ACE Digital Forensic Principles & Methodologies 2

Question 1

Which legal doctrine requires that digital evidence be obtained through lawful means to be admissible in court?

Accepted Answer

Fruit of the poisonous tree

Answer

The 'fruit of the poisonous tree' doctrine excludes evidence derived from an illegal search or seizure.

Question 2

During a forensic investigation, an examiner discovers a file with a .jpg extension but the file header shows it is actually a ZIP archive. What technique was used?

Accepted Answer

File signature spoofing

Answer

File signature spoofing involves changing a file's extension to disguise its true type, which can be detected by comparing the header magic bytes to the extension.

Question 3

What is the primary purpose of a write blocker in digital forensics?

Accepted Answer

To prevent modification of the source evidence drive

Answer

A write blocker prevents any write commands from reaching the evidence drive, ensuring the original data is not altered during acquisition.

Question 4

Which of the following best describes 'slack space' in digital forensics?

Accepted Answer

Space between the end of a file and the end of its last cluster

Answer

Slack space is the unused space between the end of a file's data and the end of the last cluster allocated to that file.

Question 5

An investigator must examine a live running system before powering it down. What type of data should be collected first due to its volatile nature?

Accepted Answer

RAM contents and running processes

Answer

RAM contents, running processes, and network connections are volatile and lost when the system powers down, so they must be captured first.

(ACE) AccessData Certified Examiner Practice Test

(ACE) AccessData Certified Examiner Practice Test

ACE Digital Forensic Principles & Methodologies 2