Digital Evidence Collection and Preservation Flashcards
6 cards from real CFE practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 Digital Evidence Collection and Preservation flashcards as text
What is the primary purpose of a write blocker in digital forensics?
Answer: To prevent changes to the original media
A write blocker is an essential hardware or software tool in digital forensics designed to prevent any data from being written to the original evidence media. Its primary purpose is to maintain the integrity and authenticity of the digital evidence by ensuring it remains unaltered during the acquisition process. This preserves the original state of the evidence for legal admissibility.
Which of the following best describes the chain of custody?
Answer: A log of evidence handling
The chain of custody is a meticulously documented chronological record that tracks the seizure, collection, handling, analysis, and storage of physical and digital evidence. It is crucial for maintaining the integrity and admissibility of evidence in legal proceedings. This log proves that the evidence has not been tampered with and accounts for every person who handled it.
What is the first step in digital evidence collection?
Answer: Securing the scene
Before any digital evidence can be collected, the first and most critical step is to secure the scene. This involves identifying the scope of the incident, isolating devices to prevent further data alteration, and thoroughly documenting the environment. Securing the scene ensures the preservation of potential evidence in its original state, which is vital for forensic integrity.
Which file format is commonly used for forensic disk images?
Answer: E01
The E01 format, also known as the EnCase Evidence File format, is a widely accepted and robust standard for forensic disk images. It stores a bit-for-bit copy of the original media, along with crucial metadata, hash values, and case information. This comprehensive format ensures the integrity, completeness, and defensibility of the acquired digital evidence.
Why is hashing important in digital forensics?
Answer: To ensure data integrity
Hashing in digital forensics involves creating a unique digital fingerprint (hash value) of a piece of evidence, such as a file or an entire drive. This hash value serves as a cryptographic checksum, allowing forensic examiners to verify that the evidence has not been altered or corrupted since its acquisition. This process is fundamental to ensuring data integrity and the admissibility of evidence.
What is the best practice when seizing a computer that is powered on?
Answer: Capture volatile data before shutdown
When seizing a computer that is powered on, the best practice is to first capture volatile data before shutting it down. Volatile data, such as RAM contents, running processes, and network connections, is lost once the power is removed. Capturing this data can provide critical insights into the system's state and user activity that would not be available from a disk image alone.