CJIS Digital Evidence Management 2 — Questions and Answers
Question 1: When collecting volatile data from a live system, which source should be collected FIRST due to its transient nature?
- Hard disk contents
- CPU registers and cache (Correct answer)
- Network configuration
- Swap file data
Correct answer: CPU registers and cache
CPU registers and cache are the most volatile and are lost immediately upon power loss, so they must be collected first.
Question 2: A CJIS investigator receives a USB drive suspected of containing contraband images. What is the FIRST step before forensic examination?
- Preview files to confirm relevance
- Connect it to the forensic workstation
- Write-block the device before imaging (Correct answer)
- Run antivirus to detect malware
Correct answer: Write-block the device before imaging
A write blocker must be attached before any connection to prevent accidental modification of the original evidence.
Question 3: Which hashing algorithm is currently recommended for digital evidence integrity verification under NIST guidelines?
- MD5
- SHA-1
- SHA-256 (Correct answer)
- CRC-32
Correct answer: SHA-256
SHA-256 is the current NIST-recommended algorithm as MD5 and SHA-1 are considered cryptographically weak.
Question 4: In CJIS policy, who is ultimately responsible for ensuring digital evidence submitted to a lab is properly packaged and documented?
- The forensic examiner
- The submitting officer or detective (Correct answer)
- The lab supervisor
- The prosecuting attorney
Correct answer: The submitting officer or detective
The submitting officer is responsible for proper packaging, labeling, and documentation before submission to the lab.
Question 5: What does 'spoliation' of digital evidence refer to?
- Encrypting evidence for secure transport
- Destruction or alteration of evidence that may be relevant to litigation (Correct answer)
- Duplicating evidence for backup purposes
- Categorizing evidence by file type
Correct answer: Destruction or alteration of evidence that may be relevant to litigation
Spoliation is the destruction, alteration, or failure to preserve evidence that may be relevant to ongoing or anticipated litigation.
Question 6: A forensic image of a 2TB drive is taken. The original drive hash is SHA-256: A1B2... and the image hash is A1B2... What does this confirm?
- The image was compressed without data loss
- The image is a bit-for-bit exact copy of the original (Correct answer)
- The image was encrypted during transfer
- The original drive has no bad sectors
Correct answer: The image is a bit-for-bit exact copy of the original
Matching hashes confirm the forensic image is a bit-for-bit exact duplicate of the original, ensuring integrity.
Question 7: Under CJIS Security Policy, digital evidence containing CJI must be stored in a manner that ensures what?
- It is accessible to all agency personnel
- Access is limited to authorized personnel only (Correct answer)
- It is stored in cloud services for redundancy
- It can be shared with any law enforcement partner
Correct answer: Access is limited to authorized personnel only
CJI-containing evidence must be physically and logically secured so that only authorized personnel can access it.
CJIS Digital Evidence Management 2
When collecting volatile data from a live system, which source should be collected FIRST due to its transient nature?