General MCQ Flashcards

Which of the following best describes steganography in the context of digital forensics?

Answer: Hiding data within another file or medium

Steganography is the practice of concealing secret data within ordinary, non-secret files such as images or audio files.

A forensic examiner is analyzing a suspect's browser history. Which SQLite database file stores Chrome's browsing history?

Answer: History

Chrome stores browsing history in an SQLite file named 'History' located in the user's Chrome profile directory.

What is the standard hashing algorithm recommended by NIST for generating forensic hash values to verify evidence integrity?

Answer: SHA-256

NIST recommends SHA-256 for generating forensic hash values as it provides stronger collision resistance than MD5 or SHA-1.

During a CHFI investigation, an examiner needs to analyze Windows event logs for failed logon attempts. Which Event ID should they filter for?

Answer: 4625

Event ID 4625 is logged in the Windows Security event log for every failed account logon attempt.

Which type of forensic acquisition captures only the allocated (active) files and directories rather than the entire disk image?

Answer: Logical acquisition

Logical acquisition copies only the active file system contents, missing deleted files and unallocated space.

An attacker uses timestomping to cover their tracks. What does this technique modify?

Answer: File system MACB timestamps on modified files

Timestomping alters MACB (Modified, Accessed, Changed, Born) timestamps on files to obscure when they were created or modified.

In mobile forensics, what does a 'logical extraction' of an iOS device typically retrieve?

Answer: iTunes backup-level data including app data and media

Logical extraction of iOS devices retrieves data equivalent to an iTunes backup, including app data, media, and settings.