CCE Digital Evidence Collection & Preservation 4

Question 1

What does the acronym 'MACB' refer to in NTFS timestamp analysis?

Accepted Answer

Modified, Accessed, Changed, Born

Answer

MACB stands for Modified, Accessed, Changed (MFT entry changed), and Born (created), representing the four timestamps stored in NTFS MFT entries for each file.

Question 2

An investigator is collecting evidence from a crime scene involving cryptocurrency transactions. Which type of storage media is most critical to locate?

Accepted Answer

Hardware wallets and devices storing private keys

Answer

Hardware wallets store private keys in dedicated secure chips and represent direct control over cryptocurrency funds, making them the highest priority item in cryptocurrency investigations.

Question 3

What is 'timestamp manipulation' and why is it forensically significant?

Accepted Answer

The deliberate alteration of file system timestamps to obscure when files were created or modified

Answer

Timestamp manipulation is the intentional changing of file system timestamps to hide or alter the timeline of events, which is forensically significant as it represents evidence tampering.

Question 4

During evidence packaging, what should be used to package hard drives to protect against electrostatic discharge?

Accepted Answer

Anti-static bags and foam padding

Answer

Hard drives must be packaged in anti-static bags to prevent electrostatic discharge damage, combined with foam padding for physical shock protection during transport.

Question 5

What is the primary difference between a logical acquisition and a physical acquisition of a mobile device?

Accepted Answer

Logical acquisition is faster but only captures allocated files; physical acquisition captures the entire memory chip including deleted data

Answer

Logical acquisition extracts only allocated, accessible files through the OS, while physical acquisition captures a bit-for-bit image of the memory including deleted and unallocated space.

(CCE) Certified Computer Examiner Practice Test

(CCE) Certified Computer Examiner Practice Test

CCE Digital Evidence Collection & Preservation 4