BSFS Digital Forensics and Cybercrime Investigation

Question 1

The first step a digital forensic investigator should take when seizing a computer as evidence is to:

Accepted Answer

Create a forensic bit-for-bit image of the storage media before any analysis

Answer

Creating a forensic image preserves the original evidence in an unaltered state, allowing analysis to be performed on the copy without modifying the original.

Question 2

A write blocker is used in digital forensics to:

Accepted Answer

Prevent any data from being written to the original evidence drive during acquisition

Answer

A write blocker intercepts write commands so the forensic investigator can read data from the original media without accidentally altering or adding any information.

Question 3

Hash values (MD5, SHA-256) are used in digital forensics primarily to:

Accepted Answer

Verify that a forensic copy is an exact, unaltered duplicate of the original evidence

Answer

Matching hash values between the original and forensic copy mathematically proves the copy is identical, ensuring evidentiary integrity.

Question 4

Volatile memory in a computer (RAM) must be acquired before powering down the device because:

Accepted Answer

It loses all data when power is removed, and may contain passwords, encryption keys, or running processes

Answer

RAM is non-persistent storage; powering off destroys any data in memory, including live network connections, decryption keys, and running application data.

Question 5

The Tor network is relevant to cybercrime investigations because it:

Accepted Answer

Anonymizes internet traffic by routing it through multiple encrypted nodes, concealing user identity

Answer

Tor routes traffic through a series of volunteer-operated relays, making it difficult to trace the originating IP address, which is commonly exploited for illegal activities on the dark web.

BSFS - Bachelor of Science in Forensic Science Practice Test

BSFS - Bachelor of Science in Forensic Science Practice Test

BSFS Digital Forensics and Cybercrime Investigation