What is the purpose of timeline analysis in forensic investigation?

To reconstruct the sequence of events by correlating timestamps from various artifacts

To predict future malicious activities

To measure the performance of the forensic tool

To determine the exact time of day an event occurred

A forensic team is tasked with imaging a RAID 5 server that is part of an ongoing investigation. The server is critical to business operations and cannot be taken offline for more than a few hours. The team must preserve the evidence while minimizing downtime. Which approach is most appropriate?

Copy the data over the network to a forensic server while the system is running.

Perform a live acquisition of the logical volume and document the process.

Take the server offline and image each physical disk individually using write blockers.

Use a hardware RAID controller to create a snapshot of the logical volume, then image the snapshot.

What is the function of a write blocker in forensic imaging?

To create a hash of the evidence device

To encrypt the data on the evidence device

To speed up the imaging process

To prevent any data from being written to the original evidence device

A forensic examiner must create an exact copy of a suspect's hard drive for analysis while ensuring the original is not altered. Which combination of tools and procedures is most appropriate?

Create a logical image of the partition and verify with a cyclic redundancy check (CRC).

Boot the suspect's system and use a software imaging tool to copy files to an external drive.

Use a write blocker and copy only the active files to a new drive, then compare file sizes.

Use a hardware write blocker and create a bit-for-bit image, then hash the original and the image with SHA-256.

EC-CouncilCertified Cybersecurity Technician

Domain 7Objective 2

Computer Forensics CCT Practice Questions (Page 6)

Part of the Incident Response and Computer Forensics domain, which makes up ~10% of our current practice bank.

56questions here

12free pages

13concepts

Questions 26–30

26foundation · easy
What is the purpose of timeline analysis in forensic investigation?
Select an answer first
27expert · hard
A forensic team is tasked with imaging a RAID 5 server that is part of an ongoing investigation. The server is critical to business operations and cannot be taken offline for more than a few hours. The team must preserve the evidence while minimizing downtime. Which approach is most appropriate?
Select an answer first
28foundation · easy
What is the function of a write blocker in forensic imaging?
Select an answer first
29application · medium
A forensic examiner must create an exact copy of a suspect's hard drive for analysis while ensuring the original is not altered. Which combination of tools and procedures is most appropriate?
Select an answer first
30foundation · easy
What is a common tool used to capture network traffic for forensic analysis?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CCT” is a trademark of its owner, used for identification only.