Practice Test GeeksISA - Information Security Analyst Certification Practice Test
← All ISA Flashcard Decks

Digital Forensics & Investigation Flashcards

7 cards from real ISA practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.

Read the first 7 Digital Forensics & Investigation flashcards as text

  1. Which principle ensures that digital evidence is not altered during collection and analysis?

    Answer: Write blocking

    Write blockers prevent any write operations to storage media during forensic acquisition, ensuring the original evidence is not altered.

  2. In digital forensics, 'order of volatility' refers to:

    Answer: The priority order for collecting evidence based on how quickly it may be lost

    Order of volatility guides forensic analysts to collect the most transient data first (e.g., RAM, running processes) before it is lost when the system is powered off.

  3. What is the primary purpose of a forensic disk image?

    Answer: To create an exact bit-for-bit copy of the original storage media

    A forensic disk image is a bit-for-bit copy of the original media, allowing analysts to work on the copy while preserving the original evidence untouched.

  4. Which hashing algorithm is most commonly used to verify forensic evidence integrity?

    Answer: SHA-256 or SHA-512

    SHA-256 and SHA-512 are preferred for forensic integrity verification because they are cryptographically stronger and more collision-resistant than MD5 or SHA-1.

  5. What does 'chain of custody' document in a digital forensic investigation?

    Answer: The chronological history of evidence handling from collection to court

    Chain of custody documents every person who handled the evidence, when, and why, ensuring evidence admissibility by proving it was not tampered with.

  6. During a live forensic investigation, which data source should be acquired FIRST according to the order of volatility?

    Answer: System RAM and running processes

    RAM contains the most volatile data including running processes, open network connections, and decrypted content, and is lost immediately when the system powers off.

  7. What is the role of a forensic examiner when acquiring evidence from a suspect's smartphone?

    Answer: Place the device in airplane mode or a Faraday bag to prevent remote wipes

    Isolating the device in airplane mode or a Faraday bag prevents remote wipe commands, network-based evidence destruction, and preserves the device's current state.