CSI Cybersecurity & Digital Evidence Handling 2 — Questions and Answers
Question 1: When conducting a forensic investigation, what is the PRIMARY reason an investigator should use a write blocker when accessing a suspect drive?
- To speed up the data acquisition process
- To prevent accidental modification of the original evidence (Correct answer)
- To compress the forensic image for storage
- To decrypt encrypted partitions automatically
Correct answer: To prevent accidental modification of the original evidence
A write blocker prevents any writes to the original drive, preserving the integrity of the evidence and ensuring admissibility in court.
Question 2: Which of the following network logs would be MOST useful for identifying unauthorized lateral movement within a corporate network?
- DHCP lease logs
- Internal firewall and router flow logs (Correct answer)
- Public DNS query logs
- Email gateway spam filter logs
Correct answer: Internal firewall and router flow logs
Internal firewall and router flow logs capture traffic between internal segments, making lateral movement patterns visible.
Question 3: A CSI investigator discovers a suspect used steganography to hide data in image files. What is steganography in the context of digital investigations?
- Encrypting files with a symmetric key algorithm
- Concealing data within seemingly innocuous carrier files (Correct answer)
- Overwriting deleted files to prevent recovery
- Using VPN tunnels to hide network traffic
Correct answer: Concealing data within seemingly innocuous carrier files
Steganography embeds hidden information within ordinary files like images or audio without visibly altering them.
Question 4: Under the Electronic Communications Privacy Act (ECPA), what is generally required before law enforcement can access stored electronic communications held by a third-party provider?
- Only a written request to the provider
- A valid subpoena, court order, or search warrant depending on content age and type (Correct answer)
- A simple administrative request signed by an agency supervisor
- No legal process if the data is over 180 days old
Correct answer: A valid subpoena, court order, or search warrant depending on content age and type
ECPA establishes a tiered framework requiring subpoenas, court orders, or warrants based on the type and age of stored communications.
Question 5: Which hashing algorithm is currently recommended by NIST for forensic evidence verification due to its collision resistance?
- MD5
- SHA-1
- SHA-256 (Correct answer)
- CRC-32
Correct answer: SHA-256
SHA-256 is NIST-recommended for integrity verification because MD5 and SHA-1 have known collision vulnerabilities.
Question 6: A security investigator is examining a Windows system and needs to find recently accessed files. Which registry hive would be MOST helpful?
- HKEY_LOCAL_MACHINE\SYSTEM
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs (Correct answer)
- HKEY_LOCAL_MACHINE\SAM
- HKEY_CLASSES_ROOT
Correct answer: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs
The RecentDocs key in HKCU tracks files recently opened by the current user through Windows Explorer.
Question 7: When a suspect's smartphone is seized, what is the FIRST step an investigator should take to preserve its digital evidence?
- Immediately connect it to a forensic workstation
- Place it in airplane mode or a Faraday bag to prevent remote wiping (Correct answer)
- Attempt to unlock it using common PIN guesses
- Remove the SIM card and battery
Correct answer: Place it in airplane mode or a Faraday bag to prevent remote wiping
Isolating the device from networks prevents remote wipe commands and preserves the current state of all data.
CSI Cybersecurity & Digital Evidence Handling 2
When conducting a forensic investigation, what is the PRIMARY reason an investigator should use a write blocker when accessing a suspect drive?