CFE Digital Evidence Collection and Preservation 2

Question 1

When performing a live acquisition of a running system, which type of memory should be captured FIRST to preserve the most volatile data?

Accepted Answer

CPU registers and cache

Answer

CPU registers and cache are the most volatile data and will be lost immediately upon system shutdown, so they must be captured first.

Question 2

A forensic examiner uses write blockers during evidence collection primarily to:

Accepted Answer

Prevent any data from being written to the source drive

Answer

Write blockers prevent any writes to the source drive, ensuring the original evidence is not modified during the acquisition process.

Question 3

Which file system artifact records the last time a file was accessed on a Windows NTFS volume?

Accepted Answer

$MFT $STANDARD_INFORMATION timestamps

Answer

The $STANDARD_INFORMATION attribute in the NTFS Master File Table (MFT) stores MAC timestamps including last access time.

Question 4

During a mobile device acquisition, what is the significance of placing the device in airplane mode?

Accepted Answer

It prevents remote wipe commands from reaching the device

Answer

Airplane mode cuts all wireless connections, preventing remote wipe commands or data changes from reaching the device over cellular or Wi-Fi.

Question 5

A Faraday bag is used in digital forensics to:

Accepted Answer

Block electromagnetic signals to and from a device

Answer

A Faraday bag blocks all electromagnetic signals, isolating the device from cellular, Wi-Fi, and Bluetooth communications.

(CFE) Certified Forensic Examiner Practice Test