CCE Digital Evidence Collection & Preservation 3 — Questions and Answers
Question 1: What is 'slack space' in the context of digital forensics?
- Unused storage capacity on an unpartitioned drive
- The space between the end of a file's actual data and the end of its allocated cluster (Correct answer)
- Free space available for new file storage
- Space reserved by the OS for system files
Correct answer: The space between the end of a file's actual data and the end of its allocated cluster
Slack space is the remnant data that can exist between the logical end of a file and the physical end of the last cluster allocated to it, and may contain previously deleted data fragments.
Question 2: An examiner is imaging a 2TB hard drive using EnCase. Midway through acquisition, the hash verification fails. What should the examiner do?
- Accept the image and note the discrepancy in the report
- Re-image the drive from the beginning and document the failed attempt (Correct answer)
- Continue with the partial image and hash what was collected
- Use a different imaging tool and compare results
Correct answer: Re-image the drive from the beginning and document the failed attempt
A failed hash verification means the image is not a reliable copy; the examiner must re-image the drive and document both the failure and the successful re-acquisition.
Question 3: Which of the following is NOT typically considered volatile data during a live system investigation?
- ARP cache entries
- Currently logged-in users
- Files in the Recycle Bin (Correct answer)
- Open network sockets
Correct answer: Files in the Recycle Bin
Files in the Recycle Bin are stored on disk and persist after shutdown, making them non-volatile data unlike ARP cache, logged-in users, and open network sockets.
Question 4: What is the significance of ACPO (Association of Chief Police Officers) guidelines in digital forensics?
- They define encryption standards for evidence storage
- They provide principles for handling digital evidence including non-alteration and documentation (Correct answer)
- They establish minimum hardware requirements for forensic workstations
- They govern cross-border evidence sharing between countries
Correct answer: They provide principles for handling digital evidence including non-alteration and documentation
ACPO guidelines establish four key principles for digital evidence handling, most notably that original data must not be altered and all actions must be documented and auditable.
Question 5: During a corporate investigation, an examiner must collect email evidence from a cloud-based Exchange server. What legal instrument is typically required?
- A forensic preservation order only
- A subpoena or court order directed at the cloud service provider (Correct answer)
- Written consent from the company's IT department
- A letter rogatory from a foreign court
Correct answer: A subpoena or court order directed at the cloud service provider
To compel a third-party cloud provider to produce data, law enforcement typically requires a subpoena or court order under the Stored Communications Act or similar legislation.
Question 6: What is the purpose of using a Faraday bag when collecting a mobile device?
- To protect the device screen from physical damage
- To prevent remote wiping by isolating the device from wireless signals (Correct answer)
- To preserve battery life during transport
- To prevent static electricity from corrupting flash memory
Correct answer: To prevent remote wiping by isolating the device from wireless signals
A Faraday bag blocks all wireless signals (cellular, Wi-Fi, Bluetooth) preventing remote commands — including remote wipe — from reaching the device after seizure.
Question 7: Which file system artifact is most useful for determining when a file was last accessed on an NTFS volume?
- The Master File Table (MFT) entry timestamps (Correct answer)
- The file's MD5 hash value
- The Volume Shadow Copy timestamp
- The Prefetch file header
Correct answer: The Master File Table (MFT) entry timestamps
The MFT entry for each file on NTFS contains MACB timestamps (Modified, Accessed, Changed, Born) that record detailed time information about file activity.
CCE Digital Evidence Collection & Preservation 3
What is 'slack space' in the context of digital forensics?