Correct answer: ccn scanner
Bulk Extractor's ccn (credit card number) scanner uses Luhn algorithm validation to identify potential credit card numbers across the image.
Question 7: During network forensics, which protocol analysis would reveal encrypted C2 (command-and-control) communication by analyzing traffic patterns rather than content?
- Deep packet inspection
- Behavioral/traffic flow analysis (Correct answer)
- SSL certificate pinning
- ARP cache analysis
Correct answer: Behavioral/traffic flow analysis
Behavioral traffic flow analysis examines packet timing, size, and frequency patterns to identify C2 beaconing even when content is encrypted.
CCE Computer Forensics Tools & Techniques 3
Which tool is specifically designed to parse and analyze Windows Registry hives for forensic evidence?