ETC Digital & Electronic Evidence Flashcards
6 cards from real ETC practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 ETC Digital & Electronic Evidence flashcards as text
What legal authority is generally required before law enforcement can search the contents of a seized digital device?
Answer: A search warrant specifically authorizing the search of the device's contents
Per Riley v. California (2014), the US Supreme Court ruled that law enforcement generally needs a separate search warrant to search the digital contents of a cell phone.
An evidence technician seizes a laptop that is encrypted with BitLocker. What should be done to preserve potential access?
Answer: Keep it powered on if possible, document any visible passwords/recovery keys, and transport it safely to avoid sleep mode
Keeping the encrypted laptop powered on may preserve the decryption key in RAM, and recovery keys displayed or written nearby may be needed to access the drive later.
What is metadata and why is it important in digital evidence investigations?
Answer: Data about data — it includes creation dates, GPS coordinates, and author information that can place evidence in time and location
Metadata embedded in files (EXIF data in photos, document properties) can reveal when a file was created, modified, where it was taken (GPS), and by whom.
Which type of digital evidence storage media requires special anti-static precautions during collection and transport?
Answer: Hard drives, SSDs, and RAM modules are susceptible to electrostatic discharge (ESD) damage
Electronic storage media components are sensitive to electrostatic discharge, which can corrupt or destroy data; anti-static bags must be used during collection and transport.
What is the purpose of creating a forensic image (bit-stream copy) rather than simply copying files from a digital device?
Answer: A forensic image captures every bit including deleted files, slack space, and unallocated sectors that file copying misses
A bit-stream forensic image copies every sector of the media, preserving deleted files, file system metadata, slack space, and unallocated areas that simple file copying skips.
When documenting the seizure of a network router as digital evidence, what information should be photographed before disconnecting it?
Answer: All status indicator lights, cable connections and labeled ports, and any visible configuration information
Photographing the router's indicator lights, labeled cable connections, and configuration data preserves the network state and documents how devices were connected before seizure.