CHFI Anti Forensics Detection Quiz

1. How can investigators detect timestamp manipulation?

By comparing file timestamps with filesystem journal entries

By analyzing system clock change events in logs

By examining NTFS $STANDARD_INFORMATION attributes

All of the above

2. What is the Chain of Custody's importance in anti-forensics defense?

It documents evidence handling to prevent tampering claims and ensure admissibility

It encrypts all digital evidence automatically

It prevents investigators from accessing the crime scene

It eliminates the need for forensic analysis

3. How can investigators recover data after anti-forensics attempts?

By analyzing magnetic residue on disk platters

By examining unallocated clusters and slack space

By using specialized recovery software

All of the above

4. What is the role of event logs in detecting anti-forensics?

Identifying when deletion tools or system utilities were executed

Recording user login and logoff events

Tracking network connections and file access

All of the above

5. Which Windows artifact helps detect evidence of file deletion anti-forensics?

$RECYCLE.BIN folder contents

Prefetch files

Shadow copies and volume snapshots

All of the above

6. What is a live response in forensic investigation?

Collecting volatile data from a running system before shutdown

Responding to incidents in real-time with automated alerts

Creating a physical copy of the entire hard drive

Monitoring network traffic continuously

7. How does full disk encryption serve as anti-forensics?

It prevents unauthorized access to data without the encryption key

It automatically deletes files after 30 days

It disables all forensic software

It creates multiple backup copies

8. What is the significance of unallocated space in forensic analysis?

It contains deleted files that anti-forensics attempts may not fully erase

It stores backup copies of all user data

It is inaccessible to forensic tools

It contains only system temporary files

9. Which memory forensics technique can detect anti-forensics tools?

Analyzing running processes and loaded DLLs

Examining registry hives in RAM

Reviewing network sockets and connections

All of the above

10. What is a Secure Boot attack in anti-forensics context?

Modifying bootloader code to hide evidence or disable forensic tools

Installing a firewall before system startup

Enabling BIOS password protection

Creating multiple user accounts

11. What is the primary goal of anti-forensics?

To prevent digital investigations from uncovering evidence

To enhance forensic analysis speed

To improve data backup procedures

To strengthen network security protocols

12. What does steganography do in the context of anti-forensics?

Hides data within other files or media

Deletes files permanently

Compresses large files

Encrypts network traffic

13. Which tool is commonly used to overwrite free space on a disk?

Wireshark

Eraser or CCleaner

Autopsy

FTK Imager

14. What is a rootkit's role in anti-forensics?

To hide unauthorized access and mask malicious activity

To accelerate system performance

To improve firewall effectiveness

To encrypt user files automatically

15. How does clearing browser history function as anti-forensics?

It permanently removes all browsing evidence from the system

Residual data may remain in cache, cookies, and temporary files

It encrypts all internet activity logs

It blocks forensic tool access to the hard drive

16. What is timeline analysis in forensic investigation?

Creating a chronological sequence of events based on file metadata

Analyzing network traffic patterns over time

Monitoring real-time system activity

Reviewing historical backup records

17. Which file system artifact can reveal evidence of anti-forensics attempts?

Master File Table (MFT)

Journal logs

Slack space data

All of the above

18. How can forensic investigators detect anti-forensics activity?

By analyzing file system metadata and timestamps

By searching for remnants of deletion tools

By examining system logs for suspicious patterns

All of the above

19. What does DBAN stand for in the context of data destruction?

Data Block Access Network

Darik's Boot And Nuke

Digital Backup And Normalize

Data Breach Alert Notification

20. Which of the following is a common anti-forensics technique?

Secure file deletion

Log file manipulation

Memory wiping

All of the above

CHFI Anti Forensics Detection Quiz

1. How can investigators detect timestamp manipulation?

2.

What first name or nickname would you like us to use?

2. What is the Chain of Custody's importance in anti-forensics defense?

3. How can investigators recover data after anti-forensics attempts?

4. What is the role of event logs in detecting anti-forensics?

5. Which Windows artifact helps detect evidence of file deletion anti-forensics?

6. What is a live response in forensic investigation?

7. How does full disk encryption serve as anti-forensics?

8. What is the significance of unallocated space in forensic analysis?

9. Which memory forensics technique can detect anti-forensics tools?

10. What is a Secure Boot attack in anti-forensics context?

11. What is the primary goal of anti-forensics?

12. What does steganography do in the context of anti-forensics?

13. Which tool is commonly used to overwrite free space on a disk?

14. What is a rootkit's role in anti-forensics?

15. How does clearing browser history function as anti-forensics?

16. What is timeline analysis in forensic investigation?

17. Which file system artifact can reveal evidence of anti-forensics attempts?

18. How can forensic investigators detect anti-forensics activity?

19. What does DBAN stand for in the context of data destruction?

20. Which of the following is a common anti-forensics technique?