Practice Test GeeksCCE - Certified Court Executive Practice Test
← All CCE Flashcard Decks

Digital Evidence Collection & Preservation Flashcards

7 cards from real CCE practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.

Read the first 7 Digital Evidence Collection & Preservation flashcards as text

  1. What is 'slack space' in the context of digital forensics?

    Answer: The space between the end of a file's actual data and the end of its allocated cluster

    Slack space is the remnant data that can exist between the logical end of a file and the physical end of the last cluster allocated to it, and may contain previously deleted data fragments.

  2. An examiner is imaging a 2TB hard drive using EnCase. Midway through acquisition, the hash verification fails. What should the examiner do?

    Answer: Re-image the drive from the beginning and document the failed attempt

    A failed hash verification means the image is not a reliable copy; the examiner must re-image the drive and document both the failure and the successful re-acquisition.

  3. Which of the following is NOT typically considered volatile data during a live system investigation?

    Answer: Files in the Recycle Bin

    Files in the Recycle Bin are stored on disk and persist after shutdown, making them non-volatile data unlike ARP cache, logged-in users, and open network sockets.

  4. What is the significance of ACPO (Association of Chief Police Officers) guidelines in digital forensics?

    Answer: They provide principles for handling digital evidence including non-alteration and documentation

    ACPO guidelines establish four key principles for digital evidence handling, most notably that original data must not be altered and all actions must be documented and auditable.

  5. During a corporate investigation, an examiner must collect email evidence from a cloud-based Exchange server. What legal instrument is typically required?

    Answer: A subpoena or court order directed at the cloud service provider

    To compel a third-party cloud provider to produce data, law enforcement typically requires a subpoena or court order under the Stored Communications Act or similar legislation.

  6. What is the purpose of using a Faraday bag when collecting a mobile device?

    Answer: To prevent remote wiping by isolating the device from wireless signals

    A Faraday bag blocks all wireless signals (cellular, Wi-Fi, Bluetooth) preventing remote commands — including remote wipe — from reaching the device after seizure.

  7. Which file system artifact is most useful for determining when a file was last accessed on an NTFS volume?

    Answer: The Master File Table (MFT) entry timestamps

    The MFT entry for each file on NTFS contains MACB timestamps (Modified, Accessed, Changed, Born) that record detailed time information about file activity.