CHFI Anti-Forensics Techniques 2 — Questions and Answers
Question 1: Which US Department of Defense standard specifies a data sanitization method using multiple overwrite passes with specific data patterns?
- ISO 27001
- NIST SP 800-88
- DoD 5220.22-M (Correct answer)
- PCI DSS
Correct answer: DoD 5220.22-M
The DoD 5220.22-M standard specifies a data sanitization method with multiple overwrite passes using defined patterns, widely implemented in secure wiping tools.
Question 2: What is the forensic significance of 'slack space' that makes it relevant to anti-forensics investigations?
- It stores encrypted data that cannot be accessed without a key
- It is the unused space between the end of a file and the end of its allocated cluster that may contain remnant data (Correct answer)
- It is a dedicated area for storing deleted files before final purge
- It refers to RAM not used by running processes
Correct answer: It is the unused space between the end of a file and the end of its allocated cluster that may contain remnant data
Slack space is the unused portion between the end of a file and the end of its allocated storage cluster, which may retain remnant data from previously stored files.
Question 3: Which anti-forensics technique involves modifying or deleting system log files to erase evidence of an attacker's activities?
- Data carving
- Log tampering (log sanitization) (Correct answer)
- Timestomping
- Steganography
Correct answer: Log tampering (log sanitization)
Log tampering involves modifying or deleting system, application, or security log files to erase records of an attacker's actions and prevent forensic reconstruction of events.
Question 4: What is a rootkit in the context of anti-forensics?
- A tool for recovering deleted files from damaged media
- Malware that hides its presence and other malicious activity from the OS and forensic tools (Correct answer)
- A network packet analyzer used for traffic interception
- A password cracking utility targeting system accounts
Correct answer: Malware that hides its presence and other malicious activity from the OS and forensic tools
A rootkit is malicious software designed to hide its own presence and the presence of other malware from the operating system, security software, and forensic investigation tools.
Question 5: Which open-source full disk encryption tool is considered a major challenge for digital forensic investigators due to its strong encryption?
- MD5sum
- SHA-256
- VeraCrypt (Correct answer)
- Wireshark
Correct answer: VeraCrypt
VeraCrypt provides strong full-disk or volume encryption that makes encrypted data completely inaccessible without the correct passphrase or key, presenting a significant obstacle to forensic access.
Question 6: Which anti-forensics technique involves an attacker deliberately planting false digital evidence to mislead forensic investigators?
- Evidence fabrication (anti-forensic deception) (Correct answer)
- Secure deletion
- Log rotation
- Data carving
Correct answer: Evidence fabrication (anti-forensic deception)
Evidence fabrication involves planting false or misleading digital artifacts to confuse investigators, waste forensic resources, or frame innocent parties for the crime.
Question 7: Which Windows artifact records information about recently executed programs including execution count and last run time, even after the program is deleted?
- Recycle Bin metadata
- Prefetch files (Correct answer)
- Desktop shortcut .lnk files
- Start menu entries
Correct answer: Prefetch files
Windows Prefetch files record details about recently executed programs including execution count and timestamps, providing evidence of program execution even after the program has been deleted.
CHFI Anti-Forensics Techniques 2
Which US Department of Defense standard specifies a data sanitization method using multiple overwrite passes with specific data patterns?