CSI - Crime Scene Investigator Digital and Electronic Evidence Questions and Answers Flashcards
6 cards from real CSI practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 CSI - Crime Scene Investigator Digital and Electronic Evidence Questions and Answers flashcards as text
When collecting a smartphone at a crime scene, what should an investigator do to prevent remote wiping?
Answer: Place it in airplane mode or a Faraday bag
Isolating the phone from networks prevents a suspect or third party from remotely wiping or altering the device's data.
What is the primary purpose of a Faraday bag in digital evidence collection?
Answer: To block all wireless signals and prevent remote access
A Faraday bag blocks electromagnetic signals, preventing remote commands such as wipe orders from reaching the device.
Which of the following is NOT a form of digital evidence?
Answer: Fingerprint powder residue
Fingerprint powder residue is physical trace evidence, not digital evidence.
What should be documented when seizing digital devices at a crime scene?
Answer: The device, its connections, surrounding environment, and current operational state
Comprehensive documentation of all aspects of the device and its environment is essential to maintaining evidentiary value.
In digital forensics, what does 'chain of custody' refer to?
Answer: The documented history of who collected, handled, and stored the evidence
Chain of custody documents every person who handled the evidence to ensure its integrity and admissibility in court.
What is 'slack space' in digital forensics?
Answer: The area between the end of a file and the end of its allocated cluster that may retain old data
Slack space can contain remnants of previously stored data that was not fully overwritten and may be forensically significant.