ETC ETC Digital & Electronic Evidence 2

Question 1

What legal authority is generally required before law enforcement can search the contents of a seized digital device?

Accepted Answer

A search warrant specifically authorizing the search of the device's contents

Answer

The same warrant used to search the physical premises

Answer

Verbal consent from any adult present at the scene

Answer

An arrest warrant for the device's owner

Question 2

An evidence technician seizes a laptop that is encrypted with BitLocker. What should be done to preserve potential access?

Accepted Answer

Keep it powered on if possible, document any visible passwords/recovery keys, and transport it safely to avoid sleep mode

Answer

Immediately power it off and submit to the lab

Answer

Force-boot from a USB drive to bypass encryption

Answer

Contact the manufacturer to unlock it remotely

Question 3

What is metadata and why is it important in digital evidence investigations?

Accepted Answer

Data about data — it includes creation dates, GPS coordinates, and author information that can place evidence in time and location

Answer

The main content of a digital file such as text or images

Answer

The file name extension that indicates file type

Answer

A digital watermark added by forensic tools

Question 4

Which type of digital evidence storage media requires special anti-static precautions during collection and transport?

Accepted Answer

Hard drives, SSDs, and RAM modules are susceptible to electrostatic discharge (ESD) damage

Answer

USB flash drives only

Answer

Optical discs (CDs/DVDs) only

Answer

Memory cards used in cameras

Question 5

What is the purpose of creating a forensic image (bit-stream copy) rather than simply copying files from a digital device?

Accepted Answer

A forensic image captures every bit including deleted files, slack space, and unallocated sectors that file copying misses

Answer

A forensic image is faster than copying files manually

Answer

A forensic image automatically decrypts protected files

Answer

A forensic image creates a compressed archive for storage efficiency

Question 6

When documenting the seizure of a network router as digital evidence, what information should be photographed before disconnecting it?

Accepted Answer

All status indicator lights, cable connections and labeled ports, and any visible configuration information

Answer

Only the front of the device for identification purposes

Answer

The router's default password label on the bottom

Answer

The power adapter and cable only