CFI Digital & Cyber Investigation 2 — Questions and Answers
Question 1: When recovering data from a fire-damaged hard drive, which component is most likely to survive and retain data?
- The read/write heads
- The platters (Correct answer)
- The spindle motor
- The printed circuit board
Correct answer: The platters
Hard drive platters are encased in metal and can often survive moderate heat, retaining recoverable data even when other components fail.
Question 2: A fire investigator discovers a smart home device at an arson scene. Which type of data from this device would be MOST valuable for establishing a timeline?
- Device firmware version
- Event logs with timestamps (Correct answer)
- Wi-Fi network name
- Device serial number
Correct answer: Event logs with timestamps
Event logs with timestamps can establish when lights, thermostats, or locks were activated, helping reconstruct pre-fire activity.
Question 3: In a cyber-originated fire investigation, what does 'thermal runaway' refer to in the context of lithium-ion batteries?
- Excessive CPU heat causing board ignition
- A self-reinforcing exothermic reaction leading to fire or explosion (Correct answer)
- Overheating of a charging cable
- A router fan failure causing overheating
Correct answer: A self-reinforcing exothermic reaction leading to fire or explosion
Thermal runaway in lithium-ion batteries is a cascading exothermic reaction where heat accelerates chemical breakdown, potentially causing fire or explosion.
Question 4: Which hashing algorithm is currently recommended for verifying digital evidence integrity in fire investigations?
- MD5
- SHA-1
- SHA-256 (Correct answer)
- CRC-32
Correct answer: SHA-256
SHA-256 is the current standard for forensic hashing because MD5 and SHA-1 have known collision vulnerabilities that could compromise evidence integrity.
Question 5: An investigator suspects a UPS (uninterruptible power supply) caused a fire. What digital evidence source within the UPS should be examined first?
- The battery charge level indicator
- The internal event log or fault memory (Correct answer)
- The input voltage meter
- The bypass switch position
Correct answer: The internal event log or fault memory
Many UPS units store internal event logs or fault memory that record overload events, battery failures, and abnormal conditions preceding the fire.
Question 6: When documenting a fire scene involving suspected computer equipment, what is the correct sequence for digital evidence collection?
- Photograph, bag, then power off any running devices
- Power off all devices, then photograph, then bag
- Photograph, document, preserve state, then collect (Correct answer)
- Collect first to prevent further damage, then document
Correct answer: Photograph, document, preserve state, then collect
Photograph and document the scene first, preserve volatile data state where possible, then collect evidence to maintain chain of custody and scene integrity.
Question 7: A building management system (BMS) log shows HVAC commands sent 12 minutes before a fire started. What does this data primarily help establish?
- The chemical composition of the fire
- The potential for intentional manipulation of building systems (Correct answer)
- The fire's burn rate
- The structural integrity of the building
Correct answer: The potential for intentional manipulation of building systems
Unusual BMS commands prior to fire ignition may indicate intentional manipulation of ventilation or suppression systems to facilitate arson.
CFI Digital & Cyber Investigation 2
When recovering data from a fire-damaged hard drive, which component is most likely to survive and retain data?