Digital & Cyber Investigation Flashcards
7 cards from real CFI practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Digital & Cyber Investigation flashcards as text
When recovering data from a fire-damaged hard drive, which component is most likely to survive and retain data?
Answer: The platters
Hard drive platters are encased in metal and can often survive moderate heat, retaining recoverable data even when other components fail.
A fire investigator discovers a smart home device at an arson scene. Which type of data from this device would be MOST valuable for establishing a timeline?
Answer: Event logs with timestamps
Event logs with timestamps can establish when lights, thermostats, or locks were activated, helping reconstruct pre-fire activity.
In a cyber-originated fire investigation, what does 'thermal runaway' refer to in the context of lithium-ion batteries?
Answer: A self-reinforcing exothermic reaction leading to fire or explosion
Thermal runaway in lithium-ion batteries is a cascading exothermic reaction where heat accelerates chemical breakdown, potentially causing fire or explosion.
Which hashing algorithm is currently recommended for verifying digital evidence integrity in fire investigations?
Answer: SHA-256
SHA-256 is the current standard for forensic hashing because MD5 and SHA-1 have known collision vulnerabilities that could compromise evidence integrity.
An investigator suspects a UPS (uninterruptible power supply) caused a fire. What digital evidence source within the UPS should be examined first?
Answer: The internal event log or fault memory
Many UPS units store internal event logs or fault memory that record overload events, battery failures, and abnormal conditions preceding the fire.
When documenting a fire scene involving suspected computer equipment, what is the correct sequence for digital evidence collection?
Answer: Photograph, document, preserve state, then collect
Photograph and document the scene first, preserve volatile data state where possible, then collect evidence to maintain chain of custody and scene integrity.
A building management system (BMS) log shows HVAC commands sent 12 minutes before a fire started. What does this data primarily help establish?
Answer: The potential for intentional manipulation of building systems
Unusual BMS commands prior to fire ignition may indicate intentional manipulation of ventilation or suppression systems to facilitate arson.