ACE Evidence Acquisition & Preservation 2 — Questions and Answers
Question 1: When acquiring evidence from a live system, which method best preserves volatile memory that would be lost on shutdown?
- Create a static disk image only
- Perform a RAM dump before any disk imaging (Correct answer)
- Power off immediately and image the drive
- Clone the hard drive using a write-blocker
Correct answer: Perform a RAM dump before any disk imaging
RAM dump captures volatile memory contents (running processes, encryption keys, network connections) that are destroyed when power is removed.
Question 2: Which hashing algorithm is currently recommended for verifying forensic image integrity due to its collision resistance?
- MD5
- SHA-1
- SHA-256 (Correct answer)
- CRC-32
Correct answer: SHA-256
SHA-256 provides stronger collision resistance than MD5 or SHA-1, both of which have known vulnerabilities that undermine forensic integrity.
Question 3: A suspect's laptop is found with BitLocker encryption enabled and running. What is the FIRST action an examiner should take?
- Immediately pull the power cord
- Acquire a RAM dump to capture the encryption key (Correct answer)
- Boot into a live Linux environment
- Attach a write-blocker and image the disk
Correct answer: Acquire a RAM dump to capture the encryption key
Capturing a RAM dump first recovers the BitLocker key from memory, enabling decryption; powering off would destroy the key.
Question 4: What is the purpose of using a Faraday bag during mobile device acquisition?
- Prevent electrostatic discharge from damaging the device
- Block wireless signals to prevent remote wipe commands (Correct answer)
- Keep the device charged during transport
- Compress file system data for storage
Correct answer: Block wireless signals to prevent remote wipe commands
A Faraday bag blocks cellular, Wi-Fi, and Bluetooth signals, preventing remote wipe or data modification commands from reaching the device.
Question 5: In FTK Imager, what format produces a single-file image with integrated hashing, compression, and case metadata?
- DD (raw)
- E01 (Expert Witness Format) (Correct answer)
- AFF (Advanced Forensic Format)
- ISO 9660
Correct answer: E01 (Expert Witness Format)
E01 format embeds MD5/SHA-1 hashes, case metadata, and optional compression within a single segmented or monolithic file.
Question 6: Which action violates proper chain of custody during evidence handling?
- Photographing the evidence before collection
- Logging each person who accesses the evidence bag
- Allowing an untrained officer to handle the drive without documentation (Correct answer)
- Sealing evidence in a tamper-evident bag
Correct answer: Allowing an untrained officer to handle the drive without documentation
Allowing undocumented access by an untrained person creates a gap in chain of custody and may render the evidence inadmissible.
Question 7: What distinguishes a logical acquisition from a physical acquisition of a mobile device?
- Logical acquisition captures deleted data; physical does not
- Physical acquisition captures the complete bit-stream; logical captures only accessible files (Correct answer)
- Logical acquisition requires a write-blocker; physical does not
- Physical acquisition works only on iOS devices
Correct answer: Physical acquisition captures the complete bit-stream; logical captures only accessible files
Physical acquisition captures the entire raw storage including deleted and unallocated space, while logical acquisition retrieves only the active file system.
ACE Evidence Acquisition & Preservation 2
When acquiring evidence from a live system, which method best preserves volatile memory that would be lost on shutdown?