CCE Computer Forensics Tools & Techniques

Question 1

Which tool is primarily used for imaging a suspect's hard drive without altering its contents?

Accepted Answer

FTK Imager

Answer

Wireshark

Answer

Autopsy

Answer

Nmap

Question 2

What is the main purpose of a write blocker in digital forensics?

Accepted Answer

To prevent writing to a suspect drive

Answer

To speed up data recovery

Answer

To block unauthorized users

Answer

To encrypt forensic images

Question 3

Which hash algorithm is most commonly used to verify the integrity of forensic images?

Accepted Answer

MD5

Answer

AES

Answer

RSA

Answer

Base64

Question 4

What is the function of the tool 'Autopsy' in computer forensics?

Accepted Answer

Forensic data analysis

Answer

Network intrusion detection

Answer

Data encryption

Answer

Real-time traffic monitoring

Question 5

Which technique is best suited to recover deleted files from a FAT file system?

Accepted Answer

File carving

Answer

Password cracking

Answer

Disk defragmentation

Answer

Registry cleaning

Question 6

Which forensic tool is used for memory (RAM) analysis?

Accepted Answer

Volatility

Answer

FTK Imager

Answer

Recuva

Answer

Metasploit