CCD CCD Digital Forensics & Evidence Handling 1 — Questions and Answers
Question 1: What is the 'order of volatility' in digital forensics?
- The order in which evidence expires legally
- The sequence for collecting evidence from most to least volatile (e.g., RAM before disk) (Correct answer)
- The priority list for patching systems
- The ranking of security incidents by severity
Correct answer: The sequence for collecting evidence from most to least volatile (e.g., RAM before disk)
The order of volatility guides forensic investigators to collect the most transient evidence first (e.g., RAM, network connections) before it disappears.
Question 2: Which tool is commonly used to create a forensic bit-for-bit image of a hard drive in Linux?
- Nmap
- dd or dcfldd (Correct answer)
- Wireshark
- Nessus
Correct answer: dd or dcfldd
`dd` and `dcfldd` are standard Linux utilities used to create forensic bit-for-bit disk images while preserving evidence integrity.
Question 3: What is the purpose of a 'chain of custody' document in digital forensics?
- To document the software patching history
- To record who had access to evidence and when, ensuring admissibility in court (Correct answer)
- To list all network hosts discovered
- To track vulnerability remediation progress
Correct answer: To record who had access to evidence and when, ensuring admissibility in court
Chain of custody documentation records every person who handled the evidence and all actions taken, ensuring the evidence remains admissible and untampered in legal proceedings.
Question 4: A forensic analyst acquires a disk image and computes its MD5 hash. Why is this hash computed again after analysis?
- To compress the image file
- To verify the image has not been altered and evidence integrity is maintained (Correct answer)
- To speed up file indexing
- To encrypt the evidence file
Correct answer: To verify the image has not been altered and evidence integrity is maintained
Recomputing the hash after analysis confirms the disk image remains unchanged, demonstrating evidence integrity and supporting admissibility.
Question 5: Which Windows artifact stores recently accessed files and application execution history useful in forensic investigations?
- Pagefile.sys only
- Prefetch files and LNK files (jump lists) (Correct answer)
- BIOS firmware logs
- DNS cache only
Correct answer: Prefetch files and LNK files (jump lists)
Windows Prefetch files record application execution history, and LNK/jump list files record recently opened files, both valuable for forensic timeline reconstruction.
Question 6: What is 'write blocking' in the context of digital forensics?
- Preventing log files from being overwritten
- Using hardware or software to prevent any writes to the evidence drive during acquisition (Correct answer)
- Blocking write access to the SIEM
- Disabling SMB write shares
Correct answer: Using hardware or software to prevent any writes to the evidence drive during acquisition
Write blockers are hardware or software devices that prevent any modification to the original evidence drive during forensic acquisition, preserving evidence integrity.
CCD CCD Digital Forensics & Evidence Handling 1
What is the 'order of volatility' in digital forensics?