300-215 Question 179
Select 2During a forensic investigation of a compromised system, you detect that a threat actor has modified file timestamps and used a VPN to route their traffic through multiple countries. Which antiforensic techniques are being utilized in this scenario?
- A
Geo location manipulation
- B
Data obfuscation
- C
Evading detection
- D
Hindering forensics
- E
Data destruction
Show answer and explanation
Correct answers: A, C
Explanation
The threat actor in this scenario is employing geo location manipulation by using a VPN to obscure their true location and evade detection by altering file timestamps. These antiforensic techniques make it harder for investigators to trace the origin of the attack and correlate evidence accurately.
- A. Correct.
Geo location manipulation involves using tools like VPNs or proxies to route traffic through different countries, making it harder to trace the origin of the activity. This is relevant in this scenario.
- B. Incorrect.
Data obfuscation refers to techniques like encryption or encoding to hide data content. This technique is not directly observed in the scenario described.
- C. Correct.
Evading detection involves actions like modifying timestamps or using techniques that make it harder for investigators to identify malicious activity. The threat actor's actions here align with this technique.
- D. Incorrect.
Hindering forensics involves deliberately impeding forensic processes, such as corrupting logs or deleting evidence. While impactful, this specific technique is not evident in the scenario.
- E. Incorrect.
Data destruction refers to the deliberate erasure or wiping of data to eliminate traces of activity. This is not mentioned in the scenario.