Forensic Investigation Process (pre-, Investigation, and Post-Investigation Phases) DFE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A forensic investigator is examining a smartphone that is powered on. The investigator needs to extract data from the phone. What is the most important consideration before starting the extraction?

   • ATurn the phone off to preserve the battery
   • BPlace the phone in airplane mode to prevent remote data alteration
   • CConnect the phone to a computer to sync data
   • DUnlock the phone and begin browsing apps to find relevant data
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An investigator is analyzing a forensic image of a laptop involved in a fraud case. The investigator finds a suspicious spreadsheet that appears to have been deleted. The investigator needs to prove when the file was created and last modified. Which forensic technique should the investigator use?

   • AUse a hex editor to view the raw bytes of the file.
   • BExamine the file system metadata, such as MAC times, for the file.
   • CRun a keyword search for the file name in the unallocated space.
   • DCheck the Windows registry for the file's creation date.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A forensic investigator is called to a scene where a server is still running and connected to the network. The investigator has authorization to seize the server. The server is running a critical business application, and the company wants to minimize downtime. However, the investigator needs to preserve volatile data and ensure the integrity of the evidence. What is the BEST course of action?

   • ACopy the entire hard drive over the network to a forensic server while the system is running.
   • BRemove the hard drive from the server while it is still running to avoid downtime.
   • CCapture the RAM contents, then perform a live acquisition of the hard drive, and finally shut down the server for a physical image.
   • DImmediately shut down the server to prevent any further changes to the hard drive.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A forensic team is about to seize a server that is part of a cluster providing critical services. The team has authorization to seize the server, but doing so will cause a service outage. The team has a limited time window to collect evidence. What is the best course of action?

   • AWait until the next maintenance window to seize the server
   • BSeize the server immediately and accept the outage
   • CPerform a live acquisition of the server's memory and disk, then seize the server
   • DCopy only the server's configuration files and leave the rest
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A forensic investigator has completed the analysis of a smartphone involved in a harassment case. The investigator needs to present the findings in a way that is understandable to a jury. What is the BEST approach for presenting the evidence?

   • AProvide the raw forensic report to the jury without any explanation.
   • BCreate visual aids, such as timelines and charts, to illustrate the evidence.
   • CRely on the investigator's verbal testimony without any visual aids.
   • DUse technical jargon to demonstrate the investigator's expertise.
   Reveal Solution Discussion Select an answer first