Cyber Forensics MCQ 60 Tests With Answers (2026)

Incorrect·A: pstree

The `pstree` plugin displays processes in a hierarchical parent-child tree view, making it easier to spot anomalies such as a `cmd.exe` spawned by `iexplore.exe` (which could indicate a browser exploit). `pslist` lists processes linearly from the ActiveProcessLinks doubly-linked list. `pstree` also shows hidden/unlinked processes that might evade `pslist`.

Incorrect·B: It may indicate that the file's timestamps were manipulated (timestomping) using a tool that only updates $STANDARD_INFORMATION

Timestomping tools like Metasploit's `timestomp` and the Windows API `SetFileTime()` modify the $STANDARD_INFORMATION attribute (visible in Windows Explorer) but typically do not update the $FILE_NAME attribute (maintained by the NTFS kernel). A discrepancy between these two sets of timestamps is a strong indicator of deliberate timestamp manipulation.

Incorrect·B: A legal framework used by U.S. federal courts to evaluate whether expert testimony and scientific evidence is admissible based on reliability and relevance

The Daubert Standard (established in Daubert v. Merrell Dow Pharmaceuticals, 1993) requires federal judges to act as gatekeepers, assessing whether scientific expert testimony is based on sufficient facts, reliable methodology, and is relevant to the case. In digital forensics, methodology must be testable, peer-reviewed, have a known error rate, and be generally accepted — criteria forensic experts must satisfy.

Incorrect·A: UserAssist

UserAssist is a registry key under `HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist` that records GUI program execution — including the program name (ROT13-encoded), run count, and last execution time. It is valuable because it also records execution of programs that have since been deleted. Prefetch, Shimcache, and LNK files are also execution artifacts but are stored differently.

Incorrect·C: It provides a real-time feed of running processes to the Windows Event Log

Windows Prefetch files (in `C:\Windows\Prefetch\`, extension `.pf`) are created for each launched executable. They record the application path, the last 8 run times (on Windows 8+), number of times run, and files/directories referenced during startup. Investigators use them to prove program execution — including malware that has been removed after the fact.

Incorrect·D: Evidence is distributed across multiple geographic jurisdictions, access depends on service provider cooperation, and data may be co-mingled with other tenants' data

Cloud forensics presents unique challenges: data is physically located across multiple datacenters in different countries (raising jurisdictional issues), investigators depend on CSPs for access (which may require legal process such as subpoenas), multi-tenancy means evidence may be interleaved with other customers' data, and evidence is ephemeral (VMs can be terminated, logs may be overwritten rapidly).

Incorrect·A: Details of a successful user logon, including the account name, logon type, and source IP address

Windows Security Event ID 4624 ("An account was successfully logged on") records successful authentication events, including the target account name, domain, logon type (2=interactive, 3=network, 10=remote interactive/RDP), workstation name, and source IP address. It is one of the most important event IDs for investigating unauthorized access.

Incorrect·B: It is a transaction log that records metadata changes to the file system, helping investigators reconstruct file creation, deletion, and renaming events even after the MFT record has been reused

The NTFS $LogFile is a circular transaction journal that records file system metadata operations (file create, rename, delete, attribute changes) to support crash recovery. Forensically, tools like LogFileParser can extract historical file operations — even after MFT records have been reallocated — providing evidence of file activity that no longer appears in the current file system.

Incorrect·A: To prevent electrostatic discharge from damaging the device's circuit board during seizure

A Faraday bag blocks all electromagnetic signals from reaching or leaving the device. This prevents the suspect or a remote administrator from sending a remote wipe command (such as via MDM or Find My Device), stops new messages or app updates from altering the device state, and prevents location tracking. Isolating the device from networks is a standard first step in mobile forensics.

Incorrect·A: HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR and setupapi.dev.log

The `USBSTOR` registry key stores a record of every USB mass storage device that has been connected, keyed by device type, vendor, product name, and serial number. The `setupapi.dev.log` (or `setupapi.setup.log`) records the first connection time. Last connection time is found in the device's registry entry or Windows Event Log. Together, these artifacts prove a specific device was connected to a specific system.

Incorrect·C: The unused sectors at the end of a partition that fall outside the last cluster

File slack space consists of two components: RAM slack (the space from the end of the logical file to the end of the sector, padded with RAM contents in older systems) and drive slack (the remaining unused sectors up to the end of the last allocated cluster). File slack can contain fragments of previously deleted data and is a valuable source of evidence in forensic investigations.

Incorrect·A: An open-source graphical front-end for The Sleuth Kit (TSK) and other forensic tools, providing case management, file system analysis, keyword search, email parsing, and timeline generation

Autopsy is a free, open-source digital forensics platform that acts as a graphical front-end for The Sleuth Kit (TSK). It supports disk image analysis, file carving, hash filtering, keyword searching, timeline generation, web artifact extraction, registry parsing, and more. It is used by law enforcement and private examiners worldwide as a full-featured forensic case management tool.

Incorrect·A: A logical extraction uses the device's own operating system APIs to retrieve data (contacts, messages, apps, call logs), whereas a physical extraction is a bit-for-bit copy of the entire flash memory, including deleted and unallocated data

Logical extraction works through the device OS and standard interfaces (iTunes backup, ADB, vendor APIs), retrieving a structured view of active data. Physical extraction is a raw sector-by-sector copy of the flash memory chip, which contains deleted files, unallocated space, and app data not exposed through APIs. Physical is more complete but requires more sophisticated techniques (e.g., JTAG, chip-off, or advanced logical methods).

Incorrect·D: Windows Recycle Bin ($I/$R files)

Windows Shell Items — including LNK files (automatically created shortcuts in the Recent folder and Desktop for opened files) and ShellBags (registry keys recording folder navigation preferences stored even for remote or removable paths) — contain rich evidence of file and folder access. LNK files record the target path, MAC times of the target, volume serial number, and NetBIOS hostname. ShellBags in `USRCLASS.DAT` reveal folder access even if the folder was later deleted.

Incorrect·B: It is a persistent change journal that records detailed file system events (create, write, rename, delete, security change) with timestamps, allowing investigators to reconstruct file activity long after the events occurred

The $UsnJrnl ($Extend\$UsnJrnl) is a change journal that records every file system event with a USN (unique sequence number), timestamp, file reference, and reason code (renamed, deleted, data extended, etc.). Even after a file is deleted and its MFT record reused, the USN journal may still contain the deletion event. Tools like MFTECmd and KAPE can parse it.

Incorrect·B: IOCs are artifacts or patterns — such as malicious IP addresses, file hashes, registry keys, or domain names — that provide high-confidence evidence that a system has been breached

Indicators of Compromise (IOCs) are forensic artifacts observed on a network or OS that, with high confidence, indicate a security breach. They include known-bad file hashes, C2 IP addresses and domains, suspicious registry keys, unusual process names, and specific strings in memory or logs. Platforms like MISP and OpenIOC enable sharing and operationalizing IOCs across investigations.

Incorrect·A: To negotiate with ransomware operators for the decryption key

During the triage phase, the investigator rapidly assesses the situation to determine the scope of the incident, identify the most critical systems affected, prioritize evidence collection starting with the most volatile sources, and establish a preliminary timeline. This phase allows efficient resource allocation and ensures the most time-sensitive evidence is not lost.

Incorrect·C: A technique that correlates events from multiple sources — file system timestamps, Windows Event Logs, $UsnJrnl, prefetch files, registry hives, and browser history — onto a single chronological timeline to reconstruct attacker or user activity

Timeline analysis involves super-timeline creation — aggregating timestamps from diverse artifact sources (MFT, $UsnJrnl, Event Logs, prefetch, registry, browser history, LNK files, etc.) into a single chronological view. Tools like Plaso (log2timeline) automate this process, allowing investigators to correlate events across sources and reconstruct attacker activity with high precision.

Incorrect·B: VSS shadow copies may contain previous versions of deleted or encrypted files, registry hives, and event logs, giving investigators access to the system state at earlier points in time

Volume Shadow Copies (VSS) are point-in-time snapshots of the NTFS volume, created automatically by Windows (before updates, restore points, etc.). Forensically, they can contain previous versions of files before encryption (critical in ransomware investigations), earlier versions of registry hives, event logs, and other artifacts from before the attacker's activity. Tools like ShadowExplorer and Velociraptor can access shadow copies.

Incorrect·B: Dead-box forensics is analysis of a system after it has been powered off; its major limitation is the permanent loss of volatile evidence (RAM contents, active network connections, encryption keys) that existed only in memory

Dead-box forensics involves analyzing a system after it has been shut down, typically by imaging the hard drive and examining it offline. The critical limitation is that all volatile data — RAM contents (running processes, encryption keys, network state, malware in memory, passwords), active connections, and any data not written to persistent storage — is irretrievably lost at the moment of power-off.

Incorrect·C: malfind combined with pstree and cmdline to correlate the injected memory region with the parent process and command-line context

`malfind` scans for memory-resident code that has been injected (pages with PAGE_EXECUTE_READWRITE protection that contain MZ/PE headers) and identifies process hollowing indicators. Cross-referencing with `pstree` (to check the parent process legitimacy) and `cmdline` (to see if the command-line arguments are suspicious) provides the full context needed to confirm process hollowing rather than a false positive.

Incorrect·D: A threat actor used timestomping to backdate the file's SI timestamps to a time before the investigation period, attempting to make it appear to predate the OS installation

Timestomping is a common anti-forensics technique where attackers use tools (Metasploit's `timestomp`, PowerShell's `[System.IO.File]::SetCreationTime()`, or direct API calls) to set file timestamps to arbitrary values — sometimes before the OS was even installed. An $SI timestamp predating the OS installation is a hallmark indicator. The $FN attribute in the MFT (harder to modify) often reveals the true creation time.

Incorrect·A: Chip-off forensics

Chip-off forensics involves physically removing (desoldering) the NAND or eMMC flash memory chip from the device's PCB and reading its raw contents using a specialized chip reader. This technique bypasses all OS security controls, PIN/pattern locks, and encryption — but requires hardware expertise and risks damaging the chip. It is used when other methods are impossible (broken screen, locked device, damaged board).

Incorrect·D: The browser history, which always contains the phishing link that initiated the compromise

Reconstructing the initial access vector requires correlating multiple artifact sources. The $MFT and $UsnJrnl reveal the first malicious file dropped. Security Event IDs 4624/4625 identify authentication events, 4648 shows pass-the-hash/pass-the-ticket, and 4672 shows privilege escalation. PowerShell ScriptBlock logs capture malicious scripts. Browser history, email artifacts, and VPN logs may reveal the phishing campaign or exploitation, but prioritizing the earliest file system and authentication events gives the clearest picture.

Incorrect·C: It strongly suggests code injection: legitimate processes rarely allocate executable writable memory; such regions may contain injected shellcode, reflective DLL injection payloads, or process hollowing artifacts

Data Execution Prevention (DEP) means legitimate applications do not normally need memory that is simultaneously writable and executable. Memory regions flagged as PAGE_EXECUTE_READWRITE are a strong indicator of malicious activity — shellcode injection, reflective DLL loading (which writes and executes a PE in memory without touching disk), unpacking stubs, or process hollowing. This is one of the primary signals `malfind` reports.

Incorrect·C: The recovered database reflects only the committed transactions at the last WAL checkpoint; uncommitted or recent transactions that were only in the WAL are lost, potentially missing the most recent activity

SQLite uses Write-Ahead Logging (WAL mode) where changes are first written to a .wal file before being checkpointed (merged) into the main database. If only the main database file is recovered without the WAL, only checkpointed data is visible. Recent uncommitted changes — potentially including the most recent messages, app activity, or user records — may exist only in the lost WAL file, creating a gap in the evidence.

Incorrect·B: DNS tunneling — used to exfiltrate data or establish a C2 channel by encoding data in DNS query/response payloads

DNS tunneling encodes data (often base32/base64) into DNS query subdomains (e.g., `aGVsbG8....<attacker>.com`) and receives data in DNS responses (TXT, CNAME, or NULL records). It abuses the fact that DNS traffic is often permitted through firewalls. Tools like iodine, dnscat2, and DNSExfiltrator implement this technique. Indicators include high query volumes, unusually long subdomain strings, high entropy subdomain names, and TXT/NULL record responses.

Incorrect·C: When a file is deleted from a directory, its $FILE_NAME entry may persist in the $I30 slack space, revealing evidence of files that existed in the directory but that an attacker attempted to remove by deleting the file

$I30 is the index allocation attribute ($INDEX_ALLOCATION and $INDEX_ROOT) for NTFS directories, storing the directory's B-tree index of filenames. When files are deleted, their $FILE_NAME entries in the directory index may leave carve-able residue in the $I30 slack. Tools like INDXParse and MFTECmd can recover these ghost directory entries, revealing file existence even after deletion and MFT record reuse.

Incorrect·B: A fileless malware technique where base64-encoded payloads are decoded and executed entirely in memory, potentially bypassing signature-based antivirus detection

Base64-encoded commands decoded with `[System.Convert]::FromBase64String()` and executed with `Invoke-Expression` (or `iex`) is a classic fileless malware/LOLBins technique. The payload never touches disk in a recognizable form, potentially bypassing file-based AV. PowerShell ScriptBlock logging (Event ID 4104) captures the decoded content before execution — making it a critical forensic artifact for detecting this attack pattern.

Incorrect·C: When TRIM is enabled, the operating system notifies the SSD controller to zero out (or mark as erasable) the blocks belonging to deleted files, meaning forensic file carving tools may find only zeroed blocks in unallocated space instead of recoverable file remnants

On TRIM-enabled SSDs, when a file is deleted, the OS sends a TRIM command that tells the SSD controller the blocks are no longer needed. The controller zeroes or reclaims those blocks for wear leveling, often before new data is written. Unlike HDDs (where deleted file data persists in unallocated space until overwritten), TRIM-enabled SSDs may immediately destroy the recoverable data, making file carving far less effective.

Incorrect·C: To extract ghost directory entries — filename, file size, and MAC timestamps — from slack space in directory index records, revealing deleted files whose MFT records have been reused

When files are deleted, NTFS reuses MFT records, but the corresponding $FILE_NAME entries in parent directory $I30 B-tree index nodes can persist in the index slack. Parsing this slack with tools like MFTECmd or INDXParse extracts these orphaned entries, recovering file name, size, and full MACB timestamps — evidence that can reconstruct directory contents and timeline even after deletion.

Incorrect·B: The eMMC controller has performed wear leveling, and the uniform areas represent erased blocks — NAND flash erases in blocks and erased NAND reads as all 0xFF bytes, representing truly deleted data

NAND flash memory erases data at the block level, and after erasure, NAND cells read as all 0xFF (logic "1"). The eMMC/NAND controller performs wear leveling by spreading writes across blocks and erasing blocks that are no longer needed. Regions of uniform 0xFF bytes in a chip-off dump represent erased (truly deleted) NAND blocks where data is unrecoverable — a key distinction from HDDs, where "deleted" sectors just lose their directory entry but the data persists.

Incorrect·A: DLL search order hijacking — malware placed a malicious DLL with the same name as a system DLL in a directory that is searched before System32, causing the application to load the malicious version

DLL search order hijacking (also called DLL preloading or DLL planting) exploits the Windows DLL search order. If an attacker places a malicious DLL with the same name as a system DLL in a directory searched before System32 (such as the application directory, current directory, or a user-writable path), the application loads the malicious version. Finding a well-known system DLL loaded from an unexpected path like `C:\Users\Public\` is a definitive indicator.

Incorrect·B: Windows Security Event ID 4624 with Logon Type 3 (network logon) and Authentication Package "NTLM" combined with Event ID 4672 (special privilege logon) from a workstation where the attacker was not physically present, showing the source IP differing from the account's normal access patterns

Pass-the-Hash uses a captured NTLM hash to authenticate without knowing the plaintext password, producing a network logon (Type 3) with NTLM authentication. Combining Event 4624 (Logon Type 3, NTLM auth package) with 4672 (special privileges assigned) from a source IP inconsistent with the account's normal access is strong PtH evidence. Note: Kerberoasting involves Kerberos tickets; LSASS memory contains hashes but their plaintext absence doesn't confirm PtH usage.

Incorrect·B: These are Firefox artifacts; IndexedDB contains web app data, Local Storage has key-value site data, and Cache2 holds cached web resources — together revealing browsing patterns, web app sessions, and potentially credentials

Firefox stores web data in a profile directory containing: IndexedDB (NoSQL databases used by web apps, often containing session data and cached application state), Local Storage (persistent key-value pairs per origin, used by web apps for authentication tokens), and Cache2 (cached web resources including HTML, scripts, and images). These artifacts reveal web app usage that goes beyond simple history and cookie analysis.

Incorrect·B: The timestomping was performed using a tool that only had minute-level timestamp precision, a known indicator of certain anti-forensics tools that do not preserve sub-second timestamp granularity, thus exposing itself within the super-timeline

NTFS stores timestamps with 100-nanosecond precision. When an anti-forensics tool manipulates timestamps but only writes minute-level precision (or zero sub-minute values), all modified timestamps cluster at exactly HH:MM:00.0000000. This is a documented artifact of certain timestomping tools (including older versions of Metasploit's `timestomp`), and its presence in a super-timeline is itself a strong indicator of tampering.

Incorrect·B: Amcache.hve records installed application metadata including SHA-1 hash, PE compilation timestamp, and first execution time for executables run since Windows 8/Server 2012; Shimcache records execution order without hashes, the two together provide both execution proof and file identity verification

Amcache.hve (`C:\Windows\appcompat\Programs\Amcache.hve`) stores metadata for executed programs including the SHA-1 hash of the binary, PE compile timestamp, file size, and publisher. Shimcache (AppCompatCache) records the execution order and presence of executables in the compatibility cache (no hashes). Together: Amcache provides file identity (the SHA-1 can be looked up in malware databases like VirusTotal), while Shimcache proves the file existed and was run. Both survive deletion of the original executable.

Incorrect·C: The file timestamps in the directory entry were overwritten with zeros using a tool that directly modified the on-disk inode, but debugfs reading from raw filesystem structures reveals the true inode metadata — a mismatch indicating targeted anti-forensics using direct disk writes

On Linux ext4, direct inode editing using tools like `debugfs` or raw disk writes can modify directory entry timestamps independently. A discrepancy between directory-entry-visible timestamps (zeros) and raw inode metadata (recent ctime/mtime from debugfs) indicates surgical anti-forensics where only the user-visible metadata was wiped, but the underlying inode metadata was not correctly zeroed. This mirrors the Windows $SI vs $FN timestamp discrepancy in NTFS timestomping.

Incorrect·C: Masquerading — a defense evasion technique (MITRE ATT&CK T1036) where malware uses the name of a trusted Windows process to blend in with legitimate system processes while running from a user-writable path outside System32

Masquerading (MITRE ATT&CK T1036.005) involves naming malware the same as — or similar to — legitimate system processes (svchost.exe, lsass.exe, explorer.exe) to evade detection. The key indicator is the process path: legitimate `svchost.exe` runs exclusively from `C:\Windows\System32\` (or `SysWOW64`). Any `svchost.exe` running from `%TEMP%`, `%APPDATA%`, or other user-writable directories is malicious with very high confidence.

Incorrect·B: The MBR and VBR execute before the OS kernel loads; a bootkit infects these structures to load malicious code before any OS-based security tool can detect it, making forensic analysis require bit-level comparison of these structures against known-good baselines to detect unauthorized modifications

Bootkits (such as TDL4, Rovnix, and BIOS-based implants) infect the MBR or VBR — structures that execute before the OS boots. Because they are loaded before the OS kernel and security software, they can hide their presence from OS-layer tools. Forensic detection requires offline analysis: computing the SHA-256 of the MBR/VBR from a forensic image and comparing against known-good baselines for the specific disk manufacturer and boot loader version.