112-57 Exam Preparation Material | EC-Council Digital Forensics Essentials (DFE)

Explanation:
RFC 3227’s “order of volatility” principle guides responders to collect the most perishable evidence first because some data can disappear immediately when power is lost, processes terminate, or the system state changes during response actions. The most volatile items are CPU registers and processor cache (4) because they change continuously at instruction speed and are lost instantly on shutdown or context switching. Next are routing table, process table, kernel statistics, and memory (3) because live RAM contents and active system tables can change within seconds and are lost if the machine is powered off or rebooted.
After volatile memory, temporary system files (7) are collected because they are frequently overwritten or cleaned by the OS, users, or malware. Then comes disk or other storage media (6) which is more persistent but still subject to modification, log rotation, and overwriting through normal activity; hence imaging should occur before extensive interaction.
Less volatile still are remote logging and monitoring data (2) since they may persist off-host, but can be rotated or altered by retention policies. Physical configuration and network topology (5) generally changes less frequently and can often be re-documented later. Finally, archival media (1) is the least volatile because it is typically write-once or preserved storage. Thus the correct sequence is 4→3→7→6→2→5→1 (Option B).

Explanation:
In forensic examinations, investigators must correctly interpret a disk’s partitioning scheme because it determines where volumes begin, where file systems reside, and how to validate acquisition completeness. Modern systems may use GPT (commonly associated with UEFI) while legacy systems often use MBR. A practical forensic command therefore needs to detect and parse partition information regardless of whether the disk uses MBR or GPT, and present the results in a consistent, investigator-friendly output for verification and downstream analysis (e.g., selecting the correct partition offsets for imaging or mounting).
Get-ForensicPartitionTable is designed for exactly this role in forensic PowerShell tooling: it parses partition table structures in a forensically oriented manner and supports disks partitioned using either MBR or GPT. That “forensic” emphasis typically means it reads raw structures directly, reports partition entries and offsets, and helps avoid ambiguity when the protective MBR (present on GPT disks) could confuse simplistic parsers.
By contrast, Get-BootSector targets boot sector/VBR data rather than the full partition layout; Get-GPT is GPT-specific and does not cover MBR-only disks; and Get-PartitionTable is a more generic label that may not guarantee dual-scheme forensic parsing. Therefore, the correct option is C.

Explanation:
The scenario describes an automated, trial-and-error attempt that tries all possible combinations of usernames and passwords until a correct credential pair is found. This is the defining characteristic of a brute-force attack. In digital forensics terminology, brute force is a direct password-guessing
method that relies on exhaustive attempts (or systematically generated candidates) rather than tricking the user or exploiting a software flaw. Investigators commonly recognize brute-force activity through artifacts such as repeated authentication failures in security logs, high-frequency login attempts from a single IP or distributed sources, account lockout events, and abnormal spikes in authentication traffic. In banking and web environments, it may also appear as repeated POST requests to login endpoints with varying credential pairs and consistent user-agent patterns, sometimes accompanied by throttling or CAPTCHA triggers.
The other options do not match the described “attempting all possible combinations” behavior. Phishing obtains credentials by deception (fake emails/sites). A Trojan horse steals data by running malicious code on the victim’s system. Data manipulation focuses on altering data integrity rather than credential guessing. Therefore, the correct attack type is Brute-force attack (A).

Explanation:
The UNIX/Linux dd utility performs a bit-by-bit (sector-by-sector) copy from an input device (such as a physical disk) to an output target (another device or a flat file). In digital forensics guidance, this type of output is known as a raw (bitstream) image because it captures the exact sequence of bytes from the source media without embedding structured case metadata, compression, or container features by default. The resulting file is often referred to as a “dd image” and may use extensions like .dd or .img, but the key point is the format is raw: it represents a straightforward byte-for-byte representation of the original storage, including allocated data, unallocated space, slack space, and file system structures.
By contrast, AFF and AFF4 are forensic container formats designed to store evidence data along with metadata (and often support features such as chunking, compression, and richer integrity structures). “Proprietary format” refers to vendor-specific containers (for example, formats created by certain commercial forensic tools) rather than the generic output produced by dd. Since Philip specifically used dd to create bit-by-bit disk images, the extracted acquisition image format is Raw Format (A).

Explanation:
SSH (Secure Shell) is specifically designed to provide an encrypted channel over an untrusted network. In digital forensics and incident response, SSH is well known for supporting tunneling/port forwarding, where traffic for another protocol (for example, HTTP, database connections, or remote desktop) is encapsulated inside an SSH session. Because the SSH session encrypts payload data (and can also protect authentication and command content), the tunneled traffic becomes obfuscated to network monitoring tools that can only see metadata such as source/destination IPs, port numbers (often TCP/22), timing, and byte counts. This capability is frequently discussed in forensic references as a mechanism that can hinder content inspection and complicate attribution of user actions purely from packet payload analysis.
By contrast, SNMP is primarily for network management and monitoring, not secure tunneling. ARP resolves IP-to-MAC addresses on local networks and does not provide encryption or tunneling. UDP is a transport protocol that can carry data for many applications but provides no built-in security or tunneling features by itself. Therefore, the protocol that creates secure tunneling enabling content obfuscation is SSH (C).
event logs) to establish user intent and sequence of actions. Therefore, the correct option is Browsing History View (B).