I85PREP
⌘ K
CCFR study materials
CCFR study resources

CCFR practice questions

One question at a time. Build your CCFR understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Cyber Forensics

During a forensic investigation, an examiner needs to preserve the contents of a live system's RAM before shutting it down. Which acquisition method captures volatile memory?

  1. Capturing a memory image using a tool such as a kernel-level memory dumper Correct answer.
  2. Copying the pagefile to external storage
  3. Cloning the hard disk with a hardware write blocker
  4. Taking a photograph of the running desktop

Explanation

Volatile memory such as RAM must be captured while the system is powered on, typically with a dedicated memory acquisition tool that reads physical memory through a kernel driver. Disk cloning and pagefile copying do not capture active RAM contents and lose volatile artifacts.

Question 2Cyber Forensics

Which term describes the property of digital evidence meaning it can be shown to be unchanged since collection?

  1. Non-repudiation
  2. Integrity Correct answer.
  3. Chain of custody
  4. Authenticity

Explanation

Integrity refers to evidence remaining unaltered, usually demonstrated through cryptographic hashes computed at acquisition and re-verified later. Chain of custody documents who handled evidence, while authenticity concerns origin and non-repudiation concerns denying actions.

Question 3Cyber Forensics

A forensic examiner images a suspect drive and computes an MD5 hash before and after analysis. What is the primary purpose of this practice?

  1. To encrypt the evidence against unauthorized access
  2. To compress the image for storage efficiency
  3. To demonstrate that the image was not altered during examination Correct answer.
  4. To verify the drive's physical sector count

Explanation

Comparing pre- and post-analysis hashes demonstrates that the working copy remained bit-for-bit identical, supporting evidentiary integrity. Hashing is not a compression, encryption, or capacity-checking mechanism.

Question 4Cyber Forensics

In FAT file system forensics, what does the term 'slack space' refer to?

  1. The duplicate copy of the file allocation table
  2. Unallocated clusters never written to
  3. The reserved boot sector region
  4. The unused remainder of the last allocated cluster of a file Correct answer.

Explanation

File slack is the leftover space between the logical end of a file and the end of its final allocated cluster, which may retain residual data from prior writes. It is distinct from unallocated clusters and from the FAT's backup copy.

Question 5Cyber Forensics

Which Windows registry hive stores per-user settings and is typically located in the user profile directory?

  1. NTUSER.DAT Correct answer.
  2. SOFTWARE
  3. SYSTEM
  4. SAM

Explanation

NTUSER.DAT holds the settings for an individual user profile and resides in that user's folder. SYSTEM, SAM, and SOFTWARE are machine-level hives stored under the system configuration directory.

Question 6Cyber Forensics

An investigator wants to determine when a file was last modified on an NTFS volume. Which artifact provides this directly?

  1. The pagefile header
  2. The $MFT record's standard information timestamps Correct answer.
  3. The volume's boot sector
  4. The $Bitmap allocation map

Explanation

NTFS stores timestamps such as creation, modification, and access times in the $STANDARD_INFORMATION attribute of each $MFT record. The boot sector, $Bitmap, and pagefile do not record per-file modification times.

Question 7Cyber Forensics

Which network forensic artifact maps IP addresses to MAC addresses on a local segment?

  1. ARP cache Correct answer.
  2. DHCP lease file
  3. Routing table
  4. DNS cache

Explanation

The ARP cache stores recently resolved mappings between IP addresses and hardware MAC addresses on the local network. DNS resolves names to addresses, routing tables direct traffic, and DHCP leases assign addresses.

Question 8Cyber Forensics

What is the role of a write blocker during disk acquisition?

  1. It speeds up imaging by caching reads
  2. It encrypts the source drive to protect evidence
  3. It repairs file system inconsistencies on the source
  4. It prevents any write operation from reaching the source drive Correct answer.

Explanation

A write blocker permits read access while blocking write commands, ensuring the source evidence is not modified during acquisition. It does not encrypt, accelerate, or repair the source drive.

Question 9Cyber Forensics

An examiner finds deleted file entries in an NTFS $MFT where the record is marked as not in use. What does this indicate?

  1. The file content was securely wiped from all clusters
  2. The file was never created on this volume
  3. The file was moved to a different volume
  4. The file entry was deallocated but residual metadata may remain Correct answer.

Explanation

When a file is deleted on NTFS, its $MFT record is flagged as unused, but metadata and possibly cluster content can persist until overwritten. Secure wiping, moving to another volume, and never-created states are distinct conditions.

Question 10Cyber Forensics

A packet capture shows repeated TCP SYN packets to many destination ports from a single source with no completed handshakes. Which activity does this most likely indicate?

  1. Normal web browsing
  2. A port scanning attempt Correct answer.
  3. A DNS zone transfer
  4. A completed file transfer

Explanation

Many SYNs to varied ports without completed three-way handshakes are characteristic of port scanning, where the scanner probes for open services. Completed transfers and normal browsing would show established connections, and zone transfers use specific DNS queries.

Question 11Cyber Forensics

During timeline analysis, an examiner correlates file system timestamps with event log entries. Why is this correlation valuable?

  1. It establishes relationships between file activity and logged system events Correct answer.
  2. It eliminates the need for hash verification
  3. It proves the system clock was accurate
  4. It guarantees the suspect's identity

Explanation

Correlating multiple artifact sources helps establish what happened and when, linking file changes to logged events. It does not by itself identify a person, replace integrity checks, or prove clock accuracy.

Question 12Cyber Forensics

An examiner recovers a partially overwritten JPEG from unallocated space. Which technique best confirms it is a valid image file?

  1. Checking for the JPEG file signature and parsing its header structure Correct answer.
  2. Searching the registry for its filename
  3. Comparing its size to the cluster size
  4. Reading the file's NTFS permissions

Explanation

File carving validates recovered data by matching known signatures such as the JPEG start-of-image marker and parsing header structure to confirm format validity. Permissions, registry names, and size alone do not establish that the bytes form a valid image.

Question 13Cyber Forensics

What does the term 'unallocated space' mean on a storage volume?

  1. Sectors that have been physically damaged
  2. The region reserved for the boot loader
  3. The area used exclusively by the operating system
  4. Clusters currently not assigned to any active file Correct answer.

Explanation

Unallocated space consists of clusters the file system does not currently assign to any file, and it may contain remnants of deleted data. It is distinct from reserved boot regions, OS-reserved areas, and physically damaged sectors.

Question 14Cyber Forensics

An investigator needs to examine a mobile device's app data that is protected by full-disk encryption. Which approach is most appropriate?

  1. Using a logical extraction with the device unlocked and credentials provided Correct answer.
  2. Deleting the lock screen database to bypass encryption
  3. Enabling airplane mode and imaging over Bluetooth
  4. Removing the storage chip and reading it directly without keys

Explanation

With full-disk encryption, data is inaccessible without the decryption keys, so a logical extraction performed while the device is unlocked and authenticated is the appropriate method. Direct chip reading yields ciphertext, and Bluetooth or database deletion do not yield decrypted data.

Question 15Cyber Forensics

Which log source on a Linux system typically records authentication successes and failures?

  1. /var/log/auth.log Correct answer.
  2. /proc/meminfo
  3. /etc/fstab
  4. /etc/passwd

Explanation

Authentication events on many Linux distributions are recorded in /var/log/auth.log or an equivalent secure log. The passwd file holds account records, meminfo reports memory statistics, and fstab lists mount configuration.

Question 16Cyber Forensics

A forensic examiner observes that a file's NTFS $STANDARD_INFORMATION timestamps differ from its $FILE_NAME timestamps. What does this most likely suggest?

  1. Timestamps may have been manipulated by a tool that alters one attribute but not the other Correct answer.
  2. The volume was formatted with FAT
  3. The file was compressed by the operating system
  4. The file has never been accessed

Explanation

NTFS maintains timestamps in both $STANDARD_INFORMATION and $FILE_NAME attributes, and certain tools or tampering may update one without the other, producing discrepancies worth investigating. Such differences are not explained by FAT formatting, compression, or lack of access.

Question 17Cyber Forensics

Which artifact would best help an examiner determine what USB storage devices were connected to a Windows system?

  1. The ARP cache
  2. The hosts file
  3. The DNS resolver cache
  4. The SetupAPI device log and USBSTOR registry keys Correct answer.

Explanation

Windows records connected USB mass storage devices in USBSTOR registry keys and SetupAPI logs, which include device identifiers and connection details. The hosts file, ARP cache, and DNS cache relate to network name resolution, not device connection history.

Question 18Cyber Forensics

An examiner is asked to analyze a memory image for signs of a process injection attack. Which artifact is most relevant?

  1. The list of loaded kernel modules only
  2. The volume serial number
  3. Memory regions with executable permissions not backed by a file on disk Correct answer.
  4. The system's time zone configuration

Explanation

Injected code often appears in memory as executable regions that are not mapped to a legitimate file on disk, a common indicator of process injection. Kernel module lists, time zone settings, and volume serial numbers do not reveal injected code in a process.

Question 19Cyber Forensics

What is the primary function of the Windows Prefetch files in forensic analysis?

  1. They contain the full contents of deleted documents
  2. They store user passwords in cleartext
  3. They define network firewall rules
  4. They record evidence of program execution and referenced file paths Correct answer.

Explanation

Prefetch files are created when applications execute and contain information such as the executable name, run count, and referenced file paths, making them useful for proving execution. They do not store passwords, deleted document contents, or firewall rules.

Question 20Cyber Forensics

An examiner finds that a suspect's system clock was set several hours ahead. How should this affect timeline interpretation?

  1. It automatically invalidates all file system timestamps
  2. It should be ignored because timestamps are always in UTC
  3. It proves the system was not used during the incident
  4. Timestamps must be normalized for the observed clock offset before correlation Correct answer.

Explanation

Clock skew must be identified and accounted for so that timestamps from different sources can be correlated accurately. Ignoring the offset, assuming non-use, or discarding all timestamps would misrepresent the evidence.

Question 21Cyber Forensics

An investigator must acquire evidence from a running server that cannot be taken offline. Which sequence best follows accepted volatile-order principles?

  1. Disconnect power, then remove the drive
  2. Shut down the server first, then image the disk
  3. Capture network connections and memory, then acquire persistent storage Correct answer.
  4. Image the disk first, then capture memory

Explanation

Volatile data such as network state and memory should be captured before persistent storage because it is lost on shutdown or power loss. Shutting down, imaging disk first, or cutting power would destroy volatile evidence.

Question 22Cyber Forensics

A carved file recovered from unallocated space appears valid by signature but contains inconsistent internal length fields. What is the most reasonable interpretation?

  1. The signature check was unnecessary
  2. The file is certainly intact and should be treated as authentic
  3. The file must have been created by the operating system
  4. The file may be fragmented or partially overwritten and requires further validation Correct answer.

Explanation

Signature matches only confirm the header, while inconsistent internal length fields suggest fragmentation, overwriting, or corruption, so additional validation is required before relying on the content. Treating it as intact, dismissing signature checks, or attributing it to the OS is not justified.

Question 23Cyber Forensics

An examiner suspects anti-forensic timestamp manipulation on NTFS. Which combination of artifacts provides the strongest corroboration?

  1. Cross-referencing $FILE_NAME timestamps, $LogFile entries, and external event logs Correct answer.
  2. The file's extension and icon
  3. Only the $STANDARD_INFORMATION timestamps
  4. The volume label and serial number

Explanation

Strong corroboration comes from multiple independent sources such as $FILE_NAME timestamps, $LogFile transaction records, and external logs, which are harder to alter consistently. Relying on a single timestamp set, volume identifiers, or cosmetic attributes is insufficient.

Question 24Cyber Forensics

During memory analysis, an examiner finds a hidden process not visible in the standard process list but present in pool tag scanning. What does this most likely indicate?

  1. A hardware failure in the memory module
  2. Possible process hiding or rootkit activity requiring deeper investigation Correct answer.
  3. A routine operating system update
  4. A normal user application

Explanation

Discrepancies between active process lists and pool tag scanning can reveal processes hidden by rootkits or DKOM techniques, warranting deeper analysis. Such findings are not explained by ordinary applications, hardware faults, or routine updates.

Question 25Cyber Forensics

An examiner must present digital evidence in court and anticipate a challenge to authenticity. Which practice best supports admissibility?

  1. Maintaining documented chain of custody, verified hashes, and reproducible methodology Correct answer.
  2. Using proprietary tools without recording versions or settings
  3. Presenting only the final report without underlying data
  4. Relying solely on the examiner's recollection of the acquisition

Explanation

Admissibility is strengthened by documented chain of custody, verified hash integrity, and a reproducible, well-recorded methodology that another examiner could follow. Memory alone, incomplete disclosure, and undocumented tool use weaken the evidence's defensibility.

Question 26Cyber Forensics

Which principle states that a forensic examiner should never alter the original evidence media during analysis?

  1. The order of volatility
  2. Locard's exchange principle
  3. The chain of custody rule Correct answer.
  4. The principle of least privilege

Explanation

Chain of custody requires that evidence be documented and handled so that its integrity can be demonstrated from seizure through presentation. Working only on verified copies and logging every transfer preserves that defensibility. The other principles govern different concerns such as data volatility or access control.

Question 27Cyber Forensics

In a FAT32 file system, where is the first cluster of a file's data recorded for a directory entry?

  1. In the boot sector's reserved region
  2. In the file allocation table entry for the file
  3. In the volume's backup superblock
  4. In the directory entry's starting cluster field Correct answer.

Explanation

A FAT directory entry stores the file name, attributes, size, and the number of the first cluster allocated to the file. Subsequent clusters are found by following the linked list in the file allocation table. The boot sector describes volume geometry, not individual file locations.

Question 28Cyber Forensics

An examiner hashes a disk image immediately after acquisition and again after analysis. What is the purpose of the second hash?

  1. To verify the image remained unchanged during examination Correct answer.
  2. To decrypt the image for review
  3. To compress the image for archival storage
  4. To index the image for keyword searching

Explanation

Recomputing the hash after analysis and comparing it with the acquisition hash demonstrates that the working copy was not altered. Matching values support the claim that findings reflect the original evidence. Compression, decryption, and indexing are unrelated to integrity verification.

Question 29Cyber Forensics

Which file system metadata structure on an ext4 volume records inode allocation state and block group statistics?

  1. The journal
  2. The extent tree
  3. The superblock Correct answer.
  4. The directory hash tree

Explanation

The ext4 superblock holds volume-wide parameters including block size, inode counts, and block group descriptors that track allocation. The journal records pending metadata transactions for crash recovery. Extent trees and hash trees describe individual file layouts and directory indexing.

Question 30Cyber Forensics

What does the Windows registry hive file NTUSER.DAT primarily contain for a given user?

  1. System-wide hardware configuration
  2. The machine's security audit policy
  3. That user's profile settings and preferences Correct answer.
  4. Installed driver binaries

Explanation

NTUSER.DAT is loaded as HKEY_CURRENT_USER and stores per-user settings such as application preferences, recent documents, and user-specific configuration. Machine-wide hardware and security policy live in the SYSTEM and SECURITY hives.

Question 31Cyber Forensics

Which artifact records the programs a Windows user launched through the Explorer shell, including execution counts?

  1. Amcache.hve
  2. UserAssist registry keys Correct answer.
  3. Prefetch files
  4. ShimCache entries

Explanation

UserAssist stores ROT13-encoded entries under the user's registry hive that track GUI-launched programs with run counters and last-run times. Prefetch and Amcache provide related execution evidence but from different sources and with different coverage.

Question 32Cyber Forensics

Which tool is designed specifically to acquire a forensic image of a live Linux system's memory?

  1. LiME Correct answer.
  2. dd
  3. Autopsy
  4. Volatility

Explanation

LiME is a loadable kernel module that captures physical memory to a file or over a network socket on Linux hosts. Volatility analyzes memory images rather than acquiring them, and dd targets block devices.

Question 33Cyber Forensics

Which of the following best describes the purpose of a forensic case management log?

  1. Encrypting examiner communications
  2. Storing the acquired disk images
  3. Documenting who accessed evidence and when Correct answer.
  4. Compiling malware signatures

Explanation

A case management log records actions taken on evidence, including examiners, timestamps, and purposes, supporting chain of custody and reproducibility. It is a documentation record rather than a storage or security mechanism.

Question 34Cyber Forensics

An examiner finds that a FAT32 directory entry has the first character of its name replaced with 0xE5. What does this most likely indicate?

  1. The file is compressed
  2. The volume was formatted
  3. The file was renamed by the user
  4. The entry was marked as deleted Correct answer.

Explanation

In FAT file systems, 0xE5 in the first name byte signals that the directory entry is no longer in use, a common result of deletion. The remaining name characters and starting cluster often survive, enabling recovery. Renaming or compression would not produce this marker.

Question 35Cyber Forensics

An investigator needs to prove that a seized laptop was not booted from its internal disk before imaging. Which evidence most directly supports this?

  1. The disk's SMART power-on hours counter
  2. The absence of a user logon event after seizure time Correct answer.
  3. The system event log showing a clean shutdown
  4. The presence of a hibernation file

Explanation

If no logon or boot events appear in the security or system logs after the documented seizure time, that supports the claim the system was not started. SMART counters and hibernation files reflect historical use and cannot establish post-seizure state on their own.

Question 36Cyber Forensics

During analysis of a Windows host, an examiner finds a service binary path pointing to a user-writable directory and a matching 7045 event. What does this combination most strongly suggest?

  1. A failed Windows update
  2. A legitimate driver update
  3. A scheduled disk defragmentation
  4. Possible persistence through a malicious service Correct answer.

Explanation

Event ID 7045 records service installation, and a binary in a user-writable path is a common persistence technique because the attacker can replace the executable. Correlating the log entry with the file path strengthens the finding. Legitimate updates typically install to protected system directories.

Question 37Cyber Forensics

Which approach best preserves volatile network state on a running server before shutdown?

  1. Image the disk first and ignore network state
  2. Capture active connections and ARP cache, then acquire memory Correct answer.
  3. Immediately power off the host
  4. Disconnect the network cable and wait

Explanation

Active connections, routing tables, and ARP caches vanish on shutdown, so they should be captured first, followed by memory acquisition to preserve process and network artifacts. Powering off or isolating the host destroys that state before it can be recorded.

Question 38Cyber Forensics

An examiner recovers an email file in MBOX format. How are individual messages separated within the file?

  1. By XML tags enclosing each message
  2. By null byte delimiters
  3. By a line beginning with 'From ' before each message Correct answer.
  4. By fixed-length binary headers

Explanation

MBOX stores messages concatenated in one file, each introduced by a line starting with 'From ' followed by the sender and a timestamp. Parsers rely on this separator, and the escaping of body lines beginning with 'From ' prevents false splits.

Question 39Cyber Forensics

A browser's SQLite History database is examined. Which field in the visits table most directly records when a page was accessed?

  1. visit_duration
  2. visit_time Correct answer.
  3. transition
  4. typed_count

Explanation

The visits table stores visit_time as a timestamp, typically microseconds since 1601 for Chromium-based browsers. Duration, typed count, and transition type describe other aspects of the visit rather than its moment.

Question 40Cyber Forensics

An examiner observes a large number of TCP connections from one internal host to many external hosts on port 443 with high outbound byte counts. Which hypothesis is most consistent with this pattern?

  1. Data exfiltration over encrypted channels Correct answer.
  2. A DHCP starvation attack
  3. An ARP spoofing campaign
  4. A SYN flood against the internal host

Explanation

Many outbound TLS sessions with substantial upload volume suggest data being sent to multiple external endpoints, a common exfiltration pattern. SYN floods, DHCP starvation, and ARP spoofing produce different signatures centered on connection attempts or local address resolution.

Question 41Cyber Forensics

When carving files from unallocated space, why should an examiner prefer validated carving tools with format-aware parsers?

  1. They bypass the need for hash verification
  2. They guarantee every carved file is authentic
  3. They reduce false positives by checking structural consistency Correct answer.
  4. They recover deleted files faster than file system parsing

Explanation

Format-aware carving validates headers, internal lengths, and terminators, which filters fragments that merely match a signature. No carving tool can guarantee authenticity, and hash verification remains necessary for evidentiary integrity.

Question 42Cyber Forensics

A Linux host shows an entry in /etc/passwd with UID 0 for an account named 'support'. What is the forensic significance?

  1. The account has root-equivalent privileges Correct answer.
  2. The account was created by the package manager
  3. The account is locked
  4. The account is a standard system service

Explanation

UID 0 grants root privileges regardless of the account name, so a nonstandard name with UID 0 is a common backdoor technique. System service accounts use dedicated low UIDs, and lock state is recorded in the shadow file.

Question 43Cyber Forensics

Which Windows artifact most directly records the last time a specific user profile was used to log on interactively?

  1. The NTUSER.DAT file's last write time Correct answer.
  2. The SYSTEM hive's CurrentControlSet
  3. The SAM hive's user account flags
  4. The SOFTWARE hive's Run key

Explanation

NTUSER.DAT is loaded at logon and updated during the session, so its last write time approximates the last interactive use of that profile. SAM stores account data, and the SOFTWARE and SYSTEM hives hold machine configuration.

Question 44Cyber Forensics

An examiner finds that a suspect's anti-forensic tool overwrote file slack on an NTFS volume. Which data is most likely lost?

  1. The $MFT record header
  2. The transaction log
  3. The volume boot sector
  4. Residual data beyond the logical end of allocated files Correct answer.

Explanation

File slack is the space between the logical end of a file and the end of its last allocated cluster; it can hold remnants of previously deleted content. Overwriting slack removes that residual data but leaves file system metadata structures intact.

Question 45Cyber Forensics

Which memory analysis artifact best indicates that a process was created by injecting code into another process's address space?

  1. The process's parent PID value
  2. Memory regions marked executable but not backed by a file Correct answer.
  3. The process's working set size
  4. The process's handle count

Explanation

Private memory regions with execute permission that have no corresponding file on disk are a hallmark of injected code such as shellcode or reflectively loaded modules. Parent PID can be spoofed, and handle counts and working set sizes vary widely for legitimate reasons.

Question 46Cyber Forensics

An examiner must reconstruct activity on a system where the clock was skewed. Which method best establishes a reliable timeline?

  1. Using external time sources and log correlations to estimate the offset Correct answer.
  2. Assuming the skew was a constant one hour
  3. Ignoring all timestamps and relying on witness statements
  4. Trusting file system timestamps as recorded

Explanation

Comparing recorded times against external references such as server logs, network captures, or time synchronization records lets the examiner estimate the offset and normalize events. Assuming a fixed offset is unsafe because skew can drift or be applied inconsistently.

Question 47Cyber Forensics

An examiner finds a volume with an Apple File System container and needs to locate per-file metadata such as extended attributes. Which structure should be examined?

  1. The checkpoint descriptor area
  2. The allocation bitmap
  3. The volume superblock only
  4. The catalog file B-tree Correct answer.

Explanation

APFS stores file and directory records, including extended attributes, in the catalog B-tree of each volume. The superblock holds volume parameters, the allocation bitmap tracks free blocks, and checkpoint areas support consistency.

Question 48Cyber Forensics

A packet capture shows a host resolving many nonexistent domain names in rapid succession. Which activity is most consistent with this pattern?

  1. Domain generation algorithm beaconing Correct answer.
  2. A DHCP lease renewal
  3. Normal web browsing
  4. A large file download

Explanation

Malware using a domain generation algorithm queries many pseudorandom names, most of which do not resolve, to locate its command-and-control server. Browsing, downloads, and DHCP renewals do not produce bursts of failed lookups for random domains.

Question 49Cyber Forensics

An investigator needs to prove a file existed on a volume at a specific time despite its deletion. Which combination of evidence is strongest?

  1. The volume's creation timestamp
  2. A file system journal entry plus a matching external log record Correct answer.
  3. A witness statement about the file
  4. A single unallocated cluster containing file content

Explanation

Corroborating a file system journal entry with an independent external record ties the file's existence to a specific moment through two sources. A lone cluster lacks context, and creation timestamps and testimony do not establish the file's presence at the relevant time.

Question 50Cyber Forensics

An examiner wants to establish a defensible chain of custody for a seized USB drive. Which record is the primary document for this purpose?

  1. A screenshot of the drive's contents in a file browser
  2. A memory dump taken from the workstation used to view the drive
  3. A timeline of file access times extracted from the drive's filesystem
  4. A hash log recording the drive's SHA-256 at acquisition and each transfer Correct answer.

Explanation

Chain of custody documents who had control of evidence, when, and in what condition. Cryptographic hashes recorded at acquisition and at each transfer allow later verification that the evidence was not altered. Timelines and screenshots are analytical products and cannot demonstrate custody continuity.