CCD CCD Digital Forensics & Evidence Handling

Question 1

What is the 'order of volatility' in digital forensics?

Accepted Answer

The sequence for collecting evidence from most to least volatile (e.g., RAM before disk)

Answer

The order of volatility guides forensic investigators to collect the most transient evidence first (e.g., RAM, network connections) before it disappears.

Question 2

Which tool is commonly used to create a forensic bit-for-bit image of a hard drive in Linux?

Accepted Answer

dd or dcfldd

Answer

`dd` and `dcfldd` are standard Linux utilities used to create forensic bit-for-bit disk images while preserving evidence integrity.

Question 3

What is the purpose of a 'chain of custody' document in digital forensics?

Accepted Answer

To record who had access to evidence and when, ensuring admissibility in court

Answer

Chain of custody documentation records every person who handled the evidence and all actions taken, ensuring the evidence remains admissible and untampered in legal proceedings.

Question 4

A forensic analyst acquires a disk image and computes its MD5 hash. Why is this hash computed again after analysis?

Accepted Answer

To verify the image has not been altered and evidence integrity is maintained

Answer

Recomputing the hash after analysis confirms the disk image remains unchanged, demonstrating evidence integrity and supporting admissibility.

Question 5

Which Windows artifact stores recently accessed files and application execution history useful in forensic investigations?

Accepted Answer

Prefetch files and LNK files (jump lists)

Answer

Windows Prefetch files record application execution history, and LNK/jump list files record recently opened files, both valuable for forensic timeline reconstruction.

(CCD) Certified Cyber Defender Practice Test

(CCD) Certified Cyber Defender Practice Test

CCD CCD Digital Forensics & Evidence Handling