312-49v11 Sample Questions & Answers

Email headers are added from bottom to top. The receiving server adds the topmost 'Received' header, which is generally trusted. However, attackers can inject fake 'Received' headers at the bottom of the chain to mislead investigators about the true origin. Investigators must analyze the chain from top to bottom to verify continuity.

This is a classic anti-forensic technique known as VM Detection or Anti-Sandboxing. Malware authors use it to prevent security researchers and automated sandboxes from analyzing the malware's behavior. If the malware detects it is running in a virtual environment (common for analysis labs), it stays dormant.

Cryptographic hashes (like MD5, SHA-1, SHA-256) act as a digital fingerprint. If a single bit of the data changes, the hash value changes completely. Matching hashes prove mathematically that the evidence has not been altered since acquisition.

The Best Evidence Rule states that the original writing, recording, or photograph is required to prove its content. In digital forensics, an accurate bit-stream duplicate (forensic image) is legally accepted as an 'original' under Federal Rules of Evidence (e.g., FRE 1001(d)), provided it is authenticated.

The GDPR imposes strict restrictions on the transfer of personal data of EU citizens to countries outside the EEA. Investigators must ensure mechanisms like Standard Contractual Clauses (SCCs) or mutual legal assistance treaties (MLATs) are in place before transferring evidence containing PII to the US.

An expert witness must remain objective and only testify within the boundaries of their expertise and the facts of the case. Guessing or speculating on unfamiliar topics damages credibility and violates ethical standards. It is correct and professional to admit limitations.

ISO/IEC 27037:2012 provides guidelines for specific activities in the handling of digital evidence, including identification, collection, acquisition, and preservation. It is the primary standard referenced for digital evidence handling.

A hardware write blocker intercepts write commands from the host computer to the drive. For SSDs, it is crucial because mounting the drive (even read-only in software) might trigger background controller processes like TRIM or garbage collection that could permanently wipe deleted data blocks. The hardware blocker prevents these signals from reaching the drive.

To rebuild a RAID 5 array, you must know the order of the disks (Disk 1, Disk 2, etc.), the stripe size (block size of data written before moving to next disk), and the parity rotation scheme (e.g., Left Asynchronous, Right Synchronous). Without these parameters, the data will be scrambled.

The EFI System Partition (ESP) is a dedicated partition on GPT disks used by UEFI firmware to load the OS. It is formatted as FAT32 and contains boot loaders, device drivers, and system utilities. This is distinct from the NTFS system partition where Windows resides.