112-57 EC-Council Digital Forensics Essentials (DFE) Questions and Answers

HKEY_CLASSES_ROOT (HKCR)is the Windows Registry location that storesfile-association and COM registration data, including mappings forfile extensions(e.g.,.docx) toProgIDs, and COM object identifiers such asCLSIDand interface-related identifiers likeIID. In forensic examinations, HKCR is frequently consulted to determine which application is registered to open a specific file type, to identify COM objects that may enable persistence or abuse (e.g., through COM hijacking), and to correlate suspicious registry-based execution mechanisms with installed software.

HKCR is often described asvolatile in naturebecause it is not a single standalone hive file stored independently in the same way as SAM or SYSTEM; instead, it is amerged, runtime viewcreated by the OS primarily fromHKLM\Software\Classes(machine-wide registrations) andHKCU\Software\Classes(per-user overrides). This means what you see under HKCR can vary depending on the current user context and system state, and the effective associations/registrations may change when software is installed, updated, or when per-user settings override machine defaults.

The other options represent different scopes: HKLM is system configuration, HKCU is user profile configuration, and HKCC reflects the current hardware profile—not the primary COM/file association repository.

The UNIX/Linuxddutility performs abit-by-bit (sector-by-sector) copyfrom an input device (such as a physical disk) to an output target (another device or a flat file). In digital forensics guidance, this type of output is known as araw (bitstream) imagebecause it captures the exact sequence of bytes from the source media without embedding structured case metadata, compression, or container features by default. The resulting file is often referred to as a “dd image” and may use extensions like.ddor.img, but the key point is theformat is raw: it represents a straightforward byte-for-byte representation of the original storage, including allocated data, unallocated space, slack space, and file system structures.

By contrast,AFFandAFF4are forensic container formats designed to store evidence data along with metadata (and often support features such as chunking, compression, and richer integrity structures). “Proprietary format” refers to vendor-specific containers (for example, formats created by certain commercial forensic tools) rather than the generic output produced by dd. Since Philip specifically usedddto create bit-by-bit disk images, the extracted acquisition image format isRaw Format (A).

Steganographyis the technique of concealing a messagewithin another seemingly harmless carrier(such as an image, audio file, video, or document) so that theexistence of the hidden message is not apparentto an observer. Digital forensics references distinguish steganography from encryption: encryption scrambles content but usually leaves visible indicators that protected data exists (ciphertext), while steganography aims to make the communication look ordinary, reducing suspicion. In practice, steganographic methods often embed data into redundant or less perceptible parts of the carrier, such as modifying least significant bits in pixel values, altering frequency components in audio, or inserting data into metadata or unused file structures.

The other options do not match the definition.Password crackingis an access technique to recover authentication secrets, not a concealment method.Artifact wipingis an anti-forensics method intended to remove traces (logs, files, slack space remnants), but it does not “hide behind” other data—it destroys or overwrites evidence.Program packerscompress/obfuscate executables to hinder static analysis and detection, but they still produce an executable whose presence is evident; they do not primarily hide messages inside benign files. Therefore, the described “hiding the existence of the message itself” corresponds toSteganography (C).

When a file is deleted on common file systems, the operating system typically removes the directory reference and marks the previously used clusters/blocks asunallocated, but the underlying file content may remain on disk until it is overwritten. Digital forensics procedures emphasize that recovering such deleted content often requires examining unallocated space rather than relying only on file system metadata.Autopsy’s “Data Carving”function is specifically intended for this purpose: it scans unallocated space (and sometimes slack space) forfile signatures(headers/footers and internal structure patterns) and reconstructs recoverable files even when the original filename, path, or metadata is missing.

This directly matches the scenario: Jack recovered deleted files fromunallocated space, which is the classic use case for carving. The other options in Autopsy support different investigative goals.Timeline analysiscorrelates timestamps from multiple artifacts to reconstruct sequences of activity, but it does not itself reconstruct deleted file content from raw disk areas.Web artifactsfocuses on browser history, downloads, cookies, and related traces.Multimediahelps categorize and analyze media files (e.g., images/videos), but it is not the primary mechanism for recovering deleted data from unallocated space. Therefore, the Autopsy function that enabled the recovery described isData carving (D)

The scenario describes a targeted social-engineering attack aimed specifically athigh-profile individuals(CEOs, CFOs, politicians, celebrities) and usesemail or website spoofingto deceive them into disclosing sensitive information. In digital forensics and incident response documentation, this is most accurately categorized aswhaling, a specialized form of phishing that focuses on “big targets” (often called “high-value targets” or “VIPs”). Whaling campaigns typically use highly tailored pretexts (e.g., legal subpoenas, board communications, invoice/payment requests, HR or executive directives) and may include spoofed sender domains, look-alike websites, or fraudulent login pages to harvest credentials and confidential corporate data. Because executives often have access to financial systems, strategic documents, and privileged communications, attackers concentrate effort on realism and personalization, making whaling distinct from broad, generic phishing.

By contrast,smishingis phishing conducted via SMS/text messages,spimmingis spam over instant messaging platforms, andidentity fraudis a broader category involving impersonation/misuse of personal data but does not specifically denote the executive-targeted spoofing technique described. Therefore, the attack type in the question isWhaling (A).

In the NTFS file system, theMaster File Table (MFT)is the core metadata structure that tracksevery file and directoryon the volume. NTFS implements this as a special system file named$MFT(shown here as$mft). Each file or folder on an NTFS partition is represented by at least oneMFT record entry, which stores essential metadata such as file name(s), timestamps, security identifiers/ACL references, file size, attributes, and pointers to the file’s data runs (or, for very small files, the content can be stored resident inside the record). Because it is the authoritative “index” of file objects, forensic examiners rely heavily on $MFT to reconstruct user activity and file history, including evidence of deleted files (when records are marked unused but remnants of attributes may remain) and timeline building from timestamp attributes.

The other options are different NTFS metadata files with narrower purposes:$LogFilerecords NTFS transaction logs to support recovery,$Volumestores volume-level information (like version/label), and$Quotamanages disk quota tracking. None of these contain a record for every file on the system. Therefore, the NTFS system file that contains a record of every file present is$mft (B).

In forensic readiness planning, the goal is to ensure that when an incident occurs, the organization can collect, preserve, and present digital evidence in a manner that remainsreliable, repeatable, and legally defensible. A key requirement for courtroom acceptance is cleardocumentation—often referred to as proper documentation and chain-of-custody support—showing what actions were taken, by whom, when, using which tools, and under what conditions. Creating a defined process for documenting procedures ensures investigators consistently record acquisition steps, handling methods, hashing/verification results, storage locations, access history, and any changes in evidence possession. This documentation becomes a “backup” in the sense that it preserves institutional memory of the investigation steps, allowing future reviewers (auditors, opposing experts, courts) to reconstruct and validate what occurred even long after the incident.

While identifying potential evidence (B) and determining evidence sources (C) are important readiness tasks, they do not themselves create the structured record needed to defend evidence integrity. Keeping an incident response team ready (D) supports operational response, but does not directly ensure admissibility. Therefore, the step that provides future reference and supports court presentation isCreating a process for documenting the procedure (A).

The scenario describes a victim beingredirected from a legitimate banking URL to a fraudulent websitewithout intending to visit it, after malware is installed on the system. This behavior is characteristic ofpharming, an attack in which an adversarycauses redirectionto a malicious destination even when the user types the correct address or clicks a legitimate bookmark. In digital forensics references, pharming is commonly achieved by manipulatingname resolution or routing mechanisms, such as altering the localhosts file, changingDNS server settings, poisoning DNS responses, modifying browser proxy settings, or installing malware that intercepts and rewrites web requests. The key forensic indicator is that the victim’s request for the real domain is transparently diverted to attacker-controlled infrastructure, where credentials are harvested through a convincing spoofed login page.

The other options do not match the redirection-and-fake-site mechanism.Tailgatingis physical access abuse (following someone into a secure area).Dumpster divinginvolves retrieving sensitive information from discarded materials.Shoulder surfingis observing credentials by watching the victim type. Because the essential action here ismalicious redirection to a fake site to steal credentials, the correct answer isPharming (A).

In Windows forensics and incident response, investigators often need to linknetwork activity(remote IPs, ports, connection states) to theresponsible processto determine whether traffic is legitimate or associated with malware, unauthorized tools, or data exfiltration. The Windowsnetstatutility can enumerate current TCP connections and listening ports, but the key flag that enables attribution to a running program is-o. The-oparameter instructs netstat to include theOwning Process ID (PID)with each connection or listening socket. Once the PID is known, examiners can correlate it with process listings (e.g., Task Manager,tasklist, memory forensics output) to identify the executable name, path, user context, and parent process—critical steps in reconstructing attacker behavior and persistence.

The other options do not provide PID mapping:-nshows addresses and ports in numeric form (useful for speed and to avoid DNS lookups),-adisplays all connections and listening ports but without PID attribution by itself, and-sshows protocol statistics rather than per-connection ownership. Therefore, the parameter that shows active connectionsandincludes the PID for each is[-o](Option C).

The protocols listed—Frame Relay, SMDS, Fast Ethernet, SLIP, PPP, FDDI, ATM, Ethernet, and ARP—belong to the portion of the TCP/IP model responsible forlocal network deliveryand direct interaction with the physical media and link-layer addressing. In TCP/IP terminology, this is theNetwork Access layer(also called the Link layer or Network Interface layer). It combines functions that map closely to the OSIData LinkandPhysicallayers.

This layer is essential for delivering frames within the same network segment because it governs how devices access the medium (e.g., Ethernet), how frames are formatted and transmitted, and how hardware addressing works.ARP (Address Resolution Protocol)is especially important here: it resolvesIP addresses to MAC addressesso that an IP packet can be encapsulated into a link-layer frame and delivered to the correct local host or next-hop gateway. Technologies like PPP/SLIP support point-to-point links, while Frame Relay/ATM represent WAN/link technologies, all of which still sit under IP and provide the mechanisms for moving data across the immediate network path.

TheInternet layerhandles IP routing between networks, theTransport layerprovides end-to-end host communications (TCP/UDP), and theApplication layerprovides user protocols. Therefore, the correct layer isNetwork access layer (A).

Ntdll.dllis the Windows user-mode system library that provides manyinternal NT functions(commonly exposed as “NT Native API” routines such asNt*/Zw*) and, critically, contains thesystem service dispatch stubsused by user-mode code to transition into kernel mode for operating system services. In standard Windows architecture, most user-mode applications call higher-level APIs (for example, Win32 APIs inKernel32.dll), which then ultimately rely onNtdll.dllto perform the final step of invoking the kernel through these system call stubs. This is whyNtdll.dllis a core component loaded into nearly every process and is tightly associated with the boundary between user mode and theexecutivecomponents of the OS.

From a forensics viewpoint, understandingNtdll.dllmatters because it is central to how processes request privileged services, and it is frequently referenced in analyses of process execution, API call chains, and certain user-mode hooking techniques used by malware or anti-forensics tools.

By contrast,Ntoskrnl.exeis the kernel image itself (core kernel/executive),Win32k.sysis a kernel-mode graphics/windowing subsystem component, andKernel32.dllprovides higher-level Win32 APIs rather than the primary system-call stub layer. Hence,Ntdll.dll (C)is the correct answer.

The scenario describes the use ofBitLockerto lock an entire disk volume with asecret key, preventing access to the contents. In digital forensics, this is a classic example ofencryption as an anti-forensics technique. Full-disk or full-volume encryption transforms readable data into ciphertext using cryptographic algorithms so that, without the correct key (password, recovery key, TPM-bound protector, etc.), the data is computationally infeasible to interpret. This directly obstructs evidence acquisition and analysis because a forensic image of the drive will largely contain encrypted blocks rather than interpretable file system structures and user data.

This differs from the other options:file carvingis a forensic recovery method (often used by investigators) that reconstructs files from unallocated space; it is not an anti-forensics method used to block access.Artifact wipingattempts to erase traces by deleting or overwriting files, logs, or free space, but it does not inherently prevent access to remaining data if wiping is incomplete.Trail obfuscationinvolves misleading or altering logs and traces to confuse investigators, whereas encryption primarilydenies content visibilityby design. Because BitLocker is explicitly a volume encryption mechanism used here to deny access, the correct anti-forensic technique isEncryption (D).

In classic hard-disk geometry, total capacity is computed fromCHS parameters(Cylinders × Heads × Sectors per track) multiplied bybytes per sector. Forensic examiners learn this because it helps validate whether an image acquisition size is consistent with the physical disk geometry and to spot anomalies caused by misreported device geometry or capture errors.

First compute total addressable sectors:

16,384 cylinders × 80 heads = 1,310,720 tracks(because each head provides a track per cylinder).

Then multiply by sectors per track:

1,310,720 × 63 = 82,575,360 sectors.

Convert sectors to bytes using the sector size:

82,575,360 sectors × 512 bytes/sector = 42,278,584,320 bytes.

This matches optionAexactly. In practice, modern drives often use LBA and may report different logical geometries, but the forensic principle remains the same: capacity equals the number of logical blocks times the logical block size, and CHS-style values are a structured way to perform that verification.

The Windowsnet view \\<computer>command is used to enumerateshared resources(SMB shares) that a remote Windows system is publishing. When Jessy runsnet view \\10.10.10.11, her goal is to retrieve a list of the target host’s visible shares—such as administrative shares (e.g.,C$,ADMIN$) and any custom shares created for departments, applications, or users. In forensic and incident-response practice, this is important because attackers commonly use SMB shares forlateral movement,staging tools,dropping payloads, andexfiltrating data. By reviewing the shares exposed by a suspected server, the investigator can quickly identify unexpected or overly permissive shares, locate potential repositories of web content or logs, and determine whether a compromised web server is also exposing file resources that expand the attacker’s options.

The other options map to different commands and artifacts: disk space usage is checked with storage utilities (notnet view), open sessions are examined with commands likenet session, and identifying users accessing files typically involvesnet fileor server auditing logs. Therefore, Jessy’s objective was toreview file shareson the remote host.

To understand a malware sample’s purpose at the instruction level, investigators usereverse-engineering toolsthat candisassemblecompiled binaries intoassembly codeand often allowinteractive debuggingto observe runtime behavior (API calls, unpacking routines, decryption loops, process injection, and control-flow decisions).OllyDbgis a classic Windows user-mode debugger widely referenced in malware analysis workflows because it provides an integrated view ofdisassembly, CPU registers, memory, breakpoints, and execution tracing. This makes it suitable for extracting behavioral insight from the actual assembly instructions, especially when malware uses obfuscation or packers that require stepping through execution to reach the real payload.

The other options do not primarily perform assembly-level analysis.VirtualBoxandVMware vSphereare virtualization platforms; they help safely run malware in isolated environments, but they are not disassemblers/debuggers for examining assembly instructions.QualNetis a network simulation tool used for modeling network behavior, not binary reverse engineering. Because the question specifically emphasizesanalyzing assembly code instructionsto understand malware purpose, the correct tool among the choices isOllyDbg (C).

Under the Electronic Communications Privacy Act (ECPA),Title IIis commonly known as theStored Communications Act (SCA). Digital forensics and e-discovery references treat the SCA as the key legal framework governing access tostored electronic communications and associated subscriber/account recordsheld by service providers. The question specifically mentions (1) “contents of files stored by service providers” and (2) “records held about the subscriber … such as subscriber name, billing records, and IP addresses.” These map directly to the SCA’s two broad categories:content(what a communication or stored file contains) andnon-content records(subscriber identity, connection logs, billing information, IP assignment/history, and related transactional metadata).

From an investigative perspective, Title II matters because it sets the legal process and restrictions for compelled disclosure—typically requiring different forms of legal process depending on whether the investigator seekscontentversussubscriber/transactional records, and depending on factors like how the data is stored and retention timeframes. In contrast,Title Ifocuses on real-time interception (wiretap-style capture), andTitle IIIaddresses pen register/trap-and-trace style dialing/routing information rather than stored content. Therefore, the correct title isTitle II (Option A).

The scenario describes an email-retrieval configuration in which messages aredownloaded to a client deviceandnot retained on the server. This behavior aligns withPOP3 (Post Office Protocol v3), a legacy but widely referenced mail access protocol that retrieves email from a server mailbox to a local client. In standard POP3 operation, the client authenticates to the mail server, issues retrieval commands (e.g., to list and download messages), and may then issue a delete command so that downloaded messages are removed from the server mailbox. Digital forensics references commonly contrast POP3 with IMAP:IMAP is designed for server-side mailbox synchronization and typically leaves mail stored on the server, whereas POP3 is oriented towardclient-side storageand supports workflows where server copies are not preserved after download. The other options are unrelated to email retrieval:SHA-1is a cryptographic hash function used for integrity checks,ICMPsupports network diagnostics and control messaging, andSNMPis used for network device management and monitoring. From an investigative standpoint, POP3 usage can reduce server-resident evidence and shift evidentiary value tolocal artifacts(mail client databases, cache, OS traces, backups), which is consistent with the intent described in the question.

The technique described—taking a snapshot of the baseline state of the forensic workstation before executing malware—aligns withMonitoring host integrity. In malware forensics, investigators often perform controlled execution (dynamic analysis) and need a reliable way to identifywhat changed on the systemas a direct result of the malware run. Host integrity monitoring is a structured approach where the examiner first captures aknown-good baselineof critical system elements such as file system state (key directories, system binaries), registry/configuration state, running services, installed drivers, scheduled tasks, and sometimes hash inventories of important files. After malware execution, the investigator captures a second snapshot and performsdifferential comparisonto determine newly created/modified files, persistence mechanisms, configuration changes, dropped payloads, and tampering attempts.

This baseline-before/after comparison is fundamental for attributing changes to the sample, supporting repeatability, and documenting evidence in a defensible manner. The other options do not require a workstation baseline snapshot in this sense:online malware scanningchecks a file against signatures/reputation services;string searchextracts readable strings from binaries; andfile fingerprintingtypically refers to hashing to uniquely identify a file, not system-wide state comparison. Therefore, the correct answer isMonitoring host integrity (B).

SSH (Secure Shell)is specifically designed to provide anencrypted channelover an untrusted network. In digital forensics and incident response, SSH is well known for supportingtunneling/port forwarding, where traffic for another protocol (for example, HTTP, database connections, or remote desktop) is encapsulated inside an SSH session. Because the SSH session encrypts payload data (and can also protect authentication and command content), the tunneled traffic becomesobfuscated to network monitoring toolsthat can only see metadata such as source/destination IPs, port numbers (often TCP/22), timing, and byte counts. This capability is frequently discussed in forensic references as a mechanism that can hinder content inspection and complicate attribution of user actions purely from packet payload analysis.

By contrast,SNMPis primarily for network management and monitoring, not secure tunneling.ARPresolves IP-to-MAC addresses on local networks and does not provide encryption or tunneling.UDPis a transport protocol that can carry data for many applications but provides no built-in security or tunneling features by itself. Therefore, the protocol that creates secure tunneling enabling content obfuscation isSSH (C).

event logs) to establish user intent and sequence of actions. Therefore, the correct option isBrowsingHistoryView (B).