General Flashcards

Which type of evidence is considered the most reliable in a court of law during a digital forensics case?

Answer: Best evidence

Best evidence refers to the original document or data, and courts prefer it over copies or secondary evidence.

What does the term 'locard's exchange principle' mean in the context of digital forensics?

Answer: Every contact leaves a trace between the criminal and the crime scene

Locard's Exchange Principle states that any interaction between two entities results in an exchange of material, including digital artifacts.

In digital forensics, what is the primary purpose of write blockers?

Answer: To prevent any writes to the evidence media during acquisition

Write blockers prevent the forensic examiner's system from writing data to the evidence drive, preserving its original state.

What is 'slack space' in the context of disk forensics?

Answer: The space between the end of a file and the end of its allocated cluster

Slack space is the residual storage area between the end of a file's logical content and the end of the last cluster allocated to it.

Which RFC defines the format and structure of email messages and is important for email forensics?

Answer: RFC 2822

RFC 2822 defines the Internet Message Format, specifying how email headers and body content are structured.

During a forensic investigation, what does 'chain of custody' documentation primarily ensure?

Answer: That evidence has not been tampered with and its handling is traceable

Chain of custody documents every person who handled the evidence and every action taken, ensuring its integrity and admissibility.

What forensic technique involves examining the allocated and unallocated areas of a disk to find deleted files?

Answer: File carving

File carving recovers files by searching for file headers and footers in raw disk data, regardless of filesystem structure.