"In exceptional circumstances, where a person finds it necessary to access original data held on a computer or on storage media, that person must be competent to do so and be able to explain his/her actions and the impact of those actions on the evidence, in the court." Which ACPO principle states this?

On NTFS file system, which of the following tools can a forensic investigator use in order to identify timestomping of evidence files?

Matthew needs to analyze a suspicious MS Office document via static analysis on an Ubuntu-based forensic machine to determine type, encryption, and presence of flash objects/VBA macros. Which python-based script should he run to get relevant information?

Before accessing digital evidence from victims, witnesses, or suspects, on their electronic devices, what should the investigator do first to respect legal privacy requirements?

During a forensic investigation, a large number of files were collected. The investigator begins to identify attributes such as "author name," "organization name," "network name," or supporting data meant for owner's identification. Which term describes these attributes?

A forensic specialist inspects an active computer's RAM, cache, and DLLs to check for incident signatures. Identify the data acquisition method employed in this scenario.

When analyzing logs, device clocks must be synchronized. Which protocol helps in synchronizing these clocks?

What happens to the header of the file once it is deleted from the Windows OS file systems?

A file requires 10 KB space on a hard disk partition. An entire cluster of 32 KB has been allocated for this file. The remaining, unused space of 22 KB on this cluster will be identified as __________.

Which layer in the IoT architecture is comprised of hardware parts such as sensors, RFID tags, and devices that play an important role in data collection?

Which of the following tools will allow a forensic investigator to acquire the memory dump of a suspect machine so that it may be investigated on a forensic workstation to collect evidentiary data like processes and Tor browser artifacts?

"No action taken by law enforcement agencies or their agents should change data held on a computer or storage media which may subsequently be relied upon in court" - this principle is advocated by which of the following?

Cloud forensic investigations impose challenges related to multi-jurisdiction and multi-tenancy aspects. To have a better understanding of the roles and responsibilities between the cloud service provider (CSP) and the client, which document should the forensic investigator review?

For the purpose of preserving the evidentiary chain of custody, which of the following labels is not appropriate?

During an investigation, the first responders stored mobile devices in specific containers to provide network isolation. All the following are examples of such pieces of equipment, except for:

What is the extension used by Windows OS for shortcut files present on the machine?

Consider a scenario where the perpetrator of a dark web crime has uninstalled Tor browser from their computer after committing the crime. The computer has been seized by law enforcement so they can investigate it for artifacts of Tor browser usage. Which of the following should the investigators examine to establish the use of Tor browser on the suspect machine?

Harry has collected a suspicious executable file from an infected system and seeks to reverse its machine code to instructions written in assembly language. Which tool should he use for this purpose?

Maria has executed a suspicious executable file in a controlled environment and wants to see if the file adds/modifies any registry value after execution via Windows Event Viewer. Which of the following event ID should she look for in this scenario?

Edgar is part of the FBI's forensic media and malware analysis team; he is analyzing a current malware and is conducting a thorough examination of the suspect system, network, and other connected devices. Edgar's approach is to execute the malware code to know how it interacts with the host system and its impacts on it. He is also using a virtual machine and a sandbox environment. What type of malware analysis is Edgar performing?

An investigator is examining a file to identify any potentially malicious content. To avoid code execution and still be able to uncover hidden indicators of compromise (IOC), which type of examination should the investigator perform:

Rule 1002 of Federal Rules of Evidence (US) talks about _______________.

Which of the following is the most effective tool for acquiring volatile data from a Windows-based system?

Jacob, a cybercrime investigator, joined a forensics team to participate in a criminal case involving digital evidence. After the investigator collected all the evidence and presents it to the court, the judge dropped the case and the defense attorney pressed charges against Jacob and the rest of the forensics team for unlawful search and seizure. What forensics privacy issue was not addressed prior to collecting the evidence?

This is a statement, other than one made by the declarant while testifying at the trial or hearing, offered in evidence to prove the truth of the matter asserted. Which among the following is suitable for the above statement?

Jack is reviewing file headers to verify the file format and hopefully find more information of the file. After a careful review of the data chunks through a hex editor; Jack finds the binary value 0xffd8ff. Based on the above information, what type of format is the file/image saved as?

Which among the following acts has been passed by the U.S. Congress to protect investors from the possibility of fraudulent accounting activities by corporations?

Simona has written a regular expression for the detection of web application-specific attack attempt that reads as (/((%3C)|(\(%2F)) V)*[a-z0-9%]+((%3E)|>)/ix. Which of the following does the part ((%3E)|>) look for?

Web browsers can store relevant information from user activities. Forensic investigators may retrieve files, lists, access history, cookies, among other digital footprints. Which tool can contribute to this task?

Which of the following statements is true with respect to SSDs (solid-state drives)?

When installed on a Windows machine, which port does the Tor browser use to establish a network connection via Tor nodes?

What command-line tool enables forensic investigator to establish communication between an Android device and a forensic workstation in order to perform data acquisition from the device?

In forensics __________ are used to view stored or deleted data from both files and disk sectors.

Place the following in order of volatility from most volatile to the least volatile.

A clothing company has recently deployed a website on its latest product line to increase its conversion rate and base of customers. Andrew, the network administrator recently appointed by the company, has been assigned with the task of protecting the website from intrusion and vulnerabilities. Which of the following tool should Andrew consider deploying in this scenario?

Adam is thinking of establishing a hospital in the US and approaches John, a software developer to build a site and host it for him on one of the servers, which would be used to store patient health records. He has learned from his legal advisors that he needs to have the server's log data reviewed and managed according to certain standards and regulations. Which of the following regulations are the legal advisors referring to?

A computer forensics investigator or forensic analyst is a specially trained professional who works with law enforcement as well as private businesses to retrieve information from computers and other types of data storage devices. For this, the analyst should have an excellent working knowledge of all aspects of the computer. Which of the following is not a duty of the analyst during a criminal investigation?

Jeff is a forensics investigator for a government agency's cyber security office. Jeff is tasked with acquiring a memory dump of a Windows 10 computer that was involved in a DDoS attack on the government agency's web application. Jeff is onsite to collect the memory. What tool could Jeff use?

ISO/IEC 17025 is an accreditation for which of the following:

Brian analyzes malware in an isolated virtual environment with separated virtual networks and no Internet or intranet connectivity. He runs the executable to observe its behavior. What type of analysis did Brian perform?

____________ allows a forensic investigator to identify the missing links during investigation.

An investigator seized a notebook with Microsoft Windows. Which type of file systems would support investigating the data size and structure on the device?

A SIM card shows ICCID 8944245252001451548. What do the first four digits (89 and 44) in the ICCID represent?

Frank needs to back up OS disks of two Azure VMs storing business‑critical data. Which type of Azure blob storage can he use for this purpose?

Which Windows event log records events related to device drivers and hardware changes?

Which application allows a forensic investigator to track user login sessions and transactions on an MS SQL Server?

Which method of mobile device data acquisition captures all data present on the device, including deleted data and access to unallocated space?

Which forensic tool allows an investigator to detect and extract hidden streams on an NTFS drive?

According to RFC 3227, which item is considered the most volatile on a typical system?

In Java on Android, which process enables low memory use and fast start-up by avoiding multiple Dalvik VM instances?

Which IoT attack uses many forged identities to create an illusion of traffic congestion that disrupts communication between nodes and networks?

Data density of a disk drive is calculated using which set of measures?

On a Windows XP system, where is the Recycle Bin located?

To copy an OS disk snapshot of a compromised VM to a storage account in a different Azure region, which tool should be used?

Which iOS architecture layer provides frameworks for iOS app development?

A forensic analyst reviews web application logs showing database errors after crafted inputs. What attack type was performed?

Which tool can extract passwords and hashes from SAM and System files to obtain a list of users?

When analyzing RAM with the Volatility Framework, which plugin identifies hidden processes or injected code/DLLs in a memory dump?

Packers can be used in anti-forensics to hinder analysis of malware or binaries. Which statement best explains their role?

Which set of anti-forensic tools/techniques allows a program to compress and/or encrypt an executable file to hide attack tools from being detected by reverse-engineering or scanning?

A cybercriminal is attempting to remove evidence from a Windows computer. He deletes the file evidence1.doc, sending it to Windows Recycle Bin. The cybercriminal then empties the Recycle Bin. After having been removed from the Recycle Bin, what will happen to the data?

You are the incident response manager at a regional bank. While performing routine auditing of web application logs, you find several attempted login submissions that contain the following strings: What kind of attack has occurred?

Which of the following statements pertaining to First Response is true?

Storage location of Recycle Bin for NTFS file systems (Windows Vista and later) is located at:

Which of the following attacks refers to unintentional download of malicious software via the Internet? Here, an attacker exploits flaws in browser software to install malware merely by the user visiting the malicious website.

Which of the following directory contains the binary files or executables required for system maintenance and administrative tasks on a Linux system?

The information security manager at a national legal firm has received several alerts from the intrusion detection system that a known attack signature was detected against the organization's file server. What should the information security manager do first?

An investigator needs to perform data acquisition from a storage media without altering its contents to maintain the integrity of the content. The approach adopted by the investigator relies upon the capacity of enabling read-only access to the storage media. Which tool should the investigator integrate into his/her procedures to accomplish this task?

Chloe is a forensic examiner who is currently cracking hashed passwords for a crucial mission and hopefully solve the case. She is using a lookup table used for recovering a plain text password from cipher text; it contains word list and brute-force list along with their computed hash values. Chloe is also using a graphical generator that supports SHA1. a. What password technique is being used? b. What tool is Chloe using?

You are a forensic investigator who is analyzing a hard drive that was recently collected as evidence. You have been unsuccessful at locating any meaningful evidence within the file system and suspect a drive wiping utility may have been used. You have reviewed the keys within the software hive of the Windows registry and did not find any drive wiping utilities. How can you verify that drive wiping software was used on the hard drive?

Which law sets rules for commercial email, establishes requirements for commercial messages, gives recipients the right to opt out, and spells out tough penalties for violations?

To understand the impact of a malicious program after the booting process and gather recent information from the disk partition, an investigator should evaluate the content of the:

An investigator uploads a suspicious executable to VirusTotal to confirm whether the file is malicious, provide information about its functionality, and produce simple network signatures. What type of malware analysis was performed?

Debbie executed a search warrant to seize digital devices used for downloading illicit images. She seized all devices except a digital camera. Why did she not collect the digital camera?

A Cisco firewall log shows: "%ASA-1-106021: Deny ICMP reverse path check from 10.0.0.44 to 10.0.0.33 on interface outside." What does "%ASA-1-106021" denote?

You are an information security analyst at a large pharmaceutical company. While performing a routine review of audit logs, you have noticed a significant amount of egress traffic to various IP addresses on destination port 22 during off-peak hours. You researched some of the IP addresses and found that many of them are in Eastern Europe. What is the most likely cause of this traffic? A. The organization's primary internal DNS server has been compromised and is performing DNS zone transfers to malicious external entities

Fred, a cybercrime investigator, finished storing a solid-state drive in a static resistant bag and filled out the chain of custody form. Two days later, John grabbed the solid-state drive and created a clone of it (with write blockers enabled) in order to investigate the drive. He did not document the chain of custody though. When John was finished, he put the solid-state drive back in the static resistant bag and placed it back in the evidence locker. A day later, the court trial began and upon presenting the evidence and the supporting documents, the chief justice outright rejected them. Which of the following statements strongly supports the reason for rejecting the evidence?

The working of the Tor browser is based on which of the following concepts?

A breach resulted from a malware attack that evaded detection and compromised the machine memory without installing any software or accessing the hard drive. What technique did the adversaries use to deliver the attack?

Sally accessed the computer system that holds trade secrets of the company where she is employed. She knows she accessed it without authorization and all access (authorized and unauthorized) to this computer is monitored. To cover her tracks, Sally deleted the log entries on this computer. What among the following best describes her action?

Which of the following is considered as the starting point of a database and stores user data and database objects in an MS SQL server?

Fill in the missing Master Boot Record component. 1. Master boot code 2. Partition table 3. __________

"To ensure that the digital evidence is collected, preserved, examined, or transferred in a manner safeguarding the accuracy and reliability of the evidence, law enforcement, and forensics organizations must establish and maintain an effective quality system" is a principle established by:

Recently, an internal web app that a government agency utilizes has become unresponsive. Betty, a network engineer for the government agency, has been tasked to determine the cause of the web application's unresponsiveness. Betty launches Wireshark and begins capturing the traffic on the local network. While analyzing the results, Betty noticed that a syn flood attack was underway. How did Betty know a syn flood attack was occurring?

Steve received an email that seemed to have come from her bank. The mail has instructions for Steve to click on a link and provide information to avoid the suspension of her account. The link redirected her to a form asking for details such as name, phone number, date of birth,

Mark works for a government agency as a cyber-forensic investigator. He has been given the task of restoring data from a hard drive. The partition of the hard drive was deleted by a disgruntled employee in order to hide their nefarious actions. What tool should Mark use to restore the data?

An EC2 instance storing critical data of a company got infected with malware. The forensics team took the EBS volume snapshot of the affected instance to perform further analysis and collected other data of evidentiary value. What should be their next step?

A security analyst identifies an influx of network traffic from an IoT HVAC system in a multinational corporation. The corporation is concerned about a possible HVAC attack. What should the security analyst prioritize to mitigate this potential threat?

A digital forensics investigator performs a browser history analysis after a suspected breach. The investigator deals with three web browsers: Mozilla Firefox, Google Chrome, and Microsoft Edge. The suspect was using Windows. The investigator must locate the cache, cookies, and history for all three browsers. What are the correct locations?

A Computer Hacking Forensic Investigator (CHFI) is examining a compromised Macintosh computer. The system was found to be missing the pre-linked kernel at /System/Library/Caches/com.apple.kernelcaches. What is the next step that the Macintosh boot process will take to load the operating system in such a scenario?

An experienced forensic investigator, Chris, is tasked with preparing a testbed for malware analysis. Given the complexity of the malware samples, which are mostly compatible with Windows binary executables, Chris must take meticulous precautions to ensure the integrity of the lab environment. Which of the following procedures would Chris NOT be likely to follow in preparing the testbed for malware analysis?

A forensic investigator is analyzing a smartphone to gather crucial evidence. To fully understand the device's working and data flow, he needs to comprehend the various mobile architectural layers. While examining the device's frequency conversion, the investigator focuses on which of the following hardware components?

As a Computer Hacking Forensic Investigator, you are analysing a system with a UEFI boot process underway. You have reached the Boot Device Selection phase, and you notice that the system is attempting to load MBR boot code into memory. What can you infer from this?

As a forensic investigator, you are investigating a suspected cyberattack that led to the system crash of a Windows 10 computer. You obtained a memory dump file and intend to utilize Microsoft's DumpChk tool for a quick analysis. However, you are interested in isolating a particular process that you suspect is responsible for the crash, rather than inspecting the whole memory dump file. Based on the given details and your knowledge of Windows memory analysis, which of the following would be the most efficient approach?As a forensic investigator, you are investigating a suspected cyberattack that led to the system crash of a Windows 10 computer. You obtained a memory dump file and intend to utilize Microsoft's DumpChk tool for a quick analysis. However, you are interested in isolating a particular process that you suspect is responsible for the crash, rather than inspecting the whole memory dump file. Based on the given details and your knowledge of Windows memory analysis, which of the following would be the most efficient approach?

Someone in the field of forensic investigation is looking at an Apache access log. They're searching for any evidence of a command injection attack. During this process, they find a log entry where the IP address "10.0.0.8" placed a GET request using the command ip=127.0.0.1;ls+/var/www/html. Judging by this data, what might be the individual’s objective behind this attack?

In an ongoing investigation, a computer forensics investigator encounters a suspicious file believed to be packed using a password-protected program packer. The investigator possesses both the knowledge of the packing tool used and the necessary unpacking tool. What critical step should the investigator consider before analyzing the packed file?In an ongoing investigation, a computer forensics investigator encounters a suspicious file believed to be packed using a password-protected program packer. The investigator possesses both the knowledge of the packing tool used and the necessary unpacking tool. What critical step should the investigator consider before analyzing the packed file?In an ongoing investigation, a computer forensics investigator encounters a suspicious file believed to be packed using a password-protected program packer. The investigator possesses both the knowledge of the packing tool used and the necessary unpacking tool. What critical step should the investigator consider before analyzing the packed file?In an ongoing investigation, a computer forensics investigator encounters a suspicious file believed to be packed using a password-protected program packer. The investigator possesses both the knowledge of the packing tool used and the necessary unpacking tool. What critical step should the investigator consider before analyzing the packed file?

During an ongoing cybercrime investigation involving a significant amount of encrypted communication, a Computer Hacking Forensic Investigator (CHFI) believes the suspect's computer holds crucial evidence. However, there's a high chance that the suspect could destroy the evidence before obtaining a warrant. Which action is legally permissible in this circumstance according to the US courts?