Computer Forensics in Today's World CHFI Practice Questions (Page 11)

Questions 51–53

1. 51application · medium

   A forensic examiner is reading about the history of computer forensics and notes that early investigations focused on recovering deleted files from floppy disks and hard drives. Today, investigations often involve cloud storage and social media. Which statement best describes this change?

   • AThe need for forensic tools has decreased because cloud providers handle investigations.
   • BThe role of the forensic examiner has become less important.
   • CThe legal process has become simpler because data is now centralized.
   • DThe scope of digital evidence has expanded to include data stored on remote servers and devices.
   Reveal Solution Discussion Select an answer first
2. 52application · medium

   A company discovers that an employee's laptop contains files that may be relevant to a lawsuit. The legal team wants to preserve and collect only the specific files related to the case, while the IT security team wants to analyze the entire hard drive for signs of malware. The company's counsel insists that the process must follow a defensible, court-approved methodology. Which approach best aligns with the legal team's requirement?

   • AAsk the employee to email the relevant files to the legal team.
   • BPerform a full forensic image of the hard drive and then extract the relevant files using a forensic tool.
   • CCopy only the relevant files to a USB drive and hand them to the legal team.
   • DRun a malware scan on the laptop and then delete any files that are not related to the lawsuit.
   Reveal Solution Discussion Select an answer first
3. 53application · medium

   A forensic examiner is hired by a company to investigate an employee suspected of leaking confidential data. The examiner is given access to the employee's work computer and email account. During the investigation, the examiner finds personal emails unrelated to the case. What is the most appropriate ethical action for the examiner?

   • ADelete the personal emails to protect the employee's privacy.
   • BInclude the personal emails in the final report as background information.
   • CIgnore the personal emails and focus only on evidence related to the data leak.
   • DReport the personal emails to the company's management as potential policy violations.
   Reveal Solution Discussion Select an answer first