Forensic Investigation Process (pre-, Investigation, and Post-Investigation Phases) DFE Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which activity is part of the examination and analysis step in the investigation phase of digital forensics?

   • AObtaining a search warrant
   • BSecuring the physical scene
   • CRecovering deleted files from a forensic image
   • DPresenting findings in court
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   During a forensic examination, an investigator finds a file that appears to be relevant to the case. The file's metadata shows it was created after the incident date. What should the investigator do?

   • AChange the file's creation date to match the incident timeline
   • BDelete the file to avoid confusion
   • CIgnore the file because it does not fit the timeline
   • DDocument the file and its metadata, and consider that the system clock may have been altered
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   During a forensic investigation, an analyst needs to collect the contents of a suspect's RAM from a running Windows system. The analyst has already obtained written authorization and documented the scene. Which step should the analyst perform NEXT to ensure the evidence is collected properly?

   • APower down the system and then remove the RAM chips for physical imaging.
   • BCreate a forensic image of the hard drive before touching the RAM.
   • CRun a trusted memory acquisition tool to capture the RAM contents to an external drive.
   • DUse the built-in Windows Task Manager to export the running processes list.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A company's security team discovers that an employee has been accessing unauthorized websites during work hours. The company wants to investigate but is concerned about employee privacy laws. The employee uses a company-issued computer, and the company's policy states that computer usage may be monitored. What is the BEST way to proceed with the investigation?

   • AImmediately seize the computer and search for browsing history without any further review.
   • BReview the company's monitoring policy and ensure the investigation complies with it and applicable laws.
   • CAsk the employee for consent to search the computer.
   • DIgnore the issue because monitoring employee activity is always illegal.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A forensic investigator is analyzing a server that was compromised by a ransomware attack. The investigator needs to determine the entry point of the attack and the extent of the data exfiltration. The server's logs have been partially deleted by the attacker. What is the BEST approach to reconstruct the timeline of the attack?

   • AReinstall the operating system and recreate the logs from memory.
   • BCorrelate the remaining server logs with network traffic captures and firewall logs.
   • CRely solely on the server's event logs, even if they are incomplete.
   • DUse the attacker's ransom note as the primary source of the timeline.
   Reveal Solution Discussion Select an answer first