Practice Test Geeks(CPI) Certified Principal Investigator Practice Test
← All CPI Flashcard Decks

Technology & Digital Tools Flashcards

7 cards from real CPI practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.

Read the first 7 Technology & Digital Tools flashcards as text

  1. Which hashing algorithm is the current NIST-recommended standard for verifying the integrity of forensic disk images?

    Answer: SHA-256

    SHA-256 is collision-resistant and NIST-recommended for evidence integrity verification, whereas MD5 and SHA-1 have known vulnerabilities.

  2. An investigator discovers that a suspect used a VPN during online activity. Which data source is MOST likely to still reveal the suspect's true IP address?

    Answer: Legal process served to the VPN provider

    A legal subpoena or court order served to the VPN provider can compel disclosure of connection logs even when the provider claims a no-log policy.

  3. In cellular network investigations, a tower dump request asks a carrier for:

    Answer: All device identifiers that connected to a specific tower during a time window

    A tower dump provides investigators with a list of all IMSIs/IMEIs that registered with a specific cell tower during a specified period.

  4. Which open-source tool is widely used by investigators to recover deleted files from digital storage media?

    Answer: Autopsy

    Autopsy is a free digital forensics platform that can carve deleted files, analyze file systems, and generate investigative reports.

  5. A subject sends a threatening email from a free webmail account. Which part of the email header is MOST useful for tracing the origin IP address?

    Answer: The 'Received:' chain of headers

    Each mail server that relays a message adds a 'Received:' header, and reading them in order reveals the originating IP address.

  6. What is 'geofencing' as applied to digital investigation warrant requests?

    Answer: Requesting location data for all devices present in a defined geographic area during a time period

    A geofence warrant compels a provider (commonly Google) to disclose device identifiers for all devices within a specific location boundary during a defined time window.

  7. Which type of steganography technique would an investigator look for when a suspect is suspected of hiding data inside image files?

    Answer: LSB (Least Significant Bit) insertion

    LSB steganography hides data by altering the least significant bits of pixel values, making changes nearly invisible to the human eye.