Forensic Investigation Process (pre-, Investigation, and Post-Investigation Phases) DFE Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A forensic investigator arrives at a crime scene where a computer is found turned off. The investigator needs to preserve the evidence. What is the most appropriate action?

   • ADisconnect the power supply and immediately start imaging the hard drive on site
   • BLabel all cables and connections, then transport the computer to a forensic lab
   • CPhotograph the scene and then remove the hard drive for imaging
   • DTurn the computer on to check if it is working
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   During an internal fraud investigation, an investigator needs to collect evidence from a suspect's workstation. The workstation is running and the user is logged in. The investigator has a forensically sound write blocker and an external drive. What is the most appropriate next step?

   • AImmediately pull the power cord to preserve the hard drive state
   • BPerform a live acquisition of volatile data before powering down the system
   • CCopy the user's files to an external drive using the operating system
   • DLog off the user and then create a forensic image
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A forensic team is about to conduct a raid on a suspect's home to seize digital devices. The team has a search warrant that authorizes the seizure of 'computers and storage media.' During the raid, the team finds a smartphone that is not listed in the warrant. The smartphone is locked, and the team believes it may contain evidence of the crime. What should the team do?

   • ASeize the smartphone and later obtain a separate warrant for its examination.
   • BAttempt to unlock the smartphone immediately to search for evidence.
   • CAsk the suspect to unlock the smartphone voluntarily.
   • DLeave the smartphone behind because it is not in the warrant.
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A forensic investigator has completed the analysis of a laptop and is preparing the final report. The report will be used in a criminal trial. The investigator used a new, untested forensic tool during the analysis. The defense attorney is likely to challenge the tool's reliability. What should the investigator do to strengthen the report?

   • AUse a different, well-known tool to redo the analysis and include both results.
   • BDocument the tool's name, version, and the validation process used to confirm its reliability.
   • CRely on the investigator's experience to justify the tool's use.
   • DOmit the tool's name from the report to avoid scrutiny.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A forensic analyst is examining a hard drive image from a suspected data breach. The analyst needs to recover deleted files and identify the timeline of the breach. Which combination of actions should the analyst take during the examination phase?

   • ABoot the image in a virtual machine and browse the internet to see what the user did.
   • BRun a full antivirus scan on the image and then delete any detected malware.
   • CCopy the image to a network share and then use the original drive for analysis.
   • DUse file carving tools to recover deleted files and analyze file system metadata to establish a timeline.
   Reveal Solution Discussion Select an answer first