CCE Digital Evidence Collection & Preservation 3

Question 1

What is 'slack space' in the context of digital forensics?

Accepted Answer

The space between the end of a file's actual data and the end of its allocated cluster

Answer

Slack space is the remnant data that can exist between the logical end of a file and the physical end of the last cluster allocated to it, and may contain previously deleted data fragments.

Question 2

An examiner is imaging a 2TB hard drive using EnCase. Midway through acquisition, the hash verification fails. What should the examiner do?

Accepted Answer

Re-image the drive from the beginning and document the failed attempt

Answer

A failed hash verification means the image is not a reliable copy; the examiner must re-image the drive and document both the failure and the successful re-acquisition.

Question 3

Which of the following is NOT typically considered volatile data during a live system investigation?

Accepted Answer

Files in the Recycle Bin

Answer

Files in the Recycle Bin are stored on disk and persist after shutdown, making them non-volatile data unlike ARP cache, logged-in users, and open network sockets.

Question 4

What is the significance of ACPO (Association of Chief Police Officers) guidelines in digital forensics?

Accepted Answer

They provide principles for handling digital evidence including non-alteration and documentation

Answer

ACPO guidelines establish four key principles for digital evidence handling, most notably that original data must not be altered and all actions must be documented and auditable.

Question 5

During a corporate investigation, an examiner must collect email evidence from a cloud-based Exchange server. What legal instrument is typically required?

Accepted Answer

A subpoena or court order directed at the cloud service provider

Answer

To compel a third-party cloud provider to produce data, law enforcement typically requires a subpoena or court order under the Stored Communications Act or similar legislation.

(CCE) Certified Computer Examiner Practice Test

(CCE) Certified Computer Examiner Practice Test

CCE Digital Evidence Collection & Preservation 3