CSI CSI - Crime Scene Investigator Digital and Electronic Evidence Questions and Answers

Question 1

What is the first step when encountering a powered-on computer at a crime scene?

Accepted Answer

Document its current state before any action

Answer

Unplug it immediately

Answer

Shut it down using the operating system

Answer

Remove the hard drive

Question 2

Which type of data is considered 'volatile' in digital forensics?

Accepted Answer

Data stored in RAM

Answer

Hard drive data

Answer

Files on a USB drive

Answer

Data on optical discs

Question 3

What does a 'write blocker' do in a digital forensic investigation?

Accepted Answer

Prevents modification of digital evidence during acquisition

Answer

Prevents writing to reports

Answer

Blocks network access on a device

Answer

Erases digital media securely

Question 4

What is a forensic image in a digital investigation?

Accepted Answer

An exact bit-for-bit copy of digital storage media

Answer

A photograph of the crime scene

Answer

A compressed backup of visible files

Answer

A screenshot of a suspect's screen

Question 5

Which hashing algorithm is commonly used to verify the integrity of digital evidence?

Accepted Answer

MD5 or SHA-256

Answer

ZIP

Answer

AES

Answer

SSL

Question 6

What is metadata in the context of digital evidence?

Accepted Answer

Data about data, such as file creation dates and author information

Answer

The content of a file

Answer

Deleted file fragments in unallocated space

Answer

Encrypted file content