BSFS Digital Forensics and Cybercrime Investigation 1 — Questions and Answers
Question 1: The first step a digital forensic investigator should take when seizing a computer as evidence is to:
- Create a forensic bit-for-bit image of the storage media before any analysis (Correct answer)
- Open the computer and review files immediately
- Run antivirus software to clean malware
- Connect the drive to the internet to sync cloud data
Correct answer: Create a forensic bit-for-bit image of the storage media before any analysis
Creating a forensic image preserves the original evidence in an unaltered state, allowing analysis to be performed on the copy without modifying the original.
Question 2: A write blocker is used in digital forensics to:
- Prevent any data from being written to the original evidence drive during acquisition (Correct answer)
- Speed up the copying process of large hard drives
- Encrypt the forensic image after acquisition
- Block unauthorized internet access during analysis
Correct answer: Prevent any data from being written to the original evidence drive during acquisition
A write blocker intercepts write commands so the forensic investigator can read data from the original media without accidentally altering or adding any information.
Question 3: Hash values (MD5, SHA-256) are used in digital forensics primarily to:
- Verify that a forensic copy is an exact, unaltered duplicate of the original evidence (Correct answer)
- Encrypt sensitive case files during transmission
- Index and search large volumes of digital evidence quickly
- Detect malware hidden within image files
Correct answer: Verify that a forensic copy is an exact, unaltered duplicate of the original evidence
Matching hash values between the original and forensic copy mathematically proves the copy is identical, ensuring evidentiary integrity.
Question 4: Volatile memory in a computer (RAM) must be acquired before powering down the device because:
- It loses all data when power is removed, and may contain passwords, encryption keys, or running processes (Correct answer)
- RAM is the only place where deleted files are stored
- Encrypted drives can only be decrypted using RAM data
- Operating systems always delete RAM contents after shutdown
Correct answer: It loses all data when power is removed, and may contain passwords, encryption keys, or running processes
RAM is non-persistent storage; powering off destroys any data in memory, including live network connections, decryption keys, and running application data.
Question 5: The Tor network is relevant to cybercrime investigations because it:
- Anonymizes internet traffic by routing it through multiple encrypted nodes, concealing user identity (Correct answer)
- Provides direct access to suspect devices for law enforcement
- Stores criminal records in an encrypted darknet database
- Enables investigators to track IP addresses in real time
Correct answer: Anonymizes internet traffic by routing it through multiple encrypted nodes, concealing user identity
Tor routes traffic through a series of volunteer-operated relays, making it difficult to trace the originating IP address, which is commonly exploited for illegal activities on the dark web.
Question 6: File metadata in digital forensics can reveal which of the following?
- Creation, modification, and access timestamps, as well as file author and location (Correct answer)
- The actual content of encrypted files
- Whether a file was physically deleted from a drive
- The specific user who physically typed a document
Correct answer: Creation, modification, and access timestamps, as well as file author and location
Metadata embedded in files records important context such as when a file was created or modified, author name, GPS coordinates, and software version used.
BSFS Digital Forensics and Cybercrime Investigation 1
The first step a digital forensic investigator should take when seizing a computer as evidence is to: