ISA Digital Forensics & Investigation

Question 1

Which principle ensures that digital evidence is not altered during collection and analysis?

Accepted Answer

Write blocking

Answer

Write blockers prevent any write operations to storage media during forensic acquisition, ensuring the original evidence is not altered.

Question 2

In digital forensics, 'order of volatility' refers to:

Accepted Answer

The priority order for collecting evidence based on how quickly it may be lost

Answer

Order of volatility guides forensic analysts to collect the most transient data first (e.g., RAM, running processes) before it is lost when the system is powered off.

Question 3

What is the primary purpose of a forensic disk image?

Accepted Answer

To create an exact bit-for-bit copy of the original storage media

Answer

A forensic disk image is a bit-for-bit copy of the original media, allowing analysts to work on the copy while preserving the original evidence untouched.

Question 4

Which hashing algorithm is most commonly used to verify forensic evidence integrity?

Accepted Answer

SHA-256 or SHA-512

Answer

SHA-256 and SHA-512 are preferred for forensic integrity verification because they are cryptographically stronger and more collision-resistant than MD5 or SHA-1.

Question 5

What does 'chain of custody' document in a digital forensic investigation?

Accepted Answer

The chronological history of evidence handling from collection to court

Answer

Chain of custody documents every person who handled the evidence, when, and why, ensuring evidence admissibility by proving it was not tampered with.

ISA - Information Security Analyst Certification Practice Test

ISA - Information Security Analyst Certification Practice Test

ISA Digital Forensics & Investigation