CSX Evidence Collection & Preservation 2

Question 1

During a live system investigation, which volatile data should be collected FIRST before any other action?

Accepted Answer

Running processes and network connections

Answer

Running processes and network connections are the most volatile and disappear immediately upon shutdown, so they must be captured first.

Question 2

What is the primary purpose of using a write blocker during evidence collection?

Accepted Answer

To prevent modification of the original evidence

Answer

A write blocker prevents any write operations to the source media, ensuring the original evidence remains unaltered.

Question 3

A forensic investigator uses SHA-256 to hash an evidence drive before and after imaging. What does a matching hash confirm?

Accepted Answer

The evidence was not tampered with during acquisition

Answer

Matching hash values before and after imaging confirm that the copy is an exact, unaltered replica of the original.

Question 4

Which legal doctrine requires digital evidence to be collected in a manner that can withstand court scrutiny?

Accepted Answer

Best evidence rule

Answer

The best evidence rule requires that the original or a verified exact copy of digital evidence be presented in court.

Question 5

When acquiring memory from a running system, which tool is most commonly used in Windows environments?

Accepted Answer

WinPmem

Answer

WinPmem is a widely used Windows memory acquisition tool that can capture a full RAM dump for forensic analysis.

(CSX) Cybersecurity Nexus Certification Practice Test