ETC ETC Digital & Electronic Evidence

Question 1

What is the first step an evidence technician should take upon encountering a powered-on computer at a crime scene?

Accepted Answer

Photograph the screen, document its state, and consult with a digital forensics specialist before touching it

Answer

Documenting the screen's current state before any action preserves volatile data and allows a digital forensics specialist to advise on whether to acquire live data or power down.

Question 2

Why is it important to place a cell phone in a Faraday bag or airplane mode immediately upon seizure?

Accepted Answer

To prevent remote wiping, incoming data, or location updates that could alter evidence

Answer

Isolating the phone from wireless signals prevents remote wipe commands, new incoming messages, or GPS updates from altering the data on the device.

Question 3

What is a write blocker and why is it used in digital evidence processing?

Accepted Answer

A hardware or software device that prevents any writes to a storage medium, ensuring the original is not altered during imaging

Answer

A write blocker allows forensic tools to read data from a storage device without making any changes, preserving the original evidence in its unaltered state.

Question 4

Which hashing algorithm is most commonly used to verify the integrity of a digital evidence image?

Accepted Answer

MD5 or SHA-256

Answer

MD5 and SHA-256 cryptographic hash values are computed before and after imaging; matching hashes confirm the copy is identical to the original.

Question 5

When seizing a smartphone as digital evidence, which data may be lost if the battery dies before forensic acquisition?

Accepted Answer

Volatile data in RAM such as active app states and temporary files

Answer

RAM is volatile memory that is erased when power is lost; active app states, decryption keys, and temporary data that could be forensically valuable are lost when the battery dies.

(ETC) Evidence Technician Certification Practice Test

(ETC) Evidence Technician Certification Practice Test

ETC ETC Digital & Electronic Evidence