Forensic Analysis and Investigation Techniques Flashcards
6 cards from real CFE practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 Forensic Analysis and Investigation Techniques flashcards as text
Which type of analysis is used to examine deleted files on a hard drive?
Answer: File carving
File carving is a forensic technique used to recover deleted or fragmented files from raw disk images. It works by searching for known file headers and footers (signatures) to reconstruct files, even when file system metadata has been lost or overwritten. This method is crucial for recovering data that has been intentionally or accidentally deleted.
What does a hash value indicate in forensic analysis?
Answer: The file's unique digital fingerprint
A hash value is a fixed-size alphanumeric string generated by a mathematical algorithm from a file's content. It acts as a unique digital fingerprint, meaning any change to the file, even a single bit, will result in a completely different hash value. This property is crucial in forensics for verifying data integrity and identifying known files.
Which tool is commonly used to analyze Windows registry artifacts?
Answer: Registry Viewer
Registry Viewer is a specialized tool designed to parse and display the contents of the Windows Registry, which stores configuration settings and system information. It allows forensic examiners to analyze various artifacts like user activity, installed software, and connected devices by navigating through the registry's hierarchical structure. Other options like FTK Imager are for disk imaging, Wireshark for network analysis, and Autopsy is a broader forensic suite.
What type of evidence is volatile and must be collected immediately?
Answer: RAM contents
RAM (Random Access Memory) contents are considered volatile evidence because the data stored within them is lost once the power is removed from the system. Therefore, it must be collected immediately using specialized tools before the system is shut down or rebooted. This data can contain crucial information like running processes, open files, and decrypted data that would otherwise be lost.
What does a timeline analysis help investigators determine?
Answer: Sequence of system events
Timeline analysis involves compiling and correlating various timestamps from different sources (e.g., file system metadata, log files, registry entries) into a chronological sequence. This helps investigators reconstruct the order of events that occurred on a system, providing a clear picture of user activities, system changes, and potential malicious actions over time. It's essential for understanding the 'when' of an incident.
Which artifact is best for identifying external devices connected to a system?
Answer: USBSTOR registry key
The USBSTOR registry key, located within the Windows Registry, specifically records information about USB mass storage devices that have been connected to a system. Analyzing this key allows forensic examiners to identify details such as the vendor ID, product ID, serial number, and the last time a specific USB device was connected. This makes it invaluable for tracking external device usage and potential data exfiltration.