CHFI Anti-Forensics Techniques 1 — Questions and Answers
Question 1: What is the primary goal of anti-forensics techniques?
- To enhance evidence collection efficiency
- To prevent, destroy, or obfuscate digital evidence (Correct answer)
- To improve system performance after an incident
- To encrypt network traffic from monitoring
Correct answer: To prevent, destroy, or obfuscate digital evidence
Anti-forensics techniques are designed to prevent, destroy, or obfuscate digital evidence to hinder forensic investigations and avoid attribution.
Question 2: Which technique involves overwriting storage media multiple times with random data patterns to prevent file recovery?
- File compression
- Secure wiping (data sanitization) (Correct answer)
- File encryption
- Data carving
Correct answer: Secure wiping (data sanitization)
Secure wiping overwrites storage media multiple times with random data patterns, making the original data unrecoverable even with advanced forensic tools.
Question 3: What does 'timestomping' refer to in anti-forensics?
- Destroying physical storage media with a hammer
- Encrypting file contents to conceal data from investigators
- Modifying file metadata timestamps to mislead timeline analysis (Correct answer)
- Hiding files in unallocated disk space
Correct answer: Modifying file metadata timestamps to mislead timeline analysis
Timestomping involves modifying a file's MAC (Modified, Accessed, Created) timestamps to mislead forensic investigators about when events occurred.
Question 4: Which of the following is a commonly used Windows tool for secure file deletion that supports multiple overwrite passes?
- Recuva
- FTK Imager
- Eraser (Correct answer)
- Autopsy
Correct answer: Eraser
Eraser is a widely used Windows tool that performs secure file deletion by overwriting files with multiple passes of random data, making recovery infeasible.
Question 5: What does steganography refer to in the context of anti-forensics?
- Encrypting files with strong cryptographic algorithms
- Hiding data within other seemingly innocent files such as images or audio (Correct answer)
- Wiping hard drive sectors to prevent data recovery
- Altering log files to remove traces of activity
Correct answer: Hiding data within other seemingly innocent files such as images or audio
Steganography involves hiding secret data within ordinary files like images, audio, or video so that the existence of the hidden data is concealed from investigators.
Question 6: What is the anti-forensics purpose of exploiting Alternate Data Streams (ADS) in NTFS?
- To encrypt the primary data stream with AES
- To compress large files automatically for storage efficiency
- To hide data within NTFS file metadata, invisible to standard directory listings (Correct answer)
- To delete files beyond forensic recovery
Correct answer: To hide data within NTFS file metadata, invisible to standard directory listings
Alternate Data Streams (ADS) is an NTFS feature that allows data to be attached to a file's metadata stream, making it invisible to standard directory listings and many forensic tools.
Question 7: Which anti-forensics technique involves routing network traffic through multiple anonymizing proxies or Tor to conceal an attacker's true IP address?
- Log sanitization
- Trail obfuscation (Correct answer)
- Data carving
- Slack space manipulation
Correct answer: Trail obfuscation
Trail obfuscation involves using proxies, VPNs, or Tor to hide the true origin of network activity, making it difficult for investigators to trace actions back to the attacker.
CHFI Anti-Forensics Techniques 1
What is the primary goal of anti-forensics techniques?