CCE Digital Evidence Collection & Preservation 5 — Questions and Answers
Question 1: What is 'chip-off' forensics and when is it typically employed?
- Removing the CPU to read cached memory from the processor registers
- Physically removing flash memory chips from a device to read them directly with specialized equipment (Correct answer)
- Disassembling a hard drive to read platters with an electron microscope
- Extracting SIM card data without the device's PIN
Correct answer: Physically removing flash memory chips from a device to read them directly with specialized equipment
Chip-off forensics involves physically desoldering and removing flash memory chips (NAND/NOR) from a device to read their raw contents when software-based acquisition methods fail.
Question 2: Under the Federal Rules of Evidence (FRE), what must be established for digital evidence to be considered authentic?
- The evidence must be encrypted using a government-approved algorithm
- The proponent must produce evidence sufficient to support a finding that the item is what it is claimed to be (Correct answer)
- The evidence must have been collected by a certified forensic examiner
- The evidence must be stored on WORM (Write Once Read Many) media
Correct answer: The proponent must produce evidence sufficient to support a finding that the item is what it is claimed to be
Under FRE Rule 901, authentication requires sufficient evidence to support a finding that the digital evidence is what the proponent claims, typically demonstrated through hash verification and chain of custody.
Question 3: What is the purpose of the 'best evidence rule' (FRE Rule 1002) in digital forensics?
- It requires investigators to use the highest quality forensic tools available
- It requires the original writing, recording, or photograph to prove its content, or a reliable duplicate (Correct answer)
- It mandates that only certified examiners can testify about digital evidence
- It requires evidence to be stored in a federally approved evidence repository
Correct answer: It requires the original writing, recording, or photograph to prove its content, or a reliable duplicate
The best evidence rule requires the original or a reliable duplicate (like a forensic image with verified hash) to prove the content of a recording, which is why forensic images are treated as equivalent to originals.
Question 4: An examiner receives a storage device that has been exposed to water. What is the recommended immediate action?
- Immediately power on the device to check if it still works
- Allow the device to air dry completely before any analysis attempt
- Submerge the device in distilled water to prevent oxidation until a specialist can examine it (Correct answer)
- Place the device in a freezer to slow down corrosion
Correct answer: Submerge the device in distilled water to prevent oxidation until a specialist can examine it
Keeping a water-damaged storage device submerged in distilled water prevents oxidation and corrosion while it awaits specialist recovery, as air exposure causes rust that can destroy the device.
Question 5: What is a 'hash set' and how is it used in digital evidence collection?
- A set of hardware tools used to compute hash values in the field
- A database of known file hash values used to identify known good or known bad files (Correct answer)
- A collection of hash algorithms applied simultaneously for stronger verification
- A security container for storing cryptographic keys used in evidence encryption
Correct answer: A database of known file hash values used to identify known good or known bad files
A hash set is a database of pre-computed hash values (such as NSRL for known good files or CAID for child exploitation material) used to quickly identify or exclude files during forensic examination.
Question 6: During evidence collection at a business, the examiner discovers the primary suspect's workstation is connected to a RAID array. How should the RAID array be handled?
- Image each individual drive separately without documenting the RAID configuration
- Document the RAID configuration and controller settings before disassembly, then image individually (Correct answer)
- Power off the RAID array immediately and seize only the drives without documentation
- Leave the RAID array in place and only image the suspect's workstation
Correct answer: Document the RAID configuration and controller settings before disassembly, then image individually
RAID configuration details (type, stripe size, drive order) must be documented before disassembly because this information is needed to reconstruct the logical volume from individual drive images.
Question 7: What is the forensic significance of the Windows $LogFile artifact on an NTFS volume?
- It stores a log of all user login attempts on the system
- It is the NTFS transaction log that records file system metadata changes, useful for timeline reconstruction (Correct answer)
- It contains application error logs generated by Windows Event Viewer
- It stores a history of all files accessed by Windows Explorer
Correct answer: It is the NTFS transaction log that records file system metadata changes, useful for timeline reconstruction
The NTFS $LogFile is a transaction journal that records file system metadata operations, allowing forensic examiners to reconstruct recent file creation, deletion, and modification events even after MFT entries are overwritten.
CCE Digital Evidence Collection & Preservation 5
What is 'chip-off' forensics and when is it typically employed?