CCD CCD Digital Forensics & Evidence Handling

Question 1

What is the 'order of volatility' in digital forensics?

Accepted Answer

The sequence for collecting evidence from most to least volatile (e.g., RAM before disk)

Answer

The order in which evidence expires legally

Answer

The priority list for patching systems

Answer

The ranking of security incidents by severity

Question 2

Which tool is commonly used to create a forensic bit-for-bit image of a hard drive in Linux?

Accepted Answer

dd or dcfldd

Answer

Nmap

Answer

Wireshark

Answer

Nessus

Question 3

What is the purpose of a 'chain of custody' document in digital forensics?

Accepted Answer

To record who had access to evidence and when, ensuring admissibility in court

Answer

To document the software patching history

Answer

To list all network hosts discovered

Answer

To track vulnerability remediation progress

Question 4

A forensic analyst acquires a disk image and computes its MD5 hash. Why is this hash computed again after analysis?

Accepted Answer

To verify the image has not been altered and evidence integrity is maintained

Answer

To compress the image file

Answer

To speed up file indexing

Answer

To encrypt the evidence file

Question 5

Which Windows artifact stores recently accessed files and application execution history useful in forensic investigations?

Accepted Answer

Prefetch files and LNK files (jump lists)

Answer

Pagefile.sys only

Answer

BIOS firmware logs

Answer

DNS cache only

Question 6

What is 'write blocking' in the context of digital forensics?

Accepted Answer

Using hardware or software to prevent any writes to the evidence drive during acquisition

Answer

Preventing log files from being overwritten

Answer

Blocking write access to the SIEM

Answer

Disabling SMB write shares