Cybersecurity & Digital Evidence Handling Flashcards
7 cards from real CSI practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Cybersecurity & Digital Evidence Handling flashcards as text
When conducting a forensic investigation, what is the PRIMARY reason an investigator should use a write blocker when accessing a suspect drive?
Answer: To prevent accidental modification of the original evidence
A write blocker prevents any writes to the original drive, preserving the integrity of the evidence and ensuring admissibility in court.
Which of the following network logs would be MOST useful for identifying unauthorized lateral movement within a corporate network?
Answer: Internal firewall and router flow logs
Internal firewall and router flow logs capture traffic between internal segments, making lateral movement patterns visible.
A CSI investigator discovers a suspect used steganography to hide data in image files. What is steganography in the context of digital investigations?
Answer: Concealing data within seemingly innocuous carrier files
Steganography embeds hidden information within ordinary files like images or audio without visibly altering them.
Under the Electronic Communications Privacy Act (ECPA), what is generally required before law enforcement can access stored electronic communications held by a third-party provider?
Answer: A valid subpoena, court order, or search warrant depending on content age and type
ECPA establishes a tiered framework requiring subpoenas, court orders, or warrants based on the type and age of stored communications.
Which hashing algorithm is currently recommended by NIST for forensic evidence verification due to its collision resistance?
Answer: SHA-256
SHA-256 is NIST-recommended for integrity verification because MD5 and SHA-1 have known collision vulnerabilities.
A security investigator is examining a Windows system and needs to find recently accessed files. Which registry hive would be MOST helpful?
Answer: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs
The RecentDocs key in HKCU tracks files recently opened by the current user through Windows Explorer.
When a suspect's smartphone is seized, what is the FIRST step an investigator should take to preserve its digital evidence?
Answer: Place it in airplane mode or a Faraday bag to prevent remote wiping
Isolating the device from networks prevents remote wipe commands and preserves the current state of all data.