Key details for this exam, checked against the published exam outline
Each question shows the correct answer and an explanation of why it is right
David, a cybercriminal, targeted a community and initiated anti-social campaigns online. In this process, he used a layer of the web that allowed him to maintain anonymity during the campaign.
Which of the following layers of the web allowed David to hide his presence during the anti-social campaign?
The layer of the web most associated with maintaining anonymity for users and services is the Dark Web. In digital forensics terminology, the Dark Web refers to services hosted on overlay networks (such as Tor hidden services) that are not indexed by standard search engines and are typically accessible only through specialized software and configurations. Its core characteristic is that it is deliberately designed to reduce traceability by routing traffic through multiple relays and separating identifying information (like the user's real IP address) from the destination. This makes attribution and geolocation significantly harder using traditional network logs alone, which is why adversaries often choose it to conduct covert communications, host content, or coordinate campaigns.
By contrast, the Surface Web (the regular, indexed portion of the web) is generally reachable through normal browsers and is easier to monitor and attribute using conventional ISP, server, and platform logs. ''World Wide Web'' is a general term for web content accessed via HTTP/HTTPS and does not specifically imply anonymity. The Deep Web refers to content not indexed by search engines (e.g., webmail, databases, authenticated portals), but it is not inherently anonymizing---many deep web resources are simply private or access-controlled. Therefore, the layer enabling David to hide his presence is the Dark Web (C).
An organization decided to strengthen the security of its network by studying and analyzing the behavior of attackers. For this purpose, Steven, a security analyst, was instructed to deploy a device to bait attackers. Steven selected a solution that appears to contain very useful information to lure attackers and find their locations and techniques.
Identify the type of device deployed by Steven in the above scenario.
A honeypot is a deliberately deployed decoy system or service designed to attract attackers by appearing valuable or vulnerable, thereby enabling defenders to observe malicious behavior in a controlled manner. Digital forensics and incident response references describe honeypots as tools for threat intelligence and evidence collection, because they can record interaction details such as connection sources, exploited services, commands executed, malware dropped, and attempted privilege escalation. This directly matches the scenario: Steven deployed something that ''appears to contain very useful information'' to lure attackers and help identify their locations and techniques. Honeypots are typically instrumented with extensive logging and monitoring, making them especially useful for building timelines, extracting indicators of compromise, and understanding adversary tactics, techniques, and procedures.
The other options do not align with the ''bait attackers'' goal. An IDS primarily detects and alerts on suspicious activity but is not intended to impersonate a valuable target. A firewall enforces access control rules to block/allow traffic, not entice attackers. A router forwards packets and provides network connectivity; it is not a deception platform. Therefore, the device type described is a Honeypot (C).
Which of the following tools helps forensic experts analyze user activity in the Microsoft Edge browser?
In Windows forensics, analyzing Microsoft Edge user activity commonly involves extracting and correlating browser artifacts such as visited URLs, visit counts, timestamps, download references, and cached content indicators. A practical forensic approach is to use a tool that can parse and normalize history artifacts across multiple browsers, because investigations often require comparing activity between Edge and other installed browsers on the same workstation. BrowsingHistoryView is designed specifically for that purpose: it aggregates browsing history from different browsers and presents it in a unified timeline-style view, which supports rapid triage and cross-validation of user activity.
By contrast, MZHistoryView and MZCacheView are associated with Mozilla-family artifacts (history and cache), making them appropriate for Firefox-related examinations rather than Edge. ChromeHistoryView is specialized for Google Chrome history databases and does not target Edge artifacts as its primary source. In forensic workflow terms, a multi-browser history tool is valuable because it helps identify patterns such as repeated access to specific domains, time windows of browsing activity, and correlation with other Windows artifacts (prefetch, jump lists,
James, a forensic specialist, was appointed to investigate an incident in an organization. As part of the investigation, James is attempting to identify whether any external storage devices are connected to the internal systems. For this purpose, he employed a utility to capture the list of all devices connected to the local machine and removed suspicious devices.
Identify the tool employed by James in the above scenario.
The requirement is to list devices connected to a local Windows machine, specifically to identify external storage devices that may be attached and potentially used for data theft or malware introduction. In Windows forensic practice, investigators often start by enumerating currently mounted volumes and recently connected removable media so they can correlate device presence with suspicious activity timelines and user actions. DriveLetterView is a utility designed to display the complete mapping of drive letters to storage devices/volumes, including removable drives (USB flash drives, external HDDs), optical media, network-mapped drives, and local partitions. It helps quickly identify what storage devices are present and accessible on the system at the time of inspection, which fits the scenario where James captures a list of connected devices and removes suspicious ones.
The other tools do not match this purpose. ESEDatabaseView is used to inspect Extensible Storage Engine databases, not enumerate attached storage. ProcDump is used for creating process memory dumps for debugging/forensic analysis of processes, not for listing connected drives. PromiscDetect relates to detecting network interfaces in promiscuous mode (packet sniffing), not external storage enumeration. Therefore, the correct tool for identifying connected storage devices is DriveLetterView (C).
Which of the following Tor relay nodes in the Tor circuit is designed to transfer data in an encrypted format?
In a standard Tor circuit, a client typically builds a three-hop path: Entry/Guard Middle Exit. Tor uses onion routing, where the client wraps the payload in multiple encryption layers---one for each hop. Each relay removes (decrypts) only its own layer to learn the next hop, but not the complete route or the original payload in the clear. The middle relay is specifically positioned to forward traffic between the entry/guard and the exit while it remains onion-encrypted end-to-end within the Tor network. Because it neither connects to the user's local network (like the entry/guard) nor to the public destination (like the exit), its primary role is encrypted transit/forwarding, helping break the linkage between source and destination. By contrast, the exit relay is where traffic leaves Tor; unless the application layer uses TLS/HTTPS, the exit may deliver data to the destination in unencrypted form on the open Internet. The entry/guard protects against certain traffic-correlation risks by being stable, but it is not uniquely ''the'' encrypted-transfer node. Therefore, the best single answer is Middle relay (D).
75 questions covering all exam domains, starting from $20
Exam domains verified against: Official Eccouncil 112-57 exam guide, last checked August 2026.
Learn the core principles of digital forensics, including digital evidence handling, forensic readiness, and the legal and ethical responsibilities of forensic investigators.
Understand the phases of forensic investigation from pre-investigation planning through evidence preservation to post-investigation reporting and documentation.
Master the structure of disk drives and file systems across Windows, Linux, and Mac operating systems, including partition examination and file system analysis.
Acquire and duplicate data forensically using accepted methodologies and formats, including disk imaging, RAM acquisition, and verification of data integrity.
Identify anti-forensics methods such as file wiping and steganography, then apply countermeasures to recover hidden or deleted data.
Analyze Windows systems by examining volatile memory, registry hives, browser artifacts, and file metadata to uncover evidence of system activity and user actions.
Perform forensic analysis on Linux and Mac systems, including file system examination with The Sleuth Kit, memory analysis, and data recovery techniques.
Analyze network traffic and logs to identify indicators of compromise, correlate security events, and investigate suspicious network activity using tools like Wireshark.
Sample question from this domain above: Q2
Examine web server logs from IIS and Apache, detect web application exploits, and investigate attacks using log analysis and forensic tools like Splunk.
Identify dark web activity on endpoints, analyze Tor Browser artifacts in memory dumps, and recover evidence of anonymous network use.
Perform email forensics to identify phishing, malware distribution, and suspicious communications by examining email headers and message content.
Conduct static and dynamic malware analysis, examine suspicious files and documents, and analyze system and network behavior to detect malicious activity.
Common questions about the exam itself
