A forensic investigator is analyzing a USB drive seized from a suspect. The investigator needs to prove that the evidence has not been altered since collection. What is the most reliable method to achieve this?

Take a photograph of the USB drive

Calculate a cryptographic hash of the drive before and after analysis

Use a write blocker during analysis

Store the USB drive in a locked evidence locker

A forensic investigator is preparing to testify in court about the findings of a digital investigation. The investigator used a forensic tool that is widely accepted in the industry, but the opposing counsel questions whether the tool was used correctly. What should the investigator do to prepare for this challenge?

Rely on the tool's reputation to justify the results without further explanation.

Bring the forensic tool to court and demonstrate its use on the stand.

Refuse to answer questions about the tool's usage, citing professional confidentiality.

Review the tool's documentation and be prepared to explain each step of the analysis process.

After completing a forensic investigation, the examiner must present the findings to a non-technical audience, including executives and legal counsel. What is the best way to structure the presentation?

Begin with the raw data and tool outputs, then explain the conclusions

Start with a high-level summary of findings, then provide supporting technical details

Use as much technical jargon as possible to demonstrate expertise

Present only the final conclusion without any supporting evidence

An investigator is analyzing a hard drive that contains encrypted files. The investigator has a search warrant that authorizes the seizure of the drive but does not mention the encryption password. The suspect refuses to provide the password. What is the most appropriate action?

Report the inability to access the files and seek additional legal authority, such as a court order to compel the password

Close the case because the evidence cannot be accessed

Use forensic tools to bypass the encryption

Attempt to crack the encryption using brute force

An investigator is examining a laptop that was used to access a cloud-based email service. The investigator needs to obtain emails that are relevant to the case. The emails are stored on the service provider's servers. What is the most appropriate method to obtain these emails?

Use the laptop's browser cache to recover the emails

Issue a legal request to the cloud service provider for the emails

Log into the user's email account using credentials found on the laptop

Contact the user and ask them to forward the emails

EC-CouncilDigital Forensics Essentials

Domain 1Objective 5

Forensic Investigation Process (pre-, Investigation, and Post-Investigation Phases) DFE Practice Questions (Page 2)

Part of the Computer Forensics Foundations and Process domain, which makes up ~15% of our current practice bank.

44questions here

9free pages

3concepts

Questions 6–10

6application · medium
A forensic investigator is analyzing a USB drive seized from a suspect. The investigator needs to prove that the evidence has not been altered since collection. What is the most reliable method to achieve this?
Select an answer first
7expert · hard
A forensic investigator is preparing to testify in court about the findings of a digital investigation. The investigator used a forensic tool that is widely accepted in the industry, but the opposing counsel questions whether the tool was used correctly. What should the investigator do to prepare for this challenge?
Select an answer first
8application · medium
After completing a forensic investigation, the examiner must present the findings to a non-technical audience, including executives and legal counsel. What is the best way to structure the presentation?
Select an answer first
9expert · hard
An investigator is analyzing a hard drive that contains encrypted files. The investigator has a search warrant that authorizes the seizure of the drive but does not mention the encryption password. The suspect refuses to provide the password. What is the most appropriate action?
Select an answer first
10expert · hard
An investigator is examining a laptop that was used to access a cloud-based email service. The investigator needs to obtain emails that are relevant to the case. The emails are stored on the service provider's servers. What is the most appropriate method to obtain these emails?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DFE” is a trademark of its owner, used for identification only.