CPI Technology & Digital Tools 3

Question 1

Which hashing algorithm is the current NIST-recommended standard for verifying the integrity of forensic disk images?

Accepted Answer

SHA-256

Answer

SHA-256 is collision-resistant and NIST-recommended for evidence integrity verification, whereas MD5 and SHA-1 have known vulnerabilities.

Question 2

An investigator discovers that a suspect used a VPN during online activity. Which data source is MOST likely to still reveal the suspect's true IP address?

Accepted Answer

Legal process served to the VPN provider

Answer

A legal subpoena or court order served to the VPN provider can compel disclosure of connection logs even when the provider claims a no-log policy.

Question 3

In cellular network investigations, a tower dump request asks a carrier for:

Accepted Answer

All device identifiers that connected to a specific tower during a time window

Answer

A tower dump provides investigators with a list of all IMSIs/IMEIs that registered with a specific cell tower during a specified period.

Question 4

Which open-source tool is widely used by investigators to recover deleted files from digital storage media?

Accepted Answer

Autopsy

Answer

Autopsy is a free digital forensics platform that can carve deleted files, analyze file systems, and generate investigative reports.

Question 5

A subject sends a threatening email from a free webmail account. Which part of the email header is MOST useful for tracing the origin IP address?

Accepted Answer

The 'Received:' chain of headers

Answer

Each mail server that relays a message adds a 'Received:' header, and reading them in order reveals the originating IP address.

(CPI) Certified Principal Investigator Practice Test

(CPI) Certified Principal Investigator Practice Test

CPI Technology & Digital Tools 3