EnCE Evidence Acquisition & Preservation

Question 1

What is the purpose of write blockers in evidence acquisition?

Accepted Answer

Prevent data alteration

Answer

Write blockers are critical hardware or software tools used during digital evidence acquisition to ensure the integrity of the original media. They physically or logically prevent any modifications, accidental or intentional, from being written to the source drive. This preserves the evidence in its original state for forensic analysis, maintaining its admissibility.

Question 2

Which file format is commonly used for forensic image acquisition?

Accepted Answer

.E01

Answer

The .E01 format, also known as EnCase Evidence File, is a widely accepted standard for forensic image acquisition. It creates a bit-for-bit copy of the original storage medium, including unallocated space, and incorporates metadata, hash values, and case information. This ensures the integrity and authenticity of the acquired evidence.

Question 3

Why is hashing used during evidence collection?

Accepted Answer

Verify data integrity

Answer

Hashing, specifically using algorithms like MD5 or SHA-1/SHA-256, generates a unique digital fingerprint for a set of data. During evidence collection, a hash of the original media is taken before and after acquisition to mathematically prove that the acquired image is an exact, unaltered copy of the original. This process verifies data integrity and ensures evidence admissibility.

Question 4

What must be documented in a chain of custody form?

Accepted Answer

Evidence transfer history

Answer

A chain of custody form is a vital legal document that meticulously tracks the handling and transfer of evidence from the moment it is collected until it is presented in court. It documents who had possession of the evidence, when, and for what purpose. This ensures its integrity and admissibility by demonstrating that it has not been tampered with.

Question 5

Which method is preferred for live system acquisition?

Accepted Answer

Full format

Answer

The provided answer, 'Full format,' is incorrect as it is a destructive process that erases data, not an acquisition method for live systems. For live system acquisition, the preferred method is a 'Memory dump' (A), which captures volatile data like RAM contents and running processes before they are lost upon system shutdown. This is crucial for a comprehensive forensic analysis.

(EnCE) EnCase Certified Examiner Practice Test

(EnCE) EnCase Certified Examiner Practice Test

EnCE Evidence Acquisition & Preservation