Introduction to Computer Forensics DFE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A system administrator discovers that an employee's laptop was used to send a threatening email. The laptop is still running and the email client is open. The administrator wants to preserve evidence for a potential legal case. Which action best aligns with the computer forensics process?

   • ACopy the email and its contents to a USB drive for safekeeping
   • BDocument the current state, then acquire a forensic image of the hard drive and capture volatile data
   • CCapture a forensic image of the hard drive while the system is running
   • DImmediately shut down the laptop and remove the hard drive for imaging
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   During an internal investigation, an HR manager asks a forensic analyst to prove that an employee accessed a confidential file on a shared server. The analyst finds that the file's last access time was changed by the employee's actions. Which characteristic of digital evidence is most relevant to this situation?

   • ADigital evidence is always timestamped by the operating system
   • BDigital evidence is fragile and can be easily altered
   • CDigital evidence is only admissible if it is in its original form
   • DDigital evidence is always stored on the hard drive
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A forensic team is investigating a case of insider trading. The suspect's computer has been seized, and the team must analyze it. The team has a limited budget and must decide whether to use a commercial forensic tool or an open-source tool. The case is expected to go to trial, and the defense will likely challenge the evidence. What is the most important factor in this decision?

   • AThe tool's acceptance and validation in the forensic community
   • BThe tool's ability to produce a detailed report
   • CThe tool's ease of use for the team
   • DThe cost of the tool
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A company is investigating a possible insider threat. The security team wants to determine if an employee used a personal USB drive to copy sensitive files. The employee claims the USB drive is for personal use and has never been connected to the company computer. The team has the employee's company laptop. Which approach is most likely to yield reliable evidence?

   • ACheck the company's network logs for any large file transfers from the laptop
   • BSearch the laptop's registry and system logs for USB device connection history
   • CAsk the employee to provide the USB drive and then compare its contents to the company files
   • DCreate a forensic image of the laptop and analyze it for USB artifacts and file access records
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A forensic investigator is asked to analyze a smartphone in a case involving a hit-and-run accident. The phone's GPS data may show the suspect's location at the time of the accident. The defense attorney argues that the GPS data is unreliable because the phone's clock was not synchronized. What is the investigator's best response?

   • ACorrelate the GPS data with other evidence, such as cell tower logs, to verify its accuracy
   • BRefuse to testify about the GPS data
   • CAgree that the GPS data is unreliable and exclude it
   • DExplain that GPS data is always accurate and reliable
   Reveal Solution Discussion Select an answer first