CJIS Digital Evidence Management 2

Question 1

When collecting volatile data from a live system, which source should be collected FIRST due to its transient nature?

Accepted Answer

CPU registers and cache

Answer

CPU registers and cache are the most volatile and are lost immediately upon power loss, so they must be collected first.

Question 2

A CJIS investigator receives a USB drive suspected of containing contraband images. What is the FIRST step before forensic examination?

Accepted Answer

Write-block the device before imaging

Answer

A write blocker must be attached before any connection to prevent accidental modification of the original evidence.

Question 3

Which hashing algorithm is currently recommended for digital evidence integrity verification under NIST guidelines?

Accepted Answer

SHA-256

Answer

SHA-256 is the current NIST-recommended algorithm as MD5 and SHA-1 are considered cryptographically weak.

Question 4

In CJIS policy, who is ultimately responsible for ensuring digital evidence submitted to a lab is properly packaged and documented?

Accepted Answer

The submitting officer or detective

Answer

The submitting officer is responsible for proper packaging, labeling, and documentation before submission to the lab.

Question 5

What does 'spoliation' of digital evidence refer to?

Accepted Answer

Destruction or alteration of evidence that may be relevant to litigation

Answer

Spoliation is the destruction, alteration, or failure to preserve evidence that may be relevant to ongoing or anticipated litigation.

(CJIS) Criminal Justice Information Services Certified Practice Test