Professional development

Computer forensics interview questions

Computer forensic investigators are in high demand. Often referred to as digital forensics engineers, computer forensic investigators are expected to know basic IT skills, understand computer architecture and networking, can collaborate with various teams and write detailed reports. A digital forensics professional must have analytical and investigative skills and strong attention to detail.

Below are 25 interview questions to help you prepare for your next computer forensics interview.

Cybersecurity interview guide

Ace your next interview with tips from our free ebook, “How to stand out, get hired and advance your career.”

Download Now

What is MD5 checksum?

MD5 checksum is a 128-bit value that helps identify the uniqueness of a file. You can have two file names, but each will have a different checksum. You use these checksums to compare two different files to identify if they are the same.

What are common data sources used during investigations?

While there are many sources of data that computer forensic investigators use during `an investigation, the following are the most common:

•         Log files
•         Network traffic
•         System images
•         Databases
•         Application data
•         User data

Name some common encryption algorithms that are used to encrypt data

Some common ones include triple DES, RSA, Blowfish, Twofish and AES.

What is an .ISO file?

An ISO file contains an application or CD image of several files and executables. Most app software can be made into an ISO that you then mount as a virtual drive and can browse files within the ISO. New Windows versions come with internal ISO mounting capabilities.

What should you learn next?

From SOC Analyst to Secure Coder to Security Manager — our team of experts has 12 free training plans to help you hit your goals. Get your free copy now.

Get Your Plan

What is a SAM file?

A SAM, or Security Accounts Manager, file is used in Windows computers to store user passwords. It’s used to authenticate remote and local Windows users, and can be used to gain access to a user’s computer.

What is data mining?

Data mining is the process of recording as much data as possible to create reports and analysis on user input. For instance, you can mine data from various websites and then log user interactions with this data to evaluate which website areas are accessed by users when logged in.

What is data carving?

Data carving is different than data mining in that data carving searches through raw data on a hard drive without using a file system. It allows a computer forensic investigator to recover a deleted file from a hard drive. Data carving is essential for computer forensics investigators to find data when a hard drive’s data is corrupted.

What is geotagging?

Geotagging refers to the addition of geographic information to digital media. A standard geotagging method is adding GPS coordinates to data, photos, and videos. It can be used to track people and objects and add context to a file.

What type of email analysis experience do you have?

Computer forensics relies on email analysis. You should be experienced with email servers like MS Exchange and free web-based platforms like Gmail and Yahoo.

What is steganography?

Steganography conceals a message within a message. In other words, someone can send an email with content that says one thing, but every third word comprises a second message that makes sense to a recipient.

What are some common port numbers?

TCP port numbers are the virtual connections created by computers and applications. Common port numbers are 21 for FTP, 80 for web services, 25 for SMTP and 53 for DNS.

Describe the SHA-1 hash

The secure hash algorithm 1 is a hash algorithm that creates a 160-bit or 20-byte message digest.

Describe your experience with virtualization

Do not lie here. Be honest about your experience with virtualizations, but be sure to describe the virtual infrastructures you are familiar with, i.e., Virtualbox, VMWare, etc. Make sure you identify the types of operating systems you have dealt with. You do not have to prove you were a system administrator, but you need to at least understand virtual storage, partitioning, how to log into a virtual box and the benefits­­ — as well as the security issues — with virtualization. It can save a company money by combining the use of resources and minimizing the amount of hardware a company has to purchase. But if there are issues with VM sprawl, when an admin duplicates a machine and forgets about it, it creates a vulnerability because those machines are not patched or hardened. This is a prevalent issue.

How would you handle retrieving data from an encrypted hard drive?

First, determine the encryption method used. For simple encryption types, try finding the configuration file. Use tools such as EaseUS Data Recovery, Advanced EFS Data Recovery or Elcomsoft Forensic Disk Decryptor. You can also use brute force methods.

What port does DNS run over?

53

What are some security issues related to the Cloud? 

The biggest issue is the increased potential for data breaches or exfiltration and the potential for account hijacking. The Man in Cloud Attack is a new threat specific to Cloud usage. It is similar to the MitM attack, where an attacker steals the user token, which is used to verify devices without requiring additional logins. Cloud computing introduces insecure API usage, which is discussed on the OWASP Top 10 Vulnerabilities list.

Describe some of the vulnerabilities listed on the OWASP Top 10 Vulnerabilities list?

This list is updated yearly with the current top 10 application security risks. Cross-site scripting is one item that has been on the list year after year. But others on the current list include SQL, OS and LDAP injections, security misconfigurations, sensitive data exposure and under-protected APIs.

How can you tell at the hex level that a file has been deleted in FAT12?

Run fsstat against the FAT partition to gather details. Run fls to get information about the image files. This wroundround-upformation about deleted files and the metatdata information.

What are some tools used to recover deleted files?

Recuva, Pandora Recovery, ADRC data recovery,directionslete, Active UNDELETE, Active partition or File recovery and more. Read Infosec’s 7 best computer forensics tools for more on forensics tools. 

What is an embedded system?

An embedded system is a computer system installed on a device to perform certain tasks. Embedded systems can be found in many devices today, such as appliances, automobiles, and even toys. With the increasing commonality of the InternetThingsings (IoT), embedded systems will be an increasingly important source of information for computer forensic investigators.

How do you stay up to date on current cybersecurity trends?

This is a personal question; ensure you can share newsletters, websites and cybersecurity podcasts you visit often. These could include InfoSec’s Cybersecurity Weekly news round-up,  Cyberwire, IT whitepapers and podcasts or webinars from companies like Nessus, Metasploit and SANS.

How do you handle conflicting directions from different stakeholders?

This question is to see how you handle conflict. You would first consult your direct supervisor, explain the conflict and ask for guidance on how to proceed.

If you needed to encrypt and compress data for transmission, which would you do first and why?

Compress, then encrypt. Because encryption takes up resources and can be cumbersome to perform, it makes sense to compress the data first.

What is the difference between threat, vulnerability and risk?

A potential attacker poses a threat by potentially using a system vulnerability that was never identified as a risk. Using this answer provides context for the three terms together, but you can define them separately.

• A threat is the possibility of an attack.
• A vulnerability is a weakness in the system.
• Risks are items that may cause harm to the system or organization.

Describe your home network

In cybersecurity-related positions, interviewers often want to know your interest if security spills over into your personal life. Ensure you know your router's security features or your specific ISP. Be sure to mention any security measures you have added to your home network.

What should you learn next?

From SOC Analyst to Secure Coder to Security Manager — our team of experts has 12 free training plans to help you hit your goals. Get your free copy now.

Get Your Plan

Digital forensics interview tips if you lack experience

During the interview process, you may also be asked to describe your familiarity with various operating systems, your experience with Encase and/or FTK, or other tools. Computer forensics is still growing; many applicants have educational experience but need real-world experience. If you lack real-world experience, you can still discuss things you do in your spare time to stay updated with current trends and what separates you from other candidates. This is an in-demand field with ample opportunity. Good luck!

Sources

• Digital forensics interview questions, Climbtheladder.com