CCE Digital Evidence Collection & Preservation 2 — Questions and Answers
Question 1: Which of the following best describes the concept of 'write blocking' in digital forensics?
- Preventing any data from being written to the evidence drive during acquisition (Correct answer)
- Encrypting the evidence drive before imaging
- Compressing data on the evidence drive to save space
- Blocking network access to the evidence drive
Correct answer: Preventing any data from being written to the evidence drive during acquisition
Write blockers prevent any write operations to the source evidence drive, ensuring the original data remains unaltered during forensic acquisition.
Question 2: A forensic examiner needs to collect volatile data from a live Windows system. What should be collected FIRST?
- Running processes and network connections
- Contents of the RAM (Correct answer)
- Windows registry hives
- Contents of the paging file
Correct answer: Contents of the RAM
RAM contents are the most volatile and will be lost immediately upon shutdown, so they must be captured before any other volatile data collection.
Question 3: What is the primary purpose of creating a forensic image rather than copying files individually?
- To save storage space on the forensic workstation
- To capture all data including deleted files, slack space, and unallocated space (Correct answer)
- To speed up the data transfer process
- To automatically decrypt encrypted partitions
Correct answer: To capture all data including deleted files, slack space, and unallocated space
A forensic image captures the entire bit-for-bit copy of the storage medium, preserving deleted files, slack space, and unallocated space that individual file copies would miss.
Question 4: During evidence collection, an examiner discovers the suspect's laptop has full disk encryption enabled and is currently powered on. What is the recommended action?
- Immediately power off the device to prevent data destruction
- Perform a live acquisition before shutting down (Correct answer)
- Remove the hard drive and use a hardware decryption tool
- Submit the device to the lab without any on-site action
Correct answer: Perform a live acquisition before shutting down
When an encrypted device is powered on and unlocked, a live acquisition should be performed to capture the decrypted data before the device is shut down and encryption re-engages.
Question 5: What does the term 'chain of custody' refer to in digital forensics?
- The sequence of hashing algorithms applied to evidence
- The documented chronological history of who handled, collected, and transferred evidence (Correct answer)
- The order in which evidence items are processed in the lab
- The hierarchy of approvals needed to access evidence
Correct answer: The documented chronological history of who handled, collected, and transferred evidence
Chain of custody is the chronological documentation showing the seizure, custody, control, transfer, and analysis of evidence, ensuring its integrity and admissibility.
Question 6: Which hashing algorithm is currently recommended by NIST for verifying the integrity of forensic images?
- MD5
- SHA-1
- SHA-256 (Correct answer)
- CRC-32
Correct answer: SHA-256
SHA-256 is the current NIST-recommended hashing algorithm as MD5 and SHA-1 have known collision vulnerabilities that could undermine evidence integrity verification.
Question 7: A first responder arrives at a scene where a desktop computer is running. Network cables are connected. What should be done regarding the network connection?
- Leave the network connected to monitor traffic
- Disconnect the network cable immediately to prevent remote data destruction
- Take a screenshot of network activity then disconnect
- Document the connection state before deciding whether to disconnect (Correct answer)
Correct answer: Document the connection state before deciding whether to disconnect
The examiner should document the current state of network connections before taking any action, as the decision to disconnect depends on case specifics and may need to be justified later.
CCE Digital Evidence Collection & Preservation 2
Which of the following best describes the concept of 'write blocking' in digital forensics?