Forensic Investigation Process (pre-, Investigation, and Post-Investigation Phases) DFE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A company's HR department suspects an employee of leaking confidential documents. The employee uses a company-issued laptop and a personal smartphone. The company's acceptable-use policy states that company devices may be searched, but personal devices are not covered. The employee is currently on a business trip. What should the investigator do to prepare for the investigation?

   • AObtain legal advice on the scope of the search and secure the necessary authorization for the company laptop.
   • BWait until the employee returns and then search both devices without any documentation.
   • CSeize the company laptop immediately and image the personal smartphone without consent.
   • DAsk the employee to email the confidential documents to the HR department for review.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A forensic examiner is preparing to present findings in a civil case. The examiner's report includes an opinion that the defendant intentionally deleted files. The defense argues that the deletion could have been accidental. What is the best way to support the examiner's opinion?

   • ARely on the fact that the defendant is the only user of the computer
   • BAvoid giving an opinion on intent and only present the facts
   • CState that the deletion was intentional because the files were deleted
   • DProvide evidence of the deletion method, such as the use of a file-shredding tool, and correlate it with user activity logs
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   In the investigation phase of digital forensics, what is the primary purpose of creating a forensic image of a storage device?

   • ATo preserve the original evidence while allowing analysis on a copy
   • BTo verify the device is working properly
   • CTo encrypt the device for secure storage
   • DTo delete irrelevant files from the device
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   In the post-investigation phase, what is the primary purpose of the final forensic report?

   • ATo document the investigation process and present findings clearly
   • BTo request additional funding for the investigation
   • CTo serve as a backup of the forensic images
   • DTo provide a list of all deleted files found
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A systems administrator discovers that a terminated employee's laptop may contain evidence of data exfiltration. The laptop is still in the employee's former office, and the office is unlocked. The administrator is the first responder. What is the FIRST action the administrator should take before touching the laptop?

   • ACopy the hard drive using a write blocker
   • BDisconnect the laptop from the network to prevent remote wiping
   • CObtain written authorization from management to seize and examine the device
   • DPower on the laptop to check if the user is still logged in
   Reveal Solution Discussion Select an answer first