ISA Digital Forensics & Investigation 1 — Questions and Answers
Question 1: Which principle ensures that digital evidence is not altered during collection and analysis?
- Chain of custody
- Write blocking (Correct answer)
- Order of volatility
- Evidence integrity
Correct answer: Write blocking
Write blockers prevent any write operations to storage media during forensic acquisition, ensuring the original evidence is not altered.
Question 2: In digital forensics, 'order of volatility' refers to:
- The sequence in which malware spreads through a network
- The priority order for collecting evidence based on how quickly it may be lost (Correct answer)
- The ranking of data by its sensitivity classification
- The order in which logs are deleted by attackers
Correct answer: The priority order for collecting evidence based on how quickly it may be lost
Order of volatility guides forensic analysts to collect the most transient data first (e.g., RAM, running processes) before it is lost when the system is powered off.
Question 3: What is the primary purpose of a forensic disk image?
- To compress evidence files for storage
- To create an exact bit-for-bit copy of the original storage media (Correct answer)
- To encrypt the evidence for secure transport
- To index all files on the drive for faster searching
Correct answer: To create an exact bit-for-bit copy of the original storage media
A forensic disk image is a bit-for-bit copy of the original media, allowing analysts to work on the copy while preserving the original evidence untouched.
Question 4: Which hashing algorithm is most commonly used to verify forensic evidence integrity?
- MD5 or SHA-1
- SHA-256 or SHA-512 (Correct answer)
- CRC32
- HMAC-MD5
Correct answer: SHA-256 or SHA-512
SHA-256 and SHA-512 are preferred for forensic integrity verification because they are cryptographically stronger and more collision-resistant than MD5 or SHA-1.
Question 5: What does 'chain of custody' document in a digital forensic investigation?
- The sequence of commands executed by an attacker
- The chronological history of evidence handling from collection to court (Correct answer)
- The list of tools used during forensic analysis
- The network path data traveled during the incident
Correct answer: The chronological history of evidence handling from collection to court
Chain of custody documents every person who handled the evidence, when, and why, ensuring evidence admissibility by proving it was not tampered with.
Question 6: During a live forensic investigation, which data source should be acquired FIRST according to the order of volatility?
- Hard disk drive contents
- System RAM and running processes (Correct answer)
- Network configuration files
- Log files stored on disk
Correct answer: System RAM and running processes
RAM contains the most volatile data including running processes, open network connections, and decrypted content, and is lost immediately when the system powers off.
Question 7: What is the role of a forensic examiner when acquiring evidence from a suspect's smartphone?
- Boot the device into recovery mode to access all data
- Place the device in airplane mode or a Faraday bag to prevent remote wipes (Correct answer)
- Connect the device to the internet to retrieve cloud backups
- Perform a factory reset to reveal hidden partitions
Correct answer: Place the device in airplane mode or a Faraday bag to prevent remote wipes
Isolating the device in airplane mode or a Faraday bag prevents remote wipe commands, network-based evidence destruction, and preserves the device's current state.
ISA Digital Forensics & Investigation 1
Which principle ensures that digital evidence is not altered during collection and analysis?