OIC Technology & Digital Investigations Flashcards

When seizing a mobile device during an OIC investigation, what is the primary concern regarding digital evidence integrity?

Answer: Preventing remote wipe by isolating the device from wireless networks

Isolating the device using airplane mode or a Faraday bag prevents remote wiping or data alteration, preserving digital evidence integrity.

Which tool is used to create a forensic image of a hard drive while preventing any data modification?

Answer: Write blocker combined with imaging software

A write blocker hardware device prevents any writes to the source drive while imaging software creates a bit-for-bit forensic copy.

In digital investigations, a hash value such as MD5 or SHA-256 is used to:

Answer: Verify that a digital file has not been altered since it was collected

Hash values serve as digital fingerprints — any change to a file produces a different hash, confirming whether evidence has been altered.

An OIC inspector reviewing surveillance footage should first establish:

Answer: Chain of custody from original recording system to review copy

Chain of custody must be established for surveillance footage to ensure it is admissible and has not been tampered with.

Metadata in digital files can provide investigators with which type of information?

Answer: Creation date, modification date, author, and device information

File metadata records information such as when a document was created or modified, the author, and the device on which it was created.

When documenting digital evidence in an OIC case, the inspector should record:

Answer: The device make, model, serial number, condition, and how it was found

Thorough documentation of physical device details at the time of seizure supports chain of custody and provides context for forensic analysis.