ACE Digital Forensic Principles & Methodologies 2 — Questions and Answers
Question 1: Which legal doctrine requires that digital evidence be obtained through lawful means to be admissible in court?
- Fruit of the poisonous tree (Correct answer)
- Chain of custody
- Best evidence rule
- Hearsay exception
Correct answer: Fruit of the poisonous tree
The 'fruit of the poisonous tree' doctrine excludes evidence derived from an illegal search or seizure.
Question 2: During a forensic investigation, an examiner discovers a file with a .jpg extension but the file header shows it is actually a ZIP archive. What technique was used?
- Steganography
- File signature spoofing (Correct answer)
- Data carving
- Slack space hiding
Correct answer: File signature spoofing
File signature spoofing involves changing a file's extension to disguise its true type, which can be detected by comparing the header magic bytes to the extension.
Question 3: What is the primary purpose of a write blocker in digital forensics?
- To speed up data acquisition
- To prevent modification of the source evidence drive (Correct answer)
- To encrypt the forensic image
- To verify hash values after acquisition
Correct answer: To prevent modification of the source evidence drive
A write blocker prevents any write commands from reaching the evidence drive, ensuring the original data is not altered during acquisition.
Question 4: Which of the following best describes 'slack space' in digital forensics?
- Unallocated space at the end of a partition
- Space between the end of a file and the end of its last cluster (Correct answer)
- Space reserved for the file system metadata
- Empty sectors at the beginning of a disk
Correct answer: Space between the end of a file and the end of its last cluster
Slack space is the unused space between the end of a file's data and the end of the last cluster allocated to that file.
Question 5: An investigator must examine a live running system before powering it down. What type of data should be collected first due to its volatile nature?
- Registry hives
- RAM contents and running processes (Correct answer)
- Hard drive contents
- Browser history files
Correct answer: RAM contents and running processes
RAM contents, running processes, and network connections are volatile and lost when the system powers down, so they must be captured first.
Question 6: What does the term 'metadata' refer to in the context of digital forensics?
- The actual content of a file
- Data that describes or provides information about other data (Correct answer)
- Encrypted data within a file system
- The index table of a file system
Correct answer: Data that describes or provides information about other data
Metadata is data that provides information about other data, such as file creation dates, author information, and GPS coordinates in photos.
Question 7: Which standard model outlines the phases of a digital forensic investigation including identification, preservation, collection, examination, analysis, and presentation?
- NIST SP 800-86 (Correct answer)
- RFC 3227
- ISO/IEC 27037
- SWGDE Best Practices
Correct answer: NIST SP 800-86
NIST SP 800-86 (Guide to Integrating Forensic Techniques into Incident Response) outlines a forensic process model with identification, collection, examination, and analysis phases.
ACE Digital Forensic Principles & Methodologies 2
Which legal doctrine requires that digital evidence be obtained through lawful means to be admissible in court?