CCE Digital Evidence Collection & Preservation 5

Question 1

What is 'chip-off' forensics and when is it typically employed?

Accepted Answer

Physically removing flash memory chips from a device to read them directly with specialized equipment

Answer

Chip-off forensics involves physically desoldering and removing flash memory chips (NAND/NOR) from a device to read their raw contents when software-based acquisition methods fail.

Question 2

Under the Federal Rules of Evidence (FRE), what must be established for digital evidence to be considered authentic?

Accepted Answer

The proponent must produce evidence sufficient to support a finding that the item is what it is claimed to be

Answer

Under FRE Rule 901, authentication requires sufficient evidence to support a finding that the digital evidence is what the proponent claims, typically demonstrated through hash verification and chain of custody.

Question 3

What is the purpose of the 'best evidence rule' (FRE Rule 1002) in digital forensics?

Accepted Answer

It requires the original writing, recording, or photograph to prove its content, or a reliable duplicate

Answer

The best evidence rule requires the original or a reliable duplicate (like a forensic image with verified hash) to prove the content of a recording, which is why forensic images are treated as equivalent to originals.

Question 4

An examiner receives a storage device that has been exposed to water. What is the recommended immediate action?

Accepted Answer

Submerge the device in distilled water to prevent oxidation until a specialist can examine it

Answer

Keeping a water-damaged storage device submerged in distilled water prevents oxidation and corrosion while it awaits specialist recovery, as air exposure causes rust that can destroy the device.

Question 5

What is a 'hash set' and how is it used in digital evidence collection?

Accepted Answer

A database of known file hash values used to identify known good or known bad files

Answer

A hash set is a database of pre-computed hash values (such as NSRL for known good files or CAID for child exploitation material) used to quickly identify or exclude files during forensic examination.

(CCE) Certified Computer Examiner Practice Test

(CCE) Certified Computer Examiner Practice Test

CCE Digital Evidence Collection & Preservation 5