Unit 3: Anti-Forensics Techniques and Windows Forensics - Practice Quiz

1 What is the primary goal of anti-forensics techniques?

2 When a file is deleted in Windows and moved to the Recycle Bin, what generally happens to the actual file data?

3 In modern Windows systems, which hidden folder stores Recycle Bin contents?

4 File carving primarily recovers files based on what?

5 File carving is especially useful when which of the following is missing or damaged?

6 Which attack tries every possible combination of characters to guess a password?

7 A dictionary attack cracks passwords by:

8 What is steganography?

9 How does steganography differ from encryption?

10 In NTFS, which feature can be misused to hide data attached to a normal file?

11 Trail obfuscation in anti-forensics aims to:

12 What is the purpose of artifact wiping?

13 Encryption protects data by:

14 What does a program packer typically do to an executable?

15 Which of the following is a good countermeasure against anti-forensics?

16 Which of the following is an example of volatile data?

17 The Windows Registry is best described as:

18 Which browser artifact stores small pieces of data used to track sessions and preferences?

19 What forensic information do LNK files (shortcuts) commonly reveal?

20 Windows Event Logs primarily record which type of information?

21 An investigator finds that a suspect ran a tool that overwrites file slack space and unallocated clusters with random data before shutdown. Which category of anti-forensics does this technique BEST represent?

22 On a Windows system, a user deletes a file to the Recycle Bin. Which file within the $Recycle.Bin folder stores the original path and deletion timestamp of that file?

23 An analyst recovers a JPEG from unallocated space by scanning for the byte sequence FF D8 FF at the start and FF D9 at the end. This recovery method is known as:

24 An investigator uses a precomputed table of hash values mapped to their plaintext passwords to reverse Windows LM hashes quickly. Which technique is being used?

25 During analysis, two visually identical images have significantly different file sizes and one shows abnormal statistical distribution in its least significant bits. What does this MOST likely indicate?

26 A suspect stores hidden data in an NTFS file such that it is invisible in directory listings and does not change the file's apparent size. Which NTFS feature was MOST likely abused?

27 An attacker modifies log timestamps and spoofs source IP addresses to mislead investigators about the origin and timing of an attack. This is an example of:

28 Which statement BEST distinguishes disk wiping from simple file deletion on a magnetic hard drive?

29 An investigator encounters a full-disk-encrypted volume and needs the plaintext. Which live-acquisition step gives the BEST chance of recovering the encryption key?

30 A malware sample shows very high entropy, few readable strings, and imports only LoadLibrary and GetProcAddress. What does this MOST strongly suggest?

31 Which practice is the MOST effective countermeasure against timestamp manipulation (timestomping) used by attackers?

32 Following the order of volatility during incident response, which of the following should be collected FIRST?

33 An analyst wants to determine which USB storage devices were connected to a Windows machine. Which registry key should be examined?

34 In a memory forensics investigation using Volatility, which plugin would you use to list the processes that were running at the time of capture?

35 An investigator needs to recover a user's Chrome browsing history including URLs and visit timestamps. Which artifact should be parsed?

36 Which Windows artifact provides evidence that a program was executed, including a run count and last execution time, even if the executable was later deleted?

37 An investigator wants to prove that a user browsed to a specific folder on a now-removed external drive using Windows Explorer. Which artifact is MOST appropriate?

38 A .lnk shortcut file is found referencing a document on a USB drive. Besides the target path, what additional forensic value do LNK files typically provide?

39 An analyst investigating failed and successful logons on a modern Windows system should focus on which event log and event IDs?

40 On modern Windows systems, in which format and location are event logs primarily stored?

41 On a Windows 10 system, a user deletes a file via the Recycle Bin. In the $Recycle.Bin\<SID> folder, an investigator finds a $I file and a $R file. Which statement most accurately describes the forensic value of these two files?

42 An analyst attempts to carve a JPEG from unallocated space but the recovered file is truncated and corrupt beyond the first few KB. The file header (\xFF\xD8) and footer (\xFF\xD9) are both present. What is the MOST likely explanation?

43 In NTFS, an attacker hides a malicious payload in an Alternate Data Stream (ADS) attached to a legitimate file. Which characteristic makes ADS-based hiding particularly evasive to casual inspection?

44 An investigator suspects LSB steganography in a set of bitmap images. Which statistical technique is MOST appropriate to detect the presence of hidden LSB-embedded data?

45 A suspect used a disk-wiping utility that performs a single-pass overwrite with zeros on a modern SSD. Why might forensic recovery of some data still be possible despite the wipe?

46 An examiner extracts NTLM hashes from a Windows SAM. Rather than brute-forcing, they authenticate to a remote service by passing the hash directly. What is this attack called, and what does it exploit?

47 During volatile memory analysis with Volatility, an analyst wants to identify processes hidden from the standard process list by Direct Kernel Object Manipulation (DKOM). Which approach is MOST effective?

48 An investigator finds a ShellBag entry referencing a folder path on a removable USB device that is no longer connected. What does this ShellBag artifact most reliably establish?

49 An analyst reviews Windows Security logs and finds Event ID 4624 (successful logon) with Logon Type 3 immediately followed by Type 10 from the same source. What scenario does this pattern most strongly suggest?

50 An examiner encounters a large file with uniformly high entropy (~7.99 bits/byte) and no recognizable header. Which conclusion is BEST supported before further testing?

51 A malware sample shows a very small .text section but a large section named UPX1 marked as writable and executable, with the entry point pointing into it. What does this indicate?

52 An attacker sets a compromised host's system clock backward before creating and modifying files, then restores it. During analysis, which cross-artifact inconsistency is MOST likely to expose this timestamp manipulation?

53 An investigator parses a Chromium History SQLite database and needs to convert a visits.visit_time value to a human-readable UTC timestamp. Which epoch and unit must be applied?

54 During live response on a running Windows server, an examiner must prioritize evidence collection according to the Order of Volatility (RFC 3227). Which sequence is correct from most to least volatile?

55 Which of the following BEST distinguishes 'data hiding' anti-forensics from 'artifact destruction' anti-forensics?

56 A Microsoft Word .docx file is examined. Which statement about its metadata structure is correct?

57 An organization wants to counter timestomping and log-tampering anti-forensics proactively. Which combination of countermeasures is MOST effective?

58 A .lnk (shortcut) file on the desktop points to a document opened from an external drive. Beyond the target path, which additional forensic detail can a well-formed LNK file typically provide?

59 An analyst examines the SYSTEM and SOFTWARE hives and wants to determine which USB storage devices were connected and their last-use timestamps. Which registry location is the PRIMARY source?

60 When recovering a deleted file on NTFS, why is examining the $MFT often more valuable than raw signature carving for recently deleted files?