Digital & Cyber Investigation Flashcards
7 cards from real CFI practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Digital & Cyber Investigation flashcards as text
Which type of malware is most directly associated with causing physical damage to industrial control systems that could result in fire?
Answer: SCADA-targeting malware (e.g., Stuxnet-type)
SCADA-targeting malware like Stuxnet can override safety limits on industrial equipment, causing overloads or mechanical failures that lead to fires.
When examining a fire-damaged smartphone, investigators should prioritize extracting data from which storage location first?
Answer: The cloud backup
Cloud backups are offsite and unaffected by the fire, making them the easiest and most intact source of data to retrieve quickly.
A CFI investigates a fire at a cryptocurrency mining facility. Which specific hazard unique to mining operations should be documented?
Answer: Overloaded electrical circuits from continuous high-draw GPUs
Cryptocurrency mining rigs run GPUs at near-maximum load continuously, often overloading circuits not designed for such sustained high amperage draw.
In a fire investigation involving a corporate server room, the investigator needs to preserve volatile evidence. Which item contains data that will be LOST when power is cut?
Answer: RAM containing running processes
RAM is volatile memory — all data including running processes, network connections, and encryption keys is permanently lost when power is removed.
What is the primary legal requirement for obtaining cloud-stored evidence from a U.S.-based provider during a fire investigation with criminal implications?
Answer: A subpoena or court order under the Stored Communications Act
The Stored Communications Act (18 U.S.C. § 2703) requires law enforcement to obtain a subpoena, court order, or warrant to compel cloud providers to disclose user data.
A fire investigator finds a network-attached surveillance DVR that survived a fire. The DVR is still powered. What is the FIRST action to take?
Answer: Note the time displayed and compare it to a known accurate time source
Noting the DVR's displayed time versus actual time establishes any time offset, which is critical for accurately interpreting recorded footage timestamps.
Which NFPA standard provides guidance on the investigation of fires involving electrical equipment and digital systems?
Answer: NFPA 921
NFPA 921, Guide for Fire and Explosion Investigations, provides the primary scientific methodology guidance including investigation of electrical and electronic equipment.