CPI Technology & Digital Tools 3 — Questions and Answers
Question 1: Which hashing algorithm is the current NIST-recommended standard for verifying the integrity of forensic disk images?
- MD5
- SHA-1
- SHA-256 (Correct answer)
- CRC-32
Correct answer: SHA-256
SHA-256 is collision-resistant and NIST-recommended for evidence integrity verification, whereas MD5 and SHA-1 have known vulnerabilities.
Question 2: An investigator discovers that a suspect used a VPN during online activity. Which data source is MOST likely to still reveal the suspect's true IP address?
- The VPN provider's no-log policy statement
- Legal process served to the VPN provider (Correct answer)
- The suspect's browser history alone
- The website's server logs
Correct answer: Legal process served to the VPN provider
A legal subpoena or court order served to the VPN provider can compel disclosure of connection logs even when the provider claims a no-log policy.
Question 3: In cellular network investigations, a tower dump request asks a carrier for:
- Call content recordings from a single tower
- All device identifiers that connected to a specific tower during a time window (Correct answer)
- The account holder's billing records
- A real-time GPS fix on a target device
Correct answer: All device identifiers that connected to a specific tower during a time window
A tower dump provides investigators with a list of all IMSIs/IMEIs that registered with a specific cell tower during a specified period.
Question 4: Which open-source tool is widely used by investigators to recover deleted files from digital storage media?
- Autopsy (Correct answer)
- Wireshark
- Maltego
- Shodan
Correct answer: Autopsy
Autopsy is a free digital forensics platform that can carve deleted files, analyze file systems, and generate investigative reports.
Question 5: A subject sends a threatening email from a free webmail account. Which part of the email header is MOST useful for tracing the origin IP address?
- The 'From:' field
- The 'Reply-To:' field
- The 'Received:' chain of headers (Correct answer)
- The 'Message-ID:' field
Correct answer: The 'Received:' chain of headers
Each mail server that relays a message adds a 'Received:' header, and reading them in order reveals the originating IP address.
Question 6: What is 'geofencing' as applied to digital investigation warrant requests?
- Blocking a suspect's GPS from functioning
- Requesting location data for all devices present in a defined geographic area during a time period (Correct answer)
- Electronically monitoring a subject's movement via ankle bracelet
- Installing GPS tracking on a vehicle without contact
Correct answer: Requesting location data for all devices present in a defined geographic area during a time period
A geofence warrant compels a provider (commonly Google) to disclose device identifiers for all devices within a specific location boundary during a defined time window.
Question 7: Which type of steganography technique would an investigator look for when a suspect is suspected of hiding data inside image files?
- LSB (Least Significant Bit) insertion (Correct answer)
- ROT-13 encoding
- Base64 encoding
- AES-256 encryption
Correct answer: LSB (Least Significant Bit) insertion
LSB steganography hides data by altering the least significant bits of pixel values, making changes nearly invisible to the human eye.
CPI Technology & Digital Tools 3
Which hashing algorithm is the current NIST-recommended standard for verifying the integrity of forensic disk images?