ETC ETC Digital & Electronic Evidence

Question 1

What is the first step an evidence technician should take upon encountering a powered-on computer at a crime scene?

Accepted Answer

Photograph the screen, document its state, and consult with a digital forensics specialist before touching it

Answer

Immediately shut it down by pulling the power cord

Answer

Restart the computer to capture a fresh state

Answer

Log into the system to check recent files

Question 2

Why is it important to place a cell phone in a Faraday bag or airplane mode immediately upon seizure?

Accepted Answer

To prevent remote wiping, incoming data, or location updates that could alter evidence

Answer

To charge the battery before lab analysis

Answer

To trigger the phone's backup feature

Answer

To avoid static electricity damage during transport

Question 3

What is a write blocker and why is it used in digital evidence processing?

Accepted Answer

A hardware or software device that prevents any writes to a storage medium, ensuring the original is not altered during imaging

Answer

A software tool that encrypts digital evidence files

Answer

A label applied to evidence bags to prevent re-opening

Answer

A physical lock placed on evidence room doors

Question 4

Which hashing algorithm is most commonly used to verify the integrity of a digital evidence image?

Accepted Answer

MD5 or SHA-256

Answer

CRC32 only

Answer

Base64 encoding

Answer

AES-256 encryption

Question 5

When seizing a smartphone as digital evidence, which data may be lost if the battery dies before forensic acquisition?

Accepted Answer

Volatile data in RAM such as active app states and temporary files

Answer

Photos stored on an SD card

Answer

Contacts saved to the SIM card

Answer

Previously downloaded files in internal storage

Question 6

What documentation is required when seizing digital devices as evidence?

Accepted Answer

Photographs of the device, its connections, and screen; a complete inventory of all seized items with make, model, and serial number

Answer

Only a property receipt with the device description

Answer

A written summary of the suspect's statements about the device

Answer

Video of the seizure and a signed consent form only