Evidence Collection & Preservation Flashcards

What is the correct order when documenting a crime scene under the 'order of volatility' principle?

Answer: CPU registers → RAM → Network state → Disk

The order of volatility requires collecting the most ephemeral data first: CPU registers, then RAM, network state, and finally disk.

Which technique allows investigators to analyze malware behavior without contaminating the evidence drive?

Answer: Analyzing the malware in an isolated sandbox environment

An isolated sandbox environment allows safe malware execution and behavioral analysis without risking contamination of original evidence.

An organization must hand over server logs to law enforcement. Which action best protects the organization legally?

Answer: Provide logs with a chain of custody form and hash values

Providing logs with a chain of custody form and hash values ensures the evidence is documented and its integrity can be verified.

What is 'anti-forensics' and why is it a concern during evidence collection?

Answer: Techniques used to destroy, obscure, or corrupt digital evidence

Anti-forensics encompasses techniques like data wiping, steganography, and log tampering used by adversaries to hinder forensic investigations.

A forensic examiner discovers timestamps on files have been altered. Which Windows artifact could help determine the original file creation time?

Answer: $MFT (Master File Table)

The NTFS $MFT contains multiple timestamp fields including $STANDARD_INFORMATION and $FILE_NAME, which can reveal timestamp manipulation.

Which cryptographic property ensures that even a single bit change in collected evidence produces a completely different hash value?

Answer: Avalanche effect

The avalanche effect ensures that small changes to input data produce drastically different hash outputs, making tampering detectable.

When collecting evidence from a mobile device, why is it important to place it in airplane mode or a Faraday bag?

Answer: To prevent remote wiping or data modification via wireless connections

Placing a mobile device in airplane mode or a Faraday bag prevents remote wipe commands or over-the-air updates from destroying evidence.