ALISON Digital Forensics & Cybercrime Investigation 1 — Questions and Answers
Question 1: What is the primary purpose of maintaining a 'chain of custody' in digital forensics?
- To speed up the evidence collection process
- To ensure digital evidence remains admissible and unaltered throughout an investigation (Correct answer)
- To share evidence with law enforcement agencies quickly
- To encrypt all collected evidence files
Correct answer: To ensure digital evidence remains admissible and unaltered throughout an investigation
Chain of custody documents every person who handled evidence and every action taken, ensuring its integrity and legal admissibility in court.
Question 2: Which principle in digital forensics states that any contact between two items leaves a trace?
- Occam's Razor
- Locard's Exchange Principle (Correct answer)
- Shannon's Information Theory
- Bell-LaPadula Model
Correct answer: Locard's Exchange Principle
Locard's Exchange Principle states that every contact leaves a trace, which in digital forensics means system interactions leave artifacts like logs and metadata.
Question 3: What is the correct order of volatility in digital evidence collection?
- Disk → RAM → Network → CPU registers
- CPU registers → RAM → Network → Disk (Correct answer)
- Network → Disk → RAM → CPU registers
- RAM → Disk → CPU registers → Network
Correct answer: CPU registers → RAM → Network → Disk
Evidence should be collected from most volatile (CPU registers, cache) to least volatile (disk) to preserve the most transient data first.
Question 4: What is a 'forensic image' in digital forensics?
- A screenshot taken during an investigation
- A bit-for-bit copy of a storage device including unallocated space (Correct answer)
- A photograph of the crime scene equipment
- An encrypted backup of the suspect's files
Correct answer: A bit-for-bit copy of a storage device including unallocated space
A forensic image is an exact sector-by-sector copy of a storage medium that captures all data including deleted files and unallocated space.
Question 5: What tool is commonly used on Linux/Unix systems to create a forensic bit-stream image of a drive?
- Wireshark
- Metasploit
- dd (Correct answer)
- Nmap
Correct answer: dd
The dd command creates a raw bit-stream copy of a device, making it one of the most fundamental forensic imaging tools on Unix-like systems.
Question 6: Which hashing algorithm is most commonly used to verify the integrity of forensic disk images?
- MD5 or SHA-1/SHA-256 (Correct answer)
- DES
- RSA-2048
- AES-256
Correct answer: MD5 or SHA-1/SHA-256
MD5 and SHA-256 hash values are calculated before and after imaging to verify that the forensic copy is identical to the original.
ALISON Digital Forensics & Cybercrime Investigation 1
What is the primary purpose of maintaining a 'chain of custody' in digital forensics?