Forensic Investigation Process (pre-, Investigation, and Post-Investigation Phases) DFE Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A forensic investigator is writing the final report for a case involving an employee accused of sending threatening emails. The investigator has completed the analysis and is now documenting the findings. What should the investigator include in the report to ensure it is complete and usable?

   • AA detailed description of the evidence, the tools used, and the analysis steps taken.
   • BA list of all the emails found, without any context or analysis.
   • CThe investigator's personal recommendation on the employee's punishment.
   • DOnly the final conclusion that the employee sent the emails.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   During the pre-investigation phase, what is the primary purpose of securing the scene where digital devices are located?

   • ATo allow investigators to copy files directly from the devices
   • BTo begin the chain of custody documentation
   • CTo prevent unauthorized access and potential alteration of digital evidence
   • DTo ensure all devices are powered off immediately
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A company suspects an employee of leaking confidential documents. The IT team is about to seize the employee's desktop computer. The office is shared, and other employees are present. What is the most appropriate action to secure the scene?

   • AAllow the employee to save their work before the computer is seized
   • BTake a photo of the desk and then let the employee continue working until IT is ready
   • CAsk the other employees to leave and then immediately disconnect the computer from the network
   • DCopy the employee's files to a network share before seizing the computer
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   An organization is about to conduct a forensic investigation of a manager's computer. The manager is on vacation and cannot be reached. The computer is in a locked office. The organization has a policy that allows access to company devices. What is the most appropriate action?

   • AWait until the manager returns to obtain consent
   • BContact the manager's supervisor to authorize access and have facilities open the office
   • CAsk the manager's assistant to log into the computer remotely
   • DBreak the lock and seize the computer immediately
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A forensic examiner is writing a report for a case involving a data breach. The examiner found evidence that the breach was caused by a phishing email. However, the examiner also found that the company's firewall logs were incomplete. How should the examiner handle this limitation in the report?

   • AAssume that the firewall logs would have shown the same phishing activity
   • BRecommend that the company improve its logging practices, but do not mention it in the report
   • CState that the firewall logs are incomplete and explain how this affects the findings
   • DOmit the limitation to avoid weakening the case
   Reveal Solution Discussion Select an answer first