CCD Digital Forensics & Evidence Handling Flashcards

What is the 'order of volatility' in digital forensics?

Answer: The sequence for collecting evidence from most to least volatile (e.g., RAM before disk)

The order of volatility guides forensic investigators to collect the most transient evidence first (e.g., RAM, network connections) before it disappears.

Which tool is commonly used to create a forensic bit-for-bit image of a hard drive in Linux?

Answer: dd or dcfldd

`dd` and `dcfldd` are standard Linux utilities used to create forensic bit-for-bit disk images while preserving evidence integrity.

What is the purpose of a 'chain of custody' document in digital forensics?

Answer: To record who had access to evidence and when, ensuring admissibility in court

Chain of custody documentation records every person who handled the evidence and all actions taken, ensuring the evidence remains admissible and untampered in legal proceedings.

A forensic analyst acquires a disk image and computes its MD5 hash. Why is this hash computed again after analysis?

Answer: To verify the image has not been altered and evidence integrity is maintained

Recomputing the hash after analysis confirms the disk image remains unchanged, demonstrating evidence integrity and supporting admissibility.

Which Windows artifact stores recently accessed files and application execution history useful in forensic investigations?

Answer: Prefetch files and LNK files (jump lists)

Windows Prefetch files record application execution history, and LNK/jump list files record recently opened files, both valuable for forensic timeline reconstruction.

What is 'write blocking' in the context of digital forensics?

Answer: Using hardware or software to prevent any writes to the evidence drive during acquisition

Write blockers are hardware or software devices that prevent any modification to the original evidence drive during forensic acquisition, preserving evidence integrity.