I85PREP
⌘ K
CDFE study materials
CDFE study resources

CDFE practice questions

One question at a time. Build your CDFE understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Digital Forensics

During acquisition of a suspect's hard drive, which practice best preserves the evidentiary value of the original media?

  1. Work directly on the original drive to avoid copy errors
  2. Image the drive with a write blocker and verify hashes Correct answer.
  3. Boot the suspect drive to check for hidden partitions first
  4. Compress the original drive into an archive before analysis

Explanation

Forensic acquisition relies on a write blocker to prevent modification and on hash verification (for example MD5/SHA-256) to demonstrate the image matches the source. Analysis is then performed on the verified copy, keeping the original pristine for chain of custody.

Question 2Digital Forensics

Which term describes the documented record of who handled evidence, when, and for what purpose from seizure through presentation?

  1. Chain of custody Correct answer.
  2. Hash digest
  3. Write blocker
  4. Order of volatility

Explanation

Chain of custody is the chronological documentation of custody, control, and transfer of evidence. It supports authentication of evidence in court by showing an unbroken record of handling.

Question 3Digital Forensics

An investigator must capture the most volatile data first on a running Windows host. Which item should be collected before the others?

  1. Contents of RAM Correct answer.
  2. Files in the Recycle Bin
  3. The pagefile on disk
  4. Installed application list from the registry

Explanation

Order of volatility dictates capturing memory contents before persistent disk artifacts, because RAM is lost on shutdown or reboot. Registry and file-system data persist and can be collected afterward.

Question 4Digital Forensics

What is the primary purpose of computing a cryptographic hash of a forensic image at acquisition and again before analysis?

  1. To encrypt the image against unauthorized access
  2. To demonstrate the image has not changed since acquisition Correct answer.
  3. To reconstruct deleted files from unallocated space
  4. To compress the image for efficient storage

Explanation

Comparing the acquisition hash with a later hash verifies integrity, showing the image is bit-for-bit identical to what was captured. Any mismatch signals alteration or corruption.

Question 5Digital Forensics

In NTFS, which structure stores file metadata such as timestamps, permissions, and data run locations?

  1. The Recycle Bin index
  2. The FAT table
  3. The boot sector only
  4. The Master File Table Correct answer.

Explanation

NTFS stores per-file metadata in records within the Master File Table, including standard information attributes with timestamps and data run lists. This makes MFT records a central artifact for timeline analysis.

Question 6Digital Forensics

Which Windows registry hive contains user-specific settings and is loaded from the user profile during a live examination?

  1. NTUSER.DAT Correct answer.
  2. SECURITY
  3. SAM
  4. SYSTEM

Explanation

NTUSER.DAT holds per-user configuration and is loaded into HKEY_CURRENT_USER when the user logs on. It is a frequent source of user activity artifacts such as recently used programs and typed paths.

Question 7Digital Forensics

A file is deleted on a FAT32 volume. What typically happens to the directory entry and the data clusters?

  1. The first character of the filename is replaced and the FAT entries are marked free Correct answer.
  2. The directory entry is erased and the clusters are zeroed
  3. The clusters are overwritten with random data immediately
  4. The file is moved to a hidden system folder automatically

Explanation

FAT deletion marks the directory entry's first filename byte as free (often shown as a special marker) and clears the cluster chain in the FAT. The data itself usually remains until overwritten, enabling recovery.

Question 8Digital Forensics

Which artifact in the Windows registry records applications the user has executed, including run counts and last-run times?

  1. UserAssist Correct answer.
  2. Amcache
  3. Prefetch
  4. ShimCache

Explanation

UserAssist, stored under the Explorer settings in NTUSER.DAT, tracks GUI-launched programs with run counters and last-execution timestamps. It is valuable for showing user intent and program usage.

Question 9Digital Forensics

An analyst finds an NTFS file whose $STANDARD_INFORMATION timestamps are earlier than its $FILE_NAME timestamps. What is the most defensible interpretation?

  1. The file may have been timestomped Correct answer.
  2. The volume was formatted recently
  3. The file is stored in a compressed state
  4. The file was never accessed after creation

Explanation

Timestomping tools often alter $STANDARD_INFORMATION but not $FILE_NAME, producing inconsistencies between the two attribute sets. Such discrepancies warrant further corroboration rather than a definitive conclusion on their own.

Question 10Digital Forensics

Which memory analysis artifact would best help identify a process that is hidden from the standard process list on Windows?

  1. Examining the Prefetch folder for recent launches
  2. Listing files in the System32 directory
  3. Reviewing the Recycle Bin for deleted executables
  4. Comparing process objects in memory with loaded drivers Correct answer.

Explanation

Rootkits often hide processes by unlinking them from the active process list; cross-viewing memory structures such as process objects and loaded drivers can expose discrepancies. This reveals hidden activity that disk-only artifacts may miss.

Question 11Digital Forensics

What does file carving primarily rely on to recover deleted files from unallocated space?

  1. Header and footer signatures of known formats Correct answer.
  2. Registry entries referencing the file
  3. Journal records of prior transactions
  4. File-system metadata pointers

Explanation

Carving scans raw data for known file headers and footers or structure patterns to reconstruct files without metadata. It is useful when file-system pointers are gone but content remains.

Question 12Digital Forensics

Which Linux artifact records login sessions, including user, terminal, and source host, and is commonly examined in timeline analysis?

  1. /etc/hosts
  2. /etc/passwd
  3. /var/log/wtmp Correct answer.
  4. /proc/cpuinfo

Explanation

The wtmp file records successful logins and logouts with user, terminal, and origin, and is read with tools such as last. It supports establishing who was on the system and when.

Question 13Digital Forensics

An investigator needs to establish that a specific USB mass storage device was connected to a Windows system. Which registry location is most directly relevant?

  1. The Services key for the Print Spooler
  2. The Run key under NTUSER.DAT
  3. The SAM account list
  4. USBSTOR under the SYSTEM hive Correct answer.

Explanation

USBSTOR under SYSTEM\CurrentControlSet\Enum records USB mass storage devices with vendor, product, and serial identifiers. Correlating with setupapi logs and mount points strengthens the finding.

Question 14Digital Forensics

Which statement correctly distinguishes a logical image from a physical image?

  1. A logical image is always encrypted, while a physical image is always unencrypted
  2. A physical image excludes unallocated space, while a logical image includes it
  3. A logical image requires a write blocker, while a physical image does not
  4. A logical image captures only selected files or partitions, while a physical image captures the entire device bit-for-bit Correct answer.

Explanation

A physical image copies every sector of the device, including unallocated and slack space, whereas a logical image captures only specified files or volumes. The choice affects what deleted and residual data remains available for analysis.

Question 15Digital Forensics

During triage of a suspected intrusion, an analyst finds a service binary in a temporary directory and a matching service registry entry. Which conclusion is best supported?

  1. The file was created by the Recycle Bin during cleanup
  2. The binary was likely installed as a persistent service and warrants deeper review Correct answer.
  3. The registry entry proves the binary is digitally signed
  4. The service is a standard Windows component and can be ignored

Explanation

A service whose binary resides in a temporary path and is registered as a service is consistent with persistence. The finding is a lead requiring corroboration through hashes, signatures, and timeline correlation, not an automatic verdict.

Question 16Digital Forensics

Which browser artifact best indicates that a user deliberately downloaded a file rather than merely visited a page?

  1. The downloads table entry with source URL and target path Correct answer.
  2. The history table entry for the page
  3. The cache entry for a script
  4. The cookie set by the site

Explanation

Browser download databases record the source URL, target save path, and often size and timing, directly evidencing a download action. History and cache entries show visits or fetched resources but not deliberate saving.

Question 17Digital Forensics

What is the main forensic value of the NTFS $UsnJrnl?

  1. It holds the volume's encryption keys
  2. It stores file content for deleted files
  3. It records change journal entries showing file creations, deletions, and renames Correct answer.
  4. It contains the user's saved passwords

Explanation

The USN change journal logs file-system changes such as creation, deletion, rename, and data modification with update sequence numbers. It helps reconstruct activity even when MFT timestamps are altered.

Question 18Digital Forensics

An analyst must determine whether a file was copied to a removable drive shortly before an incident. Which combination of artifacts is most useful?

  1. The hosts file and DNS cache
  2. Event log 4624 and the pagefile
  3. Prefetch and the Recycle Bin
  4. Shellbags and the USBSTOR key with mount point data Correct answer.

Explanation

Shellbags record folder views including removable volumes, while USBSTOR and mount point data tie a device serial to a drive letter and volume. Correlating them supports a claim about access to the removable drive.

Question 19Digital Forensics

Which principle requires that evidence be collected and handled so that it can withstand scrutiny in legal proceedings?

  1. Data minimization
  2. Separation of duties
  3. Forensic soundness Correct answer.
  4. Least privilege

Explanation

Forensic soundness means acquisition and analysis methods preserve integrity and are reproducible and documented, so findings can be defended. It underpins admissibility and the weight given to evidence.

Question 20Digital Forensics

A mobile device is powered on and locked at seizure. Which action best preserves the widest range of evidence while avoiding remote wipe?

  1. Power it off immediately and remove the battery
  2. Perform a factory reset to clear the lock
  3. Connect it to a charger and enable developer mode
  4. Isolate it from networks and consult device-specific acquisition options before acting Correct answer.

Explanation

Isolation prevents remote wipe and network-induced changes, and device-specific guidance determines whether logical, file-system, or physical acquisition is feasible. Premature power changes can destroy encryption keys or volatile evidence.

Question 21Digital Forensics

In network forensics, which source provides full packet payloads for later protocol reconstruction?

  1. NetFlow records
  2. Syslog messages
  3. DNS zone files
  4. A full packet capture (PCAP) Correct answer.

Explanation

A PCAP stores packet headers and payloads, allowing reconstruction of sessions and extraction of transferred content. Flow records and logs summarize activity without payload detail.

Question 22Digital Forensics

An analyst observes that a suspicious executable's compile timestamp is later than the file's creation timestamp on disk. What is the most appropriate next step?

  1. Delete the file to prevent further execution
  2. Corroborate with other artifacts such as prefetch, amcache, and event logs Correct answer.
  3. Assume the system clock was correct and ignore the anomaly
  4. Conclude the file is benign because timestamps conflict

Explanation

Timestamp inconsistencies are indicators, not proof, and should be corroborated with independent artifacts to establish execution and origin. Multiple sources reduce the risk of a mistaken conclusion.

Question 23Digital Forensics

What does the Windows event ID 4624 in the Security log represent?

  1. A successful account logon Correct answer.
  2. A system shutdown
  3. A failed account logon
  4. A service installation

Explanation

Event ID 4624 records a successful logon, including logon type and source, which helps establish access. Event ID 4625 records failed logons and is often correlated with brute-force attempts.

Question 24Digital Forensics

Which approach best supports defensible reporting of forensic findings?

  1. Omit contradictory evidence to strengthen the case
  2. Rely solely on automated tool output as the final conclusion
  3. Document tools, versions, methods, and limitations alongside findings Correct answer.
  4. State conclusions without describing methods to keep reports concise

Explanation

A defensible report documents methodology, tool versions, hashes, and limitations so another examiner can reproduce the work. It also addresses contradictory evidence, which strengthens credibility rather than weakening it.

Question 25Digital Forensics

A suspect volume uses full-disk encryption. During a lawful live examination the system is running and unlocked. Which action best preserves access to the decrypted content?

  1. Remove the drive and image it without capturing memory
  2. Capture a live memory image and logical copies of relevant volumes while unlocked Correct answer.
  3. Immediately power off the machine to freeze the state
  4. Reformat the volume to remove encryption

Explanation

While the volume is unlocked, decrypted content is accessible, so acquiring memory and logical data captures evidence that may be inaccessible after shutdown. Memory capture also may retain keys and mounted-volume context.

Question 26Digital Forensics

Which hashing property makes SHA-256 suitable for demonstrating that a disk image has not changed since acquisition?

  1. Reversibility, so the original data can be reconstructed from the digest
  2. Collision resistance, so two different images are extremely unlikely to produce the same digest Correct answer.
  3. Compression, so the digest reduces storage requirements for the image
  4. Encryption, so the digest conceals the content of the image

Explanation

A cryptographic hash produces a fixed-length digest that changes if even one bit of the input changes, which is why rehashing an image and comparing to the acquisition value demonstrates integrity. Collision resistance means it is computationally infeasible to find two distinct inputs with the same digest, so a matching digest is strong evidence the content is unchanged. Hashes are one-way and are not used to reconstruct or compress data.

Question 27Digital Forensics

An investigator documents that a seized laptop was powered on with its screen locked. Which action best preserves volatile evidence while maintaining a defensible record?

  1. Reboot the laptop into a forensic boot medium before capturing memory
  2. Immediately pull the power cord to freeze the state of the machine
  3. Photograph the screen, then capture RAM with a trusted tool before any shutdown, logging each step and hash Correct answer.
  4. Wait for the user to unlock the device so that files can be browsed normally

Explanation

Volatile data such as RAM and running processes is lost on shutdown, so it should be captured first using a validated tool while the state is documented by photographs and contemporaneous notes. Each action should be logged and the resulting memory image hashed to support later verification. Pulling power or rebooting destroys the very evidence being sought.

Question 28Digital Forensics

Which file system structure on an NTFS volume records the allocation state of every cluster and is essential when interpreting unallocated space?

  1. The $Bitmap metafile Correct answer.
  2. The $LogFile metafile
  3. The $Secure metafile
  4. The $ObjId metafile

Explanation

NTFS stores a bitmap in the $Bitmap metafile in which each bit represents one cluster, indicating whether that cluster is currently allocated. Forensic tools use it to determine which clusters are unallocated and therefore candidates for recovering deleted content. The other metafiles serve transaction logging, security descriptors, and object identifiers rather than allocation tracking.

Question 29Digital Forensics

A FAT32 directory entry for a deleted file has its first filename byte replaced with 0xE5. What does this indicate to the examiner?

  1. The entry is marked as deleted and the filename is partially lost, while cluster chain information may still be recoverable Correct answer.
  2. The volume has been converted to NTFS and the entry is now invalid
  3. The file was renamed by the user and remains fully allocated
  4. The entry has been converted into a long filename record

Explanation

In FAT file systems, 0xE5 in the first byte of a directory entry is the deletion marker; the first character of the short name is overwritten, so the name must be inferred or recovered from other sources. The starting cluster and file size fields often remain intact, allowing the cluster chain to be followed if the clusters have not been reused. This is a deletion indicator, not a rename or format conversion.

Question 30Digital Forensics

Which term describes the documented sequence of custody transfers for a piece of digital evidence from seizure through presentation?

  1. Order of volatility
  2. Write blocker
  3. Hash set
  4. Chain of custody Correct answer.

Explanation

The chain of custody is the chronological record of who handled the evidence, when, and for what purpose, and it supports authentication of the evidence in legal proceedings. Gaps or undocumented transfers can undermine admissibility. The other terms refer to collection priorities, hardware protection, and known-file filtering.

Question 31Digital Forensics

Which Linux log source most directly records successful and failed authentication attempts through the PAM subsystem?

  1. /var/log/kern.log
  2. /etc/fstab
  3. /var/log/auth.log or the journal entries for the auth facility Correct answer.
  4. /var/log/dpkg.log

Explanation

On Debian-derived systems, PAM and sshd authentication messages are written to /var/log/auth.log, while systemd-based distributions expose the same records through the journal filtered on the auth facility. These entries show accepted and failed logins with user, source, and timestamp. The other paths hold package operations, mount configuration, and kernel messages.

Question 32Digital Forensics

Which artifact most directly shows that a file was present in a Windows Recycle Bin before deletion?

  1. The $I metadata file paired with the $R content file in the Recycle Bin folder Correct answer.
  2. The System Restore point list
  3. The Windows Prefetch folder
  4. The pagefile.sys contents

Explanation

When a file is deleted to the Recycle Bin, Windows creates a $R file holding the original content and a matching $I file recording the original path, size, and deletion time. Examining the pair establishes what was deleted and from where. The other artifacts relate to memory paging, execution history, and restore points rather than recycle operations.

Question 33Digital Forensics

Which statement best describes the purpose of maintaining a working copy and a master copy of an acquired disk image?

  1. Analysis is performed on the working copy so the master image remains unaltered and can be rehashed for verification Correct answer.
  2. Both copies are written to the original evidence drive to save storage
  3. The working copy is deleted after each analysis session to reduce risk
  4. The master copy is used for analysis while the working copy is returned to the suspect

Explanation

Best practice is to preserve an untouched master image and conduct all examination on a verified working copy, rehashing the master when integrity needs to be demonstrated. This prevents accidental modification during analysis from contaminating the evidence. The original drive is never used as storage for copies, and deleting working copies destroys reproducibility.

Question 34Digital Forensics

An analyst must reconstruct which files were transferred over an SMB session captured in a packet capture. Which approach is most appropriate?

  1. Read only the Ethernet frame headers for MAC addresses
  2. Examine only DNS queries in the capture
  3. Extract the TCP stream and reassemble the SMB protocol fields to identify file operations Correct answer.
  4. Count the total number of packets in the capture

Explanation

Protocol reconstruction requires reassembling the TCP stream and parsing the application-layer SMB commands, which reveal create, read, write, and rename operations on named files. Frame headers and packet counts provide transport-level context but not file-level activity. DNS queries show name resolution rather than file transfer content.

Question 35Digital Forensics

A Windows event log shows event ID 4625 repeatedly for one account from many source addresses. What does this most likely indicate?

  1. Creation of a new user account
  2. Successful interactive logon by the account owner
  3. Repeated failed logon attempts consistent with password guessing Correct answer.
  4. A change to the account's group membership

Explanation

Event ID 4625 records a failed logon attempt, and a burst of these events against a single account from multiple sources is characteristic of brute-force or password-spraying activity. The logon type and source workstation fields help distinguish network from interactive attempts. Successful logons, group changes, and account creation use different event IDs.

Question 36Digital Forensics

An examiner needs to determine the time zone context of timestamps recorded in a Windows event log. Which fact should guide interpretation?

  1. Event log timestamps are stored only as Unix epoch seconds
  2. Event log timestamps are stored in local time with no offset information
  3. Event log timestamps are stored in UTC and rendered in the viewer according to the system's configured time zone Correct answer.
  4. Event log timestamps are generated by the display driver at render time

Explanation

Windows event records store time in UTC, and the Event Viewer converts them for display using the time zone setting of the machine viewing the log. An examiner must therefore establish the source system's time zone and any offset to correlate events with other artifacts. Treating stored values as local time without checking the offset produces timeline errors.

Question 37Digital Forensics

A memory image from a Windows host contains an established TCP connection to an unfamiliar external address that does not appear in current netstat output on the live machine. What is the best interpretation?

  1. The connection may have existed at capture time and closed afterward, so the memory artifact records a historical state Correct answer.
  2. The external address must be a loopback alias
  3. The connection was created by the forensic acquisition tool itself
  4. The memory image is necessarily corrupted because live output disagrees

Explanation

A memory image is a snapshot, so network structures reflect the moment of capture and can differ from later live queries as connections close or time out. The discrepancy is expected and the memory artifact should be correlated with firewall, proxy, and packet capture records. It does not by itself indicate corruption or tool-generated traffic.

Question 38Digital Forensics

During examination of an Android device, an analyst locates a SQLite database containing message threads. Which step is most important before querying it?

  1. Work on a copy of the database and account for write-ahead log and rollback journal files that may hold recent records Correct answer.
  2. Open the original database directly in a viewer to allow automatic repair
  3. Delete the journal files so the database opens cleanly
  4. Convert the database to CSV before recording its hash

Explanation

Mobile application databases often use write-ahead logging, so recent records may reside in the -wal or -journal companion files and be missing if only the main file is examined. Analysis should be performed on a copy so the original and its companion files remain unaltered for verification. Deleting journals destroys evidence, and hashing should precede any conversion.

Question 39Digital Forensics

An analyst finds that a user account's NTFS profile path was created before the account's stated start date in HR records. What is the most defensible next step?

  1. Conclude immediately that HR records were falsified
  2. Discard the profile timestamp as unreliable by definition
  3. Correlate profile creation with account creation events and other artifacts to determine whether the profile was pre-staged or the HR date is inaccurate Correct answer.
  4. Report the profile path as proof of unauthorized access

Explanation

A single timestamp conflict has multiple explanations, including pre-staged profiles, restored systems, or inaccurate administrative records, so the examiner should corroborate with account management events, logon history, and file system metadata. Conclusions should rest on convergent evidence rather than one artifact. Declaring falsification or unauthorized access from a lone timestamp overstates what the data supports.

Question 40Digital Forensics

Which artifact would best help determine the original filename of a file recovered by carving from unallocated space?

  1. The volume serial number alone
  2. File system metadata remnants such as a residual directory entry or MFT record referencing the clusters Correct answer.
  3. The partition table entry for the volume
  4. The file's internal creation application version string

Explanation

Carving reconstructs content from headers and footers but typically loses the name because directory metadata is not part of the carved data. Residual metadata such as an unallocated MFT record or FAT directory entry that references the same clusters can restore the name and timestamps. Application strings and volume-level structures do not identify the original filename.

Question 41Digital Forensics

An investigator must show that a specific document was opened on a workstation, not merely stored there. Which evidence combination is strongest?

  1. Recent-items or jump list entry for the document plus a link file recording its path and volume Correct answer.
  2. The file's extension appearing in a known-file hash set
  3. The document's presence in a synced cloud folder
  4. The workstation's installed application list

Explanation

Shell artifacts such as jump lists and shortcut files are created when a user opens a document and record the target path and volume information, providing evidence of user interaction rather than mere storage. Correlating both artifacts strengthens the conclusion. Presence in a synced folder or an installed application list shows availability of software or data, not that the document was opened.

Question 42Digital Forensics

A packet capture shows DNS queries for a domain followed by TLS connections to an address not present in the DNS response. Which explanation is most consistent with the evidence?

  1. The capture is missing all packets from the host
  2. The DNS server is guaranteed to be compromised
  3. The TLS traffic must be encrypted DNS
  4. The host may be resolving the domain through another mechanism or connecting to a hard-coded endpoint independent of DNS Correct answer.

Explanation

A mismatch between resolved addresses and the destination actually contacted can arise from hard-coded endpoints, alternate resolution paths, or content delivery behavior, and should prompt correlation with host artifacts. The capture alone does not prove DNS server compromise or encrypted DNS, and the presence of TLS traffic shows packets from the host are being captured.

Question 43Digital Forensics

An examiner is asked to verify that a USB device's serial number in the registry matches a device seized from the suspect. Which consideration is most important for the conclusion?

  1. The registry records only the device class, never an identifier
  2. USB serial numbers are cryptographically bound to the device and cannot be cloned
  3. Serial numbers can be duplicated or absent on inexpensive devices, so corroboration with volume identifiers and connection timestamps is needed Correct answer.
  4. Registry device entries are written only at operating system installation

Explanation

Many USB devices report no unique serial number or report a duplicate value, so an identifier match alone is weak. Examiners should corroborate with volume GUIDs, volume serial numbers, and setupapi or event log connection times before attributing use to a specific physical device. Registry entries are written on connection, not only at installation, and identifiers are not cryptographically protected.

Question 44Digital Forensics

Which step best ensures that a forensic report's conclusions can be independently reproduced?

  1. Present findings without distinguishing observation from inference
  2. Summarize only the final conclusions and omit methodology
  3. Document tool versions, parameters, and intermediate results so another examiner can repeat each step Correct answer.
  4. Rely on a single proprietary tool without recording its settings

Explanation

Reproducibility requires that the report describe the tools, versions, settings, and intermediate artifacts used so a qualified third party can repeat the analysis and reach the same result. Clear separation of raw observations from interpretive conclusions further strengthens the report. Omitting methodology or tool settings makes independent verification impossible.

Question 45Digital Forensics

An analyst recovers a partially overwritten file from unallocated space. Which statement best characterizes the reliability of the recovered content?

  1. Recovered content is trustworthy only for the clusters that were not reused, and the extent of loss must be assessed Correct answer.
  2. Any recovered fragment proves the complete original file content
  3. The recovered fragment is admissible only if the file was encrypted
  4. Partial recovery is impossible once any cluster is reused

Explanation

When a deleted file's clusters are partially reallocated, only the untouched clusters retain original content, so the examiner must map which portions survived and describe the gaps. A fragment supports conclusions about that fragment, not the entire original file. Partial recovery is common, and encryption is unrelated to the reliability question.

Question 46Digital Forensics

A laptop's system clock is shown to have been set two hours behind actual time during an incident window. How should the examiner treat file timestamps from that period?

  1. Assume the offset was constant for the entire life of the system
  2. Use the timestamps unchanged because file systems always store UTC
  3. Discard all timestamps from the affected period as unusable
  4. Apply the documented offset when building the timeline and state the adjustment in the report Correct answer.

Explanation

When a clock skew is established from corroborating sources, timestamps can be normalized by applying the offset, provided the adjustment and its basis are documented. The offset may have changed over time, so it should be verified for the relevant window rather than assumed constant. Discarding the data or ignoring the skew both misrepresent the timeline.

Question 47Digital Forensics

An analyst finds that an attacker used timestomping to set a file's $STANDARD_INFORMATION timestamps to an earlier date. Which additional artifact is most useful for detecting the manipulation?

  1. The file's icon resource
  2. The volume's partition alignment
  3. The corresponding $FILE_NAME timestamps and USN journal records for the file Correct answer.
  4. The system's installed font list

Explanation

Tools that alter $STANDARD_INFORMATION timestamps commonly leave the $FILE_NAME attribute timestamps and USN journal change records inconsistent with the modified values. Comparing these sources reveals discrepancies that indicate manipulation. Icon resources, partition alignment, and font lists have no bearing on timestamp integrity.

Question 48Digital Forensics

A suspect system uses a volume with a journaling file system, and the analyst observes that metadata for a deleted file remains in the journal while the MFT record is reallocated. What is the most defensible interpretation?

  1. The journal cannot be used because it is always encrypted
  2. The journal is authoritative over the live file system for current state
  3. The journal entry proves the file's content is fully recoverable
  4. The journal preserves a historical record of metadata changes that may describe the file even after its live record was reused Correct answer.

Explanation

Journaling records describe metadata transactions over time, so they can retain evidence of a file's earlier existence and attributes after the live record has been reused. They do not preserve file content, and for current state the live structures remain authoritative. Journal encryption is not a general property that would preclude examination.

Question 49Digital Forensics

An examiner must attribute activity on a shared workstation to one of several users. Which evidence strategy is most defensible?

  1. Assume the workstation owner performed all observed actions
  2. Attribute activity based on which user profile folder is largest
  3. Correlate per-user profile artifacts, logon session identifiers, and credential-specific activity to build a convergent attribution Correct answer.
  4. Attribute all activity to the account that last logged on

Explanation

On shared systems, account use does not equal physical user identity, so attribution requires convergent evidence such as per-user shell artifacts, logon session identifiers tied to processes, and credential use patterns. Single indicators such as last logon or profile size are weak and easily mislead. Assuming the owner acted ignores the possibility of shared or stolen credentials.

Question 50Digital Forensics

An analyst observes that an application's log records events with monotonically increasing sequence numbers but timestamps that jump backward. Which conclusion is best supported?

  1. The sequence numbers indicate event order, so the timestamp anomaly likely reflects a clock adjustment rather than reordered events Correct answer.
  2. The log file has been reordered by the operating system during write
  3. The sequence numbers must be fabricated
  4. The application generated duplicate events

Explanation

Monotonic sequence numbers provide an ordering independent of wall-clock time, so a backward timestamp jump with preserved ordering most likely reflects a system clock adjustment during the log period. The examiner should corroborate the adjustment with time service or event log records. Reordering, duplication, or fabrication are not supported when sequence numbers remain consistent.