Key details for this exam, checked against the published exam outline
Each question shows the correct answer and an explanation of why it is right
Bob, a professional hacker, targeted an organization to launch attacks. Bob gathered information such as network topology and a list of live hosts. Based on the collected information, he launched further attacks over the organization's network.
Identify the type of network attack Bob initiated on the target organization in the above scenario.
The activity described---collecting network topology details and compiling a list of live hosts---matches the reconnaissance phase commonly referred to as enumeration. In digital forensics and incident response documentation, enumeration is the systematic process of discovering and extracting information about a target environment to support later exploitation. It typically follows (or overlaps with) scanning and includes identifying active IP addresses, reachable systems, open ports/services, device roles, OS fingerprints, domain information, shared resources, user/group details, and routing or segmentation clues that reveal how the network is structured.
This information is then used to plan ''further attacks,'' such as targeting exposed services, choosing exploit paths, locating high-value systems, and selecting lateral movement routes. From a forensic standpoint, enumeration attempts often leave traces in firewall logs, IDS alerts, and endpoint artifacts (e.g., bursts of connection attempts across many hosts/ports, ICMP echo sweeps, ARP discovery on local segments, and repeated DNS queries).
The other options do not fit: data modification involves altering data integrity; session hijacking targets active sessions/tokens; and buffer overflow is an exploitation technique against vulnerable software, not the information-gathering step described. Therefore, the correct answer is Enumeration (B)
Which of the following techniques is defined as the art of hiding data ''behind'' other data without the target's knowledge, thereby hiding the existence of the message itself?
Steganography is the technique of concealing a message within another seemingly harmless carrier (such as an image, audio file, video, or document) so that the existence of the hidden message is not apparent to an observer. Digital forensics references distinguish steganography from encryption: encryption scrambles content but usually leaves visible indicators that protected data exists (ciphertext), while steganography aims to make the communication look ordinary, reducing suspicion. In practice, steganographic methods often embed data into redundant or less perceptible parts of the carrier, such as modifying least significant bits in pixel values, altering frequency components in audio, or inserting data into metadata or unused file structures.
The other options do not match the definition. Password cracking is an access technique to recover authentication secrets, not a concealment method. Artifact wiping is an anti-forensics method intended to remove traces (logs, files, slack space remnants), but it does not ''hide behind'' other data---it destroys or overwrites evidence. Program packers compress/obfuscate executables to hinder static analysis and detection, but they still produce an executable whose presence is evident; they do not primarily hide messages inside benign files. Therefore, the described ''hiding the existence of the message itself'' corresponds to Steganography (C).
John, a forensic officer, was working on a criminal case. He employed imaging software to create a copy of data from the suspect device on a storage medium for further investigation. For developing an image of the original data, John used a software application that does not allow an unauthorized user to alter the image content on storage media, thereby retaining an unaltered image copy.
Identify the data acquisition step performed by John in the above scenario.
The scenario emphasizes that John used an application (or mechanism) that prevents alteration of the acquired image content, ensuring the image remains unaltered and protected from unauthorized modification. In forensic acquisition standards, this corresponds to enabling write protection during imaging---commonly implemented using a write blocker (hardware or controlled software write-protection) to prevent any writes to the source evidence and, where applicable, to protect the integrity of the evidence copy from accidental or unauthorized changes. The purpose is to preserve evidential integrity by ensuring that neither the original media nor the forensic image is modified during handling, analysis preparation, or transfer.
''Validated data acquisition'' refers to confirming the image is an exact duplicate, typically by computing and comparing cryptographic hashes (e.g., MD5/SHA) of the source and the acquired image. While validation is essential, the question specifically highlights preventing alteration, not verifying equality. ''Sanitized the target media'' is the step of wiping/clearing the destination drive before acquisition to avoid contamination, which is not what is described. ''Planned for contingency'' relates to operational planning for unexpected issues (equipment failure, encryption, power loss), not integrity protection. Therefore, the best match is Enabled write protection on the evidence media (A).
Sam is working as a loan agent for a financial institution. He frequently receives a number of emails from clients providing their personal details for loan approval. As these emails contain sensitive data, Sam had set up a feature that directly downloads the emails on his device without storing a copy on the mail server. Which of the following protocols provides the above-discussed email features?
The scenario describes an email-retrieval configuration in which messages are downloaded to a client device and not retained on the server. This behavior aligns with POP3 (Post Office Protocol v3), a legacy but widely referenced mail access protocol that retrieves email from a server mailbox to a local client. In standard POP3 operation, the client authenticates to the mail server, issues retrieval commands (e.g., to list and download messages), and may then issue a delete command so that downloaded messages are removed from the server mailbox. Digital forensics references commonly contrast POP3 with IMAP: IMAP is designed for server-side mailbox synchronization and typically leaves mail stored on the server, whereas POP3 is oriented toward client-side storage and supports workflows where server copies are not preserved after download. The other options are unrelated to email retrieval: SHA-1 is a cryptographic hash function used for integrity checks, ICMP supports network diagnostics and control messaging, and SNMP is used for network device management and monitoring. From an investigative standpoint, POP3 usage can reduce server-resident evidence and shift evidentiary value to local artifacts (mail client databases, cache, OS traces, backups), which is consistent with the intent described in the question.
Below are the elements included in the order of volatility for a typical computing system as per the RFC 3227 guidelines for evidence collection and archiving.
Archival media
Remote logging and monitoring data related to the target system
Routing table, process table, kernel statistics, and memory
Registers and processor cache
Physical configuration and network topology
Disk or other storage media
Temporary system files
Identify the correct sequence of order of volatility from the most to least volatile for a typical system.
RFC 3227's ''order of volatility'' principle guides responders to collect the most perishable evidence first because some data can disappear immediately when power is lost, processes terminate, or the system state changes during response actions. The most volatile items are CPU registers and processor cache (4) because they change continuously at instruction speed and are lost instantly on shutdown or context switching. Next are routing table, process table, kernel statistics, and memory (3) because live RAM contents and active system tables can change within seconds and are lost if the machine is powered off or rebooted.
After volatile memory, temporary system files (7) are collected because they are frequently overwritten or cleaned by the OS, users, or malware. Then comes disk or other storage media (6) which is more persistent but still subject to modification, log rotation, and overwriting through normal activity; hence imaging should occur before extensive interaction.
Less volatile still are remote logging and monitoring data (2) since they may persist off-host, but can be rotated or altered by retention policies. Physical configuration and network topology (5) generally changes less frequently and can often be re-documented later. Finally, archival media (1) is the least volatile because it is typically write-once or preserved storage. Thus the correct sequence is 4376251 (Option B).
Which of the following hives in the Windows Registry hierarchical database is volatile in nature and contains file-extension association information and programmatic identifier (ProgID), Class ID (CLSID), and Interface ID (IID) data?
HKEY_CLASSES_ROOT (HKCR) is the Windows Registry location that stores file-association and COM registration data, including mappings for file extensions (e.g., .docx) to ProgIDs, and COM object identifiers such as CLSID and interface-related identifiers like IID. In forensic examinations, HKCR is frequently consulted to determine which application is registered to open a specific file type, to identify COM objects that may enable persistence or abuse (e.g., through COM hijacking), and to correlate suspicious registry-based execution mechanisms with installed software.
HKCR is often described as volatile in nature because it is not a single standalone hive file stored independently in the same way as SAM or SYSTEM; instead, it is a merged, runtime view created by the OS primarily from HKLM\Software\Classes (machine-wide registrations) and HKCU\Software\Classes (per-user overrides). This means what you see under HKCR can vary depending on the current user context and system state, and the effective associations/registrations may change when software is installed, updated, or when per-user settings override machine defaults.
The other options represent different scopes: HKLM is system configuration, HKCU is user profile configuration, and HKCC reflects the current hardware profile---not the primary COM/file association repository.
Jack, a forensic investigator, was appointed by an organization to perform a security audit on a Linux system. In this process, Jack collected information about the present status of the system and listed all the applications running on various ports to detect malicious programs.
Which of the following commands can help Jack determine any programs/processes associated with open ports?
On Linux, a key step in a forensic triage or security audit is mapping open/listening ports to the owning process so investigators can identify suspicious services (backdoors, unauthorized daemons, rogue remote-access tools) and correlate them with binaries, users, startup mechanisms, and timestamps. The command netstat -tulpn is designed for exactly this purpose. In this switch set: -t limits output to TCP sockets, -u includes UDP sockets, -l shows only listening sockets (open ports awaiting connections), -p displays the owning process name and PID, and -n prevents name resolution by showing numeric IP addresses and ports (faster and avoids altering evidence via DNS queries). This combination yields a concise list of active listening ports and the processes bound to them, which is highly valuable for detecting unexpected services and attributing network exposure to a specific executable.
The other options do not provide process-to-port attribution: netstat -i shows interface statistics, ip r shows the routing table, and netstat -rn displays the routing table in numeric form. Therefore, the correct command is netstat -tulpn (D).
Exam domains verified against: Official Eccouncil 112-57 exam guide, last checked October 2026.
Learn the core principles of digital forensics, including digital evidence handling, forensic readiness, and the legal and ethical responsibilities of forensic investigators.
Understand the phases of forensic investigation from pre-investigation planning through evidence preservation to post-investigation reporting and documentation.
Sample question from this domain above: Q5
Master the structure of disk drives and file systems across Windows, Linux, and Mac operating systems, including partition examination and file system analysis.
Acquire and duplicate data forensically using accepted methodologies and formats, including disk imaging, RAM acquisition, and verification of data integrity.
Sample question from this domain above: Q3
Identify anti-forensics methods such as file wiping and steganography, then apply countermeasures to recover hidden or deleted data.
Sample question from this domain above: Q2
Analyze Windows systems by examining volatile memory, registry hives, browser artifacts, and file metadata to uncover evidence of system activity and user actions.
Sample question from this domain above: Q6
Perform forensic analysis on Linux and Mac systems, including file system examination with The Sleuth Kit, memory analysis, and data recovery techniques.
Sample question from this domain above: Q7
Analyze network traffic and logs to identify indicators of compromise, correlate security events, and investigate suspicious network activity using tools like Wireshark.
Sample question from this domain above: Q1
Examine web server logs from IIS and Apache, detect web application exploits, and investigate attacks using log analysis and forensic tools like Splunk.
Identify dark web activity on endpoints, analyze Tor Browser artifacts in memory dumps, and recover evidence of anonymous network use.
Perform email forensics to identify phishing, malware distribution, and suspicious communications by examining email headers and message content.
Sample question from this domain above: Q4
Conduct static and dynamic malware analysis, examine suspicious files and documents, and analyze system and network behavior to detect malicious activity.
Common questions about the exam itself
