Skip to content

CS Professional · Internal and Forensic Audit · Cyber Forensics

A forensic auditor at a Delhi bank finds that an insider copied customer files to a USB drive and then deleted them from the workstation. Which tool or technique is best suited to establish what was copied and when?

The best technique is analysing file system metadata, USB connection artefacts and recovering deleted files from the forensic image. These show what data was accessed or copied and when. Financial procedures like confirmations or depreciation recalculation cannot reveal digital activity on a workstation.

  1. AReview of the budget variance report for the department
  2. BExamination of file system metadata, USB connection artefacts and deleted-file recovery on the forensic imageCorrect
  3. CCircularisation of balance confirmations to customers
  4. DRecalculation of the depreciation schedule

Explanation

File system timestamps, registry or log artefacts of USB connections, and recovery of deleted entries from the image together show which files were accessed or copied and at what times. The other procedures are financial audit steps with no bearing on digital activity on the workstation.

Did you get it right without looking?

One question tells you little. A timed set on Cyber Forensics shows your real accuracy, how long you take and where you lose marks.

Practise Cyber ForensicsFree diagnostic mock

More Cyber Forensics questions