GCFA · Question #238
Adam works as a professional Computer Hacking Forensic Investigator. A project has been assigned to him to investigate computer of an unfaithful employee of SecureEnet Inc. Suspect's computer runs…
The correct answer is A. Swap files B. Unused and hidden partition C. Slack spaces. In Windows forensic investigations, examiners collect evidence from volatile and residual storage locations that may retain data beyond normal user access.
Question
Adam works as a professional Computer Hacking Forensic Investigator. A project has been assigned to him to investigate computer of an unfaithful employee of SecureEnet Inc. Suspect's computer runs on Windows operating system. Which of the following sources will Adam investigate on a Windows host to collect the electronic evidences? Each correct answer represents a complete solution. Choose all that apply.
Options
- ASwap files
- BUnused and hidden partition
- CSlack spaces
- DAllocated cluster
How the community answered
(41 responses)- A73% (30)
- D27% (11)
Why each option
In Windows forensic investigations, examiners collect evidence from volatile and residual storage locations that may retain data beyond normal user access.
Swap files (pagefile.sys) store memory pages paged out from RAM and can contain fragments of running processes, passwords, or documents. Unused and hidden partitions may hold data intentionally concealed by a suspect. Slack space - the unused area between the end of a file and the end of its last allocated cluster - can retain remnants of previously deleted data, all of which are standard CHFI evidence sources on Windows hosts.
Allocated clusters store data belonging to currently active files that the operating system tracks normally; they do not represent hidden or residual evidence sources specific to forensic recovery of concealed or deleted data.
Concept tested: Windows digital forensic evidence collection sources
Source: https://www.eccouncil.org/wp-content/uploads/2022/09/CHFI-Brochure.pdf
Topics
Community Discussion
No community discussion yet for this question.