ACE Foundational Concepts & Principles 2 — Questions and Answers
Question 1: In digital forensics, what does the term 'chain of custody' primarily ensure?
- Evidence is encrypted during transport
- A documented trail of who handled evidence and when (Correct answer)
- Evidence is stored in a secure facility
- All evidence is duplicated before analysis
Correct answer: A documented trail of who handled evidence and when
Chain of custody documents every person who handled the evidence and when, ensuring its integrity and admissibility in court.
Question 2: What is the primary purpose of write-blocking hardware in digital forensics?
- To speed up the imaging process
- To prevent any data from being written to the original evidence drive (Correct answer)
- To encrypt data on the source drive
- To verify the hash of the destination drive
Correct answer: To prevent any data from being written to the original evidence drive
Write blockers prevent any modifications to the original evidence drive during the imaging or examination process.
Question 3: Which file system metadata attribute records the last time a file's content was modified on NTFS?
- $MFT entry creation time
- Last Written time ($STANDARD_INFORMATION) (Correct answer)
- Last Accessed time
- Entry Modified time ($STANDARD_INFORMATION)
Correct answer: Last Written time ($STANDARD_INFORMATION)
The Last Written timestamp in $STANDARD_INFORMATION records when the file's data content was last changed.
Question 4: What forensic principle states that 'every contact leaves a trace'?
- Daubert Standard
- Locard's Exchange Principle (Correct answer)
- Best Evidence Rule
- Frye Standard
Correct answer: Locard's Exchange Principle
Locard's Exchange Principle, developed by Edmond Locard, states that any contact between two objects results in an exchange of material.
Question 5: In FTK, what is a 'case' most accurately described as?
- A single evidence file ready for hashing
- A container that organizes evidence, bookmarks, and analysis data for an investigation (Correct answer)
- A report template for court submission
- A database of known file hashes
Correct answer: A container that organizes evidence, bookmarks, and analysis data for an investigation
In FTK, a case is the organizational unit that holds all evidence items, bookmarks, labels, and analysis results for a specific investigation.
Question 6: What does 'slack space' refer to in digital forensics?
- Unallocated disk space between partitions
- The unused space between the end of a file and the end of its last cluster (Correct answer)
- Space reserved by the operating system for virtual memory
- Empty sectors at the beginning of a drive
Correct answer: The unused space between the end of a file and the end of its last cluster
Slack space is the unused area from the logical end of a file to the end of the last cluster allocated to it, which may contain remnant data.
Question 7: Which of the following best describes 'volatile data' in a forensic investigation?
- Data stored permanently on hard drives
- Data that is lost when power is removed from a system (Correct answer)
- Encrypted data requiring decryption keys
- Data stored in backup tapes
Correct answer: Data that is lost when power is removed from a system
Volatile data, such as RAM contents, running processes, and network connections, is lost when the system loses power.
ACE Foundational Concepts & Principles 2
In digital forensics, what does the term 'chain of custody' primarily ensure?