CJIS Digital Evidence Management 3

Question 1

When documenting a crime scene with digital devices, which method best captures the spatial relationship between devices before collection?

Accepted Answer

Photography and sketching with measurements

Answer

Photography combined with scaled sketches and measurements best documents spatial relationships for court presentation.

Question 2

A seized smartphone is placed in a Faraday bag during transport. What is the PRIMARY purpose of this action?

Accepted Answer

To prevent remote wiping or data modification via wireless signals

Answer

A Faraday bag blocks wireless signals, preventing remote wiping, lock activation, or data changes via cellular, Wi-Fi, or Bluetooth.

Question 3

Which type of metadata records the date and time a file was last accessed on a Windows NTFS system?

Accepted Answer

MACE timestamps (specifically the 'A' timestamp)

Answer

NTFS MACE timestamps track Modified, Accessed, Created, and Entry-modified times; the 'A' timestamp records last access.

Question 4

An investigator finds a file with a .jpg extension but forensic analysis shows the file header signature is that of a .zip file. This is an example of:

Accepted Answer

Anti-forensic file masking or extension spoofing

Answer

Changing a file's extension to disguise its true type is an anti-forensic technique called file masking or extension spoofing.

Question 5

In digital forensics, what is 'slack space'?

Accepted Answer

The space between the end of a file and the end of its last allocated cluster

Answer

Slack space is the unused area between the logical end of a file and the physical end of the last disk cluster allocated to it.

(CJIS) Criminal Justice Information Services Certified Practice Test

(CJIS) Criminal Justice Information Services Certified Practice Test

CJIS Digital Evidence Management 3