BSFS Digital Forensics and Cybercrime Investigation

Question 1

The first step a digital forensic investigator should take when seizing a computer as evidence is to:

Accepted Answer

Create a forensic bit-for-bit image of the storage media before any analysis

Answer

Open the computer and review files immediately

Answer

Run antivirus software to clean malware

Answer

Connect the drive to the internet to sync cloud data

Question 2

A write blocker is used in digital forensics to:

Accepted Answer

Prevent any data from being written to the original evidence drive during acquisition

Answer

Speed up the copying process of large hard drives

Answer

Encrypt the forensic image after acquisition

Answer

Block unauthorized internet access during analysis

Question 3

Hash values (MD5, SHA-256) are used in digital forensics primarily to:

Accepted Answer

Verify that a forensic copy is an exact, unaltered duplicate of the original evidence

Answer

Encrypt sensitive case files during transmission

Answer

Index and search large volumes of digital evidence quickly

Answer

Detect malware hidden within image files

Question 4

Volatile memory in a computer (RAM) must be acquired before powering down the device because:

Accepted Answer

It loses all data when power is removed, and may contain passwords, encryption keys, or running processes

Answer

RAM is the only place where deleted files are stored

Answer

Encrypted drives can only be decrypted using RAM data

Answer

Operating systems always delete RAM contents after shutdown

Question 5

The Tor network is relevant to cybercrime investigations because it:

Accepted Answer

Anonymizes internet traffic by routing it through multiple encrypted nodes, concealing user identity

Answer

Provides direct access to suspect devices for law enforcement

Answer

Stores criminal records in an encrypted darknet database

Answer

Enables investigators to track IP addresses in real time

Question 6

File metadata in digital forensics can reveal which of the following?

Accepted Answer

Creation, modification, and access timestamps, as well as file author and location

Answer

The actual content of encrypted files

Answer

Whether a file was physically deleted from a drive

Answer

The specific user who physically typed a document