Digital Forensics Questions and Answers

Answer: D

File carving relies on header-footer signatures.

Carving recovers files from raw disk data without any file-system record. The tool scans unallocated space for the byte pattern that begins a file type and the pattern that ends it, and extracts everything between. A JPEG begins with FF D8 FF and ends with FF D9, so those signatures mark where each image starts and stops.

Registry keys record Windows configuration and user activity, not file contents. An MFT timestamp belongs to a file-system record, which is exactly what carving does without. TRIM commands work against recovery: they let an SSD wipe freed blocks.

Answer: D

The artifact is $UsnJrnl, the NTFS change journal.

The update sequence number journal (the $UsnJrnl file in the $Extend directory) logs every change to every file: creation, renaming, writes and deletion. Each record holds the file name, the MFT reference number, a timestamp and a reason code. Because these records live in a separate file, they survive after the file's own MFT entry has been reused and its name overwritten, so they can prove the file existed.

$Secure holds the volume's security descriptors, $Volume the volume name and version, and $AttrDef the definitions of attribute types. None of them records the history of individual files.

Answer: C

Decrypted full-disk encryption keys are most likely in the non-paged pool.

Full-disk encryption on Windows, such as BitLocker, is done by a kernel-mode driver that decrypts every sector as it is read. The driver keeps its key material in kernel memory allocated from the non-paged pool, which is never written out to the page file and is always resident in RAM. Memory forensics tools therefore recover such keys by scanning kernel pool allocations in a RAM image.

The smss.exe stack belongs to the Session Manager, a user-mode process that starts sessions and has no part in disk encryption. User-mode process heaps hold application data, not the keys of a kernel driver. Since one of the listed regions does fit, 'None of the above' is wrong.

Answer: B

The method is physical acquisition.

A physical acquisition makes a bit-stream image of the whole storage device, sector by sector, regardless of what the file system says is in use. It therefore captures file slack, unallocated clusters, deleted files and hidden areas, which is what an examiner needs for carving and recovering deleted evidence.

A logical acquisition copies only the files and folders the file system presents, so slack and unallocated space are lost. A sparse acquisition collects selected files plus some fragments of unallocated data, and a targeted acquisition collects only chosen items. Neither is a complete bit-level copy.

Answer: C

The PNG signature is 89 50 4E 47.

Every PNG file begins with the eight bytes 89 50 4E 47 0D 0A 1A 0A. After the non-ASCII byte 89, the next three bytes are the ASCII letters P N G. Forensic tools use such signatures (magic numbers) to identify files whatever their extension.

FF D8 FF E0 is the start of a JPEG file in JFIF format. 50 4B 03 04 spells 'PK' and marks a ZIP archive, which also covers DOCX, XLSX, JAR and APK files. So 'None of these' is wrong.

Answer: A

The main factor is TRIM operations and wear-leveling.

The question's 'SD' is flash storage (solid-state drives, and in the same way SD cards), which behaves very differently from a magnetic hard disk. On an HDD, a deleted file stays in place until overwritten, so it can be recovered. On flash, the TRIM command tells the drive which blocks are no longer in use, and the drive's own garbage collection erases them, often within moments and even while the device is write-blocked. Wear-leveling constantly remaps logical blocks to different physical cells, so data moves and old copies sit in areas the examiner cannot address.

Storage size is not inherently larger on flash, flash drives use MBR or GPT partition tables like hard disks, and encryption is optional, not always present.

Answer: A

The preferred method is live acquisition.

With full-disk encryption, the data on the disk is readable only while the system is running with the volume unlocked. If the machine is switched off and imaged in the usual way, the examiner gets only ciphertext and needs the password or recovery key. A live acquisition captures the decrypted data while it is accessible, together with the RAM contents, which may hold the encryption keys themselves.

Offline imaging (dead-box acquisition) is exactly the approach that loses access to encrypted data. Sparse and logical acquisitions only reduce what is collected; they do not address encryption, and they still have to be done while the system is live to be readable.

Answer: C

The most volatile is the CPU cache.

Evidence is collected in order of volatility, most short-lived first. RFC 3227, the standard guideline, puts CPU registers and cache at the top: their contents change in nanoseconds as the processor runs. Next come routing and ARP tables, the process table and main memory (RAM), then temporary file systems, disks, remote logs and archival media.

RAM is volatile too, but its contents last as long as the power and survive for seconds or more, so it comes after cache. An SSD is persistent storage, and network logs are stored records, both near the bottom of the order.

Answer: C

RS steganalysis identifies pixel relationship irregularities.

RS (Regular-Singular) steganalysis, introduced by Fridrich, Goljan and Du, detects LSB embedding in images. It divides the image into small groups of pixels, applies flipping functions to their least significant bits, and counts how many groups become more regular or more singular (smoother or noisier). In a natural image these counts follow a predictable relationship; LSB embedding disturbs it, and the size of the disturbance even estimates the length of the hidden message.

It analyses pixel values, so it does not look for hidden audio, and EXIF metadata is a separate forensic check. Since one option is correct, 'None of these' is wrong.

Answer: C

LSB embedding is substitution-based steganography.

In LSB steganography, the least significant bit of each pixel value is replaced with a bit of the secret message. Changing only the lowest bit alters each colour value by at most 1, which the eye cannot see. Because the technique works by substituting bits of the cover image directly in the spatial domain, it is classed as substitution (spatial-domain) steganography.

Transform-domain methods hide data in DCT or wavelet coefficients, as in JPEG steganography. Spread spectrum methods spread the message across the image like low-level noise. Distortion-based methods encode data as a deliberate change from the original cover, which the receiver needs in order to decode.