CSX Evidence Collection & Preservation 2 — Questions and Answers
Question 1: During a live system investigation, which volatile data should be collected FIRST before any other action?
- System logs from the hard drive
- Running processes and network connections (Correct answer)
- Registry hive files
- Browser history and cookies
Correct answer: Running processes and network connections
Running processes and network connections are the most volatile and disappear immediately upon shutdown, so they must be captured first.
Question 2: What is the primary purpose of using a write blocker during evidence collection?
- To encrypt the evidence drive
- To speed up the imaging process
- To prevent modification of the original evidence (Correct answer)
- To verify the chain of custody
Correct answer: To prevent modification of the original evidence
A write blocker prevents any write operations to the source media, ensuring the original evidence remains unaltered.
Question 3: A forensic investigator uses SHA-256 to hash an evidence drive before and after imaging. What does a matching hash confirm?
- The image was compressed correctly
- The evidence was not tampered with during acquisition (Correct answer)
- The drive is free of malware
- The chain of custody was followed
Correct answer: The evidence was not tampered with during acquisition
Matching hash values before and after imaging confirm that the copy is an exact, unaltered replica of the original.
Question 4: Which legal doctrine requires digital evidence to be collected in a manner that can withstand court scrutiny?
- Best evidence rule (Correct answer)
- Hearsay exception
- Fruit of the poisonous tree
- Chain of custody doctrine
Correct answer: Best evidence rule
The best evidence rule requires that the original or a verified exact copy of digital evidence be presented in court.
Question 5: When acquiring memory from a running system, which tool is most commonly used in Windows environments?
- dd
- Wireshark
- WinPmem (Correct answer)
- Autopsy
Correct answer: WinPmem
WinPmem is a widely used Windows memory acquisition tool that can capture a full RAM dump for forensic analysis.
Question 6: What does 'locard's exchange principle' imply in digital forensics?
- All digital evidence must be encrypted
- Every interaction leaves a trace on both the attacker and victim systems (Correct answer)
- Evidence must be collected in order of volatility
- Investigators must use certified tools only
Correct answer: Every interaction leaves a trace on both the attacker and victim systems
Locard's exchange principle states that any contact between two entities results in an exchange of material, meaning attackers leave digital traces.
Question 7: Which of the following best describes a 'forensic image' as opposed to a simple file copy?
- A forensic image only copies active files
- A forensic image is compressed for storage efficiency
- A forensic image is a bit-for-bit copy including unallocated space (Correct answer)
- A forensic image skips system files to save time
Correct answer: A forensic image is a bit-for-bit copy including unallocated space
A forensic image captures every bit of the source media, including deleted files in unallocated space, unlike a standard file copy.
CSX Evidence Collection & Preservation 2
During a live system investigation, which volatile data should be collected FIRST before any other action?