OIC OIC Technology & Digital Investigations 1 — Questions and Answers
Question 1: When seizing a mobile device during an OIC investigation, what is the primary concern regarding digital evidence integrity?
- Preventing remote wipe by isolating the device from wireless networks (Correct answer)
- Ensuring the device battery is fully charged before seizure
- Backing up data to personal cloud storage for safekeeping
- Keeping the screen unlocked to preserve active sessions
Correct answer: Preventing remote wipe by isolating the device from wireless networks
Isolating the device using airplane mode or a Faraday bag prevents remote wiping or data alteration, preserving digital evidence integrity.
Question 2: Which tool is used to create a forensic image of a hard drive while preventing any data modification?
- Write blocker combined with imaging software (Correct answer)
- Standard file copy utility such as Windows Explorer
- Cloud sync application to mirror drive contents
- Antivirus scan with deep archive extraction
Correct answer: Write blocker combined with imaging software
A write blocker hardware device prevents any writes to the source drive while imaging software creates a bit-for-bit forensic copy.
Question 3: In digital investigations, a hash value such as MD5 or SHA-256 is used to:
- Verify that a digital file has not been altered since it was collected (Correct answer)
- Encrypt sensitive files stored on evidence servers
- Identify the geographic location of a device
- Compress large evidence files for easier storage
Correct answer: Verify that a digital file has not been altered since it was collected
Hash values serve as digital fingerprints — any change to a file produces a different hash, confirming whether evidence has been altered.
Question 4: An OIC inspector reviewing surveillance footage should first establish:
- Chain of custody from original recording system to review copy (Correct answer)
- The brand of the recording equipment used
- Whether the footage has been compressed for storage
- The identity of all individuals visible in the footage
Correct answer: Chain of custody from original recording system to review copy
Chain of custody must be established for surveillance footage to ensure it is admissible and has not been tampered with.
Question 5: Metadata in digital files can provide investigators with which type of information?
- Creation date, modification date, author, and device information (Correct answer)
- The file's encryption key and access permissions
- The identity of all users who viewed the file
- The geographic coordinates where the file was stored
Correct answer: Creation date, modification date, author, and device information
File metadata records information such as when a document was created or modified, the author, and the device on which it was created.
Question 6: When documenting digital evidence in an OIC case, the inspector should record:
- The device make, model, serial number, condition, and how it was found (Correct answer)
- Only the data extracted from the device after forensic imaging
- The name of the forensic analyst who performed the extraction
- The estimated monetary value of the device
Correct answer: The device make, model, serial number, condition, and how it was found
Thorough documentation of physical device details at the time of seizure supports chain of custody and provides context for forensic analysis.
OIC OIC Technology & Digital Investigations 1
When seizing a mobile device during an OIC investigation, what is the primary concern regarding digital evidence integrity?