Computer Hacking Forensic Investigator (v10) Free Sample Questions

The linux_check_syscall plugin is specifically designed to check the system call table for hooks, which is a common technique used by rootkits and fileless malware to intercept and manipulate system functions. While linux_pslist shows processes and linux_lsmod lists loaded modules, linux_check_syscall directly addresses the suspected manipulation of system calls, making it the most effective initial step. linux_check_creds is used for checking process credentials for signs of privilege escalation.

In the Electronic Discovery Reference Model (EDRM), the 'Processing' stage involves reducing the volume of electronically stored information (ESI) and converting it into forms more suitable for review and analysis. Activities like keyword searching, filtering by date, and removing duplicate files (de-duplication) are core to this stage. 'Collection' is the acquisition of data, 'Review' is the analysis of the processed data for relevance, and 'Identification' is locating potential sources of ESI.

On an NTFS file system, a file has two main sets of timestamps stored in the Master File Table (MFT): one in the $STANDARD_INFORMATION attribute and another in the $FILE_NAME attribute. Many user-level tools, including touch, only modify the timestamps in the $STANDARD_INFORMATION attribute. Forensic tools can compare these timestamps against those in the $FILE_NAME attribute, which are not as easily modified. A mismatch between these two sets of timestamps is a strong indicator of timestomping. Inode metadata serves a similar purpose on ext4, but the MFT attributes are specific to NTFS.

The principle of Data Minimization (Article 5(1)(c) of GDPR) dictates that personal data collected must be adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed. In a forensic investigation, this means the investigator must make a concerted effort to only acquire data strictly relevant to the case, rather than collecting entire hard drives indiscriminately. Purpose Limitation refers to using the data only for the specified purpose, and Storage Limitation refers to not keeping it longer than necessary.

Freeblocks are pages within the SQLite database file that were previously allocated to a table but are now unused. When records are deleted, the pages they occupied are often marked as freeblocks but not immediately overwritten, making them a prime location for recovering deleted data.

The Write-Ahead Log (WAL) is a mechanism used by SQLite to implement atomic transactions. It stores changes to the database before they are committed to the main database file. The WAL file can contain copies of pages that have since been changed or deleted in the main file, providing another valuable source for data recovery.

Hardware write blockers are physically placed between the evidence drive and the forensic workstation. They intercept and block any write commands at the hardware level, regardless of the operating system or software running on the workstation. This independence prevents accidental writes from OS-level processes (like automounting or indexing), which a software blocker running within that same OS might not be able to prevent, making hardware blockers more reliable and forensically sound.

RAID 5 uses distributed parity, which allows it to withstand the failure of a single drive. The data from the failed drive can be rebuilt using the parity information from the remaining drives. However, if two drives fail simultaneously, there is not enough information (data and parity) to reconstruct the missing data from both failed drives, resulting in data loss.

The .onion top-level domain is used exclusively for hidden services accessible only through the Tor network. Ransomware and other malware frequently use Tor for C2 communications to anonymize the location of their servers and make them difficult to take down. Observing DNS queries for .onion domains indicates that a client on the network is attempting to resolve these addresses, likely through a Tor gateway or proxy, to establish a C2 channel.

Pillow (a fork of the Python Imaging Library, PIL) is the de facto standard library for image manipulation in Python. It has robust built-in capabilities for reading and parsing EXIF (Exchangeable Image File Format) data from various image formats like JPEG and TIFF. Scapy is for network packet manipulation, PyPDF2 is for PDF files, and Requests is for making HTTP requests.

The order of volatility dictates collecting evidence from most volatile to least volatile. Memory (RAM) is the most volatile evidence; its contents will be lost the moment the device loses power. Therefore, capturing a memory dump from the live device must be the first priority. Firmware on flash memory, network logs on a switch, and configuration files are all more persistent and should be collected after the RAM.