PCI Digital & Cyber Investigation 2 — Questions and Answers
Question 1: When conducting a forensic image of a suspect's hard drive, what is the primary purpose of using a write blocker?
- To speed up the imaging process
- To prevent any data from being written to the original drive (Correct answer)
- To compress the forensic image file
- To decrypt encrypted partitions
Correct answer: To prevent any data from being written to the original drive
A write blocker ensures the original evidence drive remains unaltered by preventing any write operations during the imaging process.
Question 2: An investigator discovers that a suspect used incognito/private browsing mode. Which artifact is MOST likely to still be recoverable?
- Browser history files
- Cached web pages
- DNS cache entries in memory (Correct answer)
- Saved passwords
Correct answer: DNS cache entries in memory
DNS cache entries stored in system memory or router logs can persist after private browsing sessions end, revealing visited domains.
Question 3: Under the Electronic Communications Privacy Act (ECPA), what is generally required to compel an ISP to disclose the contents of stored emails older than 180 days?
- A subpoena
- A search warrant (Correct answer)
- An administrative order
- A grand jury subpoena only
Correct answer: A search warrant
Though ECPA originally allowed subpoenas for emails over 180 days, courts and updated DOJ guidance now require a search warrant for email content regardless of age.
Question 4: A PCI investigator needs to preserve volatile evidence on a running Windows system. Which action should be performed FIRST?
- Pull the power cord immediately
- Capture the contents of RAM (Correct answer)
- Take a screenshot of the desktop
- Run antivirus software
Correct answer: Capture the contents of RAM
RAM contains volatile data including running processes, network connections, and encryption keys that are lost when the system powers down.
Question 5: Which hashing algorithm is currently considered the industry standard for verifying forensic image integrity in digital investigations?
- MD5
- SHA-1
- SHA-256 (Correct answer)
- CRC32
Correct answer: SHA-256
SHA-256 is the current industry standard for forensic verification as MD5 and SHA-1 have known collision vulnerabilities.
Question 6: During a corporate investigation, an employee's personal smartphone is found connected to a company computer. What should the investigator do FIRST?
- Seize the smartphone immediately
- Photograph the connection and document the state (Correct answer)
- Disconnect the phone to prevent data transfer
- Search the phone for evidence
Correct answer: Photograph the connection and document the state
Documentation of the existing state preserves the evidentiary record before any action is taken that could alter or challenge the evidence.
Question 7: What is 'anti-forensics' in the context of a digital investigation?
- Using forensic tools in reverse order
- Techniques used to hamper or defeat forensic analysis (Correct answer)
- Analyzing evidence to exonerate a suspect
- Cross-examining digital evidence in court
Correct answer: Techniques used to hamper or defeat forensic analysis
Anti-forensics encompasses methods such as data wiping, steganography, and timestamp manipulation used to obstruct forensic investigators.
PCI Digital & Cyber Investigation 2
When conducting a forensic image of a suspect's hard drive, what is the primary purpose of using a write blocker?