CFE Digital Evidence Collection and Preservation 2 — Questions and Answers
Question 1: When performing a live acquisition of a running system, which type of memory should be captured FIRST to preserve the most volatile data?
- CPU registers and cache (Correct answer)
- Hard disk contents
- BIOS configuration
- Network share mappings
Correct answer: CPU registers and cache
CPU registers and cache are the most volatile data and will be lost immediately upon system shutdown, so they must be captured first.
Question 2: A forensic examiner uses write blockers during evidence collection primarily to:
- Speed up the imaging process
- Prevent any data from being written to the source drive (Correct answer)
- Encrypt the evidence drive
- Verify the hash of the destination media
Correct answer: Prevent any data from being written to the source drive
Write blockers prevent any writes to the source drive, ensuring the original evidence is not modified during the acquisition process.
Question 3: Which file system artifact records the last time a file was accessed on a Windows NTFS volume?
- $MFT $STANDARD_INFORMATION timestamps (Correct answer)
- $LogFile entries
- $Recycle Bin metadata
- $Boot record
Correct answer: $MFT $STANDARD_INFORMATION timestamps
The $STANDARD_INFORMATION attribute in the NTFS Master File Table (MFT) stores MAC timestamps including last access time.
Question 4: During a mobile device acquisition, what is the significance of placing the device in airplane mode?
- It extends battery life during acquisition
- It prevents remote wipe commands from reaching the device (Correct answer)
- It enables faster data transfer via USB
- It automatically decrypts the device storage
Correct answer: It prevents remote wipe commands from reaching the device
Airplane mode cuts all wireless connections, preventing remote wipe commands or data changes from reaching the device over cellular or Wi-Fi.
Question 5: A Faraday bag is used in digital forensics to:
- Store physical evidence without contamination
- Block electromagnetic signals to and from a device (Correct answer)
- Transport hard drives safely without static damage
- Keep evidence cool to prevent data degradation
Correct answer: Block electromagnetic signals to and from a device
A Faraday bag blocks all electromagnetic signals, isolating the device from cellular, Wi-Fi, and Bluetooth communications.
Question 6: What is 'slack space' in the context of digital forensics?
- Unallocated space on a disk not belonging to any file
- The unused space between the end of a file and the end of its allocated cluster (Correct answer)
- Space reserved by the OS for swap memory
- The gap between partitions on a disk
Correct answer: The unused space between the end of a file and the end of its allocated cluster
Slack space is the unused area between the logical end of a file and the physical end of the last cluster allocated to that file, which may contain remnants of old data.
Question 7: Which hashing algorithm is most commonly used in US federal law enforcement to verify digital evidence integrity due to its collision resistance?
- MD5
- SHA-1
- SHA-256 (Correct answer)
- CRC32
Correct answer: SHA-256
SHA-256 is preferred in modern forensic practice due to its strong collision resistance, as MD5 and SHA-1 have known cryptographic weaknesses.
CFE Digital Evidence Collection and Preservation 2
When performing a live acquisition of a running system, which type of memory should be captured FIRST to preserve the most volatile data?