CSI CSI - Crime Scene Investigator Digital and Electronic Evidence Questions and Answers

Question 1

What is the first step when encountering a powered-on computer at a crime scene?

Accepted Answer

Document its current state before any action

Answer

Documenting the current state preserves volatile data and maintains the chain of custody before any action is taken.

Question 2

Which type of data is considered 'volatile' in digital forensics?

Accepted Answer

Data stored in RAM

Answer

Volatile data such as RAM contents is permanently lost when a device loses power.

Question 3

What does a 'write blocker' do in a digital forensic investigation?

Accepted Answer

Prevents modification of digital evidence during acquisition

Answer

A write blocker allows data to be read and copied while preventing any writes that would alter the original evidence.

Question 4

What is a forensic image in a digital investigation?

Accepted Answer

An exact bit-for-bit copy of digital storage media

Answer

A forensic image is a sector-by-sector duplicate that preserves all data including deleted files and unallocated space.

Question 5

Which hashing algorithm is commonly used to verify the integrity of digital evidence?

Accepted Answer

MD5 or SHA-256

Answer

MD5 and SHA-256 generate unique hash values that confirm a forensic copy is identical to the original.

(CSI) Crime Scene Investigator Practice Test