Digital-Forensics-in-Cybersecurity Exam Questions & Answers

Comprehensive and Detailed Explanation From Exact Extract:

Windows uses a swap file (commonly called pagefile.sys) to extend physical memory (RAM) by temporarily storing data from memory to disk when RAM is insufficient. This allows the system to handle more data than the available RAM.

Linux and Unix typically use dedicated swap partitions or swap files but refer to them differently and manage them in other ways.

Mac OS X uses a paging file system but does not typically use a 'swap file' in the Windows sense; it uses dynamic paging files instead.

The terminology 'swap file' is most commonly associated with Windows.

Microsoft Windows forensics guidelines and NIST documentation describe the page file's role in virtual memory management in Windows operating systems.

Comprehensive and Detailed Explanation From Exact Extract:

The ForwardedEvents log in Windows 7 is specifically designed to store events collected from remote computers via event forwarding. This log is part of the Windows Event Forwarding feature used in enterprise environments to centralize event monitoring.

The System and Application logs store local system and application events.

The Security log stores local security-related events.

ForwardedEvents collects and stores events forwarded from other machines.

Microsoft documentation and NIST SP 800-86 mention the use of ForwardedEvents for centralized event log collection in investigations.

Comprehensive and Detailed Explanation From Exact Extract:

SATA (Serial ATA) refers to an interface standard commonly used for connecting magnetic hard disk drives (HDDs) and solid-state drives (SSDs) to a computer. The term SATA itself describes the connection, but most HDDs that use SATA as an interface are magnetic drives.

CD-ROM and Blu-ray are optical storage media, not magnetic.

SSD (Solid State Drive) uses flash memory, not magnetic storage.

Magnetic drives rely on spinning magnetic platters, which are typically connected via SATA or other interfaces.

This differentiation is emphasized in digital forensic training and hardware documentation, including those from NIST and forensic hardware textbooks.

Comprehensive and Detailed Explanation From Exact Extract:

On Apple iOS devices, deleted files are often moved to a hidden Trash folder before permanent deletion. The directory /.Trashes/501 is a hidden folder where deleted files for user ID 501 (the first user created on macOS/iOS devices) are temporarily stored.

This folder can contain files marked for deletion and thus is a prime location for recovery attempts.

/lost+found is a directory commonly used on Unix/Linux file systems for recovered file fragments after file system corruption but is not the default trash location on iOS.

/Private/etc and /etc contain system configuration files, not deleted user files.

Apple forensic investigations per NIST and training manuals such as those from Cellebrite and BlackBag Technologies indicate that user-deleted files on iOS devices reside in .Trashes or similar hidden directories until permanently removed.

Comprehensive and Detailed Explanation From Exact Extract:

In steganography, the carrier is the file or medium used to hide the secret message. In this example, the sound file is the carrier because it contains the hidden message embedded using the least significant bit method. The message is the payload, and the website is merely the distribution platform.

LSB is the embedding technique, not the carrier.

The message is the payload, not the carrier.

The website is not involved in data hiding.

NIST and steganography references clearly define the carrier as the container holding the hidden data.