CFI Digital & Cyber Investigation 2

Question 1

When recovering data from a fire-damaged hard drive, which component is most likely to survive and retain data?

Accepted Answer

The platters

Answer

Hard drive platters are encased in metal and can often survive moderate heat, retaining recoverable data even when other components fail.

Question 2

A fire investigator discovers a smart home device at an arson scene. Which type of data from this device would be MOST valuable for establishing a timeline?

Accepted Answer

Event logs with timestamps

Answer

Event logs with timestamps can establish when lights, thermostats, or locks were activated, helping reconstruct pre-fire activity.

Question 3

In a cyber-originated fire investigation, what does 'thermal runaway' refer to in the context of lithium-ion batteries?

Accepted Answer

A self-reinforcing exothermic reaction leading to fire or explosion

Answer

Thermal runaway in lithium-ion batteries is a cascading exothermic reaction where heat accelerates chemical breakdown, potentially causing fire or explosion.

Question 4

Which hashing algorithm is currently recommended for verifying digital evidence integrity in fire investigations?

Accepted Answer

SHA-256

Answer

SHA-256 is the current standard for forensic hashing because MD5 and SHA-1 have known collision vulnerabilities that could compromise evidence integrity.

Question 5

An investigator suspects a UPS (uninterruptible power supply) caused a fire. What digital evidence source within the UPS should be examined first?

Accepted Answer

The internal event log or fault memory

Answer

Many UPS units store internal event logs or fault memory that record overload events, battery failures, and abnormal conditions preceding the fire.

(CFI) Certified Fire Investigator Practice Test

(CFI) Certified Fire Investigator Practice Test

CFI Digital & Cyber Investigation 2