300-215 Question 176
Select 3During an investigation involving a compromised endpoint, a forensic analyst notices that logs from the device have been manipulated. Additionally, the attacker used a VPN service to obscure their location and employed a tool to overwrite deleted files. Which of the following antiforensic techniques were likely used in this scenario?
- A
Geo location obfuscation
- B
Evading detection
- C
Data destruction
- D
Hindering forensics
Show answer and explanation
Correct answers: A, C, D
Explanation
The attacker employed multiple antiforensic techniques to obstruct the forensic investigation. By using a VPN, they obscured their geo location (Geo location obfuscation). Manipulating logs is a classic example of hindering forensics, while using a tool to overwrite deleted files falls under data destruction. These tactics collectively demonstrate an effort to evade identification and forensic analysis.
- A. Correct.
Geo location obfuscation refers to techniques such as using VPNs or proxies to hide the true geographic location of the attacker. This was evident in the use of a VPN in this scenario.
- B. Incorrect.
Evading detection generally involves methods such as avoiding triggering security alerts or bypassing monitoring systems. While important, this specific scenario does not directly indicate the use of evasion techniques.
- C. Correct.
Data destruction involves techniques to remove or overwrite data to make it unrecoverable, as seen with the tool used to overwrite deleted files in this case.
- D. Correct.
Hindering forensics refers to efforts to disrupt or manipulate forensic investigations, such as tampering with logs, as observed in this scenario.