312-49v10 Sample Questions & Answers

Hardware write blockers are physically placed between the evidence drive and the forensic workstation. They intercept and block any write commands at the hardware level, regardless of the operating system or software running on the workstation. This independence prevents accidental writes from OS-level processes (like automounting or indexing), which a software blocker running within that same OS might not be able to prevent, making hardware blockers more reliable and forensically sound.

RAID 5 uses distributed parity, which allows it to withstand the failure of a single drive. The data from the failed drive can be rebuilt using the parity information from the remaining drives. However, if two drives fail simultaneously, there is not enough information (data and parity) to reconstruct the missing data from both failed drives, resulting in data loss.

The .onion top-level domain is used exclusively for hidden services accessible only through the Tor network. Ransomware and other malware frequently use Tor for C2 communications to anonymize the location of their servers and make them difficult to take down. Observing DNS queries for .onion domains indicates that a client on the network is attempting to resolve these addresses, likely through a Tor gateway or proxy, to establish a C2 channel.

Pillow (a fork of the Python Imaging Library, PIL) is the de facto standard library for image manipulation in Python. It has robust built-in capabilities for reading and parsing EXIF (Exchangeable Image File Format) data from various image formats like JPEG and TIFF. Scapy is for network packet manipulation, PyPDF2 is for PDF files, and Requests is for making HTTP requests.

The order of volatility dictates collecting evidence from most volatile to least volatile. Memory (RAM) is the most volatile evidence; its contents will be lost the moment the device loses power. Therefore, capturing a memory dump from the live device must be the first priority. Firmware on flash memory, network logs on a switch, and configuration files are all more persistent and should be collected after the RAM.

While Prefetch files and Amcache entries confirm execution, Shell Link (.LNK) files are created when a user interacts with a file (including executing it). Crucially, a .LNK file stores metadata about the target file, including its original full path. If the program was run from \\SERVER\share\program.exe, the .LNK file will contain this exact path, providing definitive evidence of execution from a network location. It also stores volume information of the host, such as the MAC address.

The first ACPO principle is the foundation of digital forensic evidence handling. It states that no action should alter the original data. If changes are necessary to access the data (e.g., changing a password), these actions must be performed on a forensic copy, and the process must be fully documented and explainable. The other options represent other ACPO principles (Principle 2, 3, and 4), but this is the first and most fundamental one.

mactime is a tool within The Sleuth Kit that creates a chronological timeline of file activity (Modified, Accessed, Changed, Birth times) based on metadata collected from the file system. It takes the output from tools like fls (which lists files) and formats it into a human-readable timeline, which is invaluable for reconstructing event sequences. istat displays metadata for a specific file/inode, and fsstat displays general file system details.

John the Ripper (JtR) is a powerful and popular password cracking tool. It includes helper utilities (like zip2john) that can extract the password hash from an encrypted ZIP file. The main JtR program can then run dictionary, brute-force, or hybrid attacks against this hash to recover the password. Hashcat is another powerful password cracker, but JtR is widely recognized for its direct support of various archive formats. Wireshark is for network analysis and Volatility is for memory analysis.

The correct forensic procedure is to first isolate the compromised instance to prevent further damage or evidence tampering (4). Next, you create a new EBS volume from the previously taken snapshot; this preserves the original snapshot as pristine evidence (1). Then, you attach this new volume to a trusted forensic analysis EC2 instance (2). Finally, you mount the volume on the workstation in read-only mode to prevent any modification during analysis (3).