Which characteristic is commonly associated with digital evidence?

It is always stored on a physical hard drive

It is permanent and cannot be deleted

It is always visible to the naked eye

It is fragile and can be easily altered or destroyed

A forensic examiner is working on a case involving a stolen laptop. The examiner has identified a suspicious file on the laptop's hard drive and needs to determine if it was downloaded from the internet. Which combination of goals is the examiner applying?

Identification and interpretation

A small business owner suspects an employee of leaking customer information. The owner has a copy of the employee's work computer's hard drive and wants to know if the employee accessed specific files. The owner asks a consultant for advice. What is the consultant's primary role in this situation?

To interview the employee and other staff members

To advise the owner on legal consequences of the leak

To use forensic tools to analyze the hard drive copy for evidence of file access

To recommend disciplinary action against the employee

EC-CouncilDigital Forensics Essentials

Domain 1Objective 1

Introduction to Computer Forensics DFE Practice Questions (Page 6)

Part of the Computer Forensics Foundations and Process domain, which makes up ~15% of our current practice bank.

35questions here

7free pages

5concepts

Questions 26–30

26foundation · easy
Which characteristic is commonly associated with digital evidence?
Select an answer first
27application · medium
A forensic examiner is documenting the steps taken during an investigation for a court case. The examiner records who handled the evidence, when it was handled, and where it was stored. Which step of the computer forensics process does this documentation support?
Select an answer first
28foundation · easy
What is the first step in the computer forensics process?
Select an answer first
29application · medium
A forensic examiner is working on a case involving a stolen laptop. The examiner has identified a suspicious file on the laptop's hard drive and needs to determine if it was downloaded from the internet. Which combination of goals is the examiner applying?
Select an answer first
30application · easy
A small business owner suspects an employee of leaking customer information. The owner has a copy of the employee's work computer's hard drive and wants to know if the employee accessed specific files. The owner asks a consultant for advice. What is the consultant's primary role in this situation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DFE” is a trademark of its owner, used for identification only.

Introduction to Computer Forensics DFE Practice Questions (Page 6)

Questions 26–30

Which characteristic is commonly associated with digital evidence?

A forensic examiner is documenting the steps taken during an investigation for a court case. The examiner records who handled the evidence, when it was handled, and where it was stored. Which step of the computer forensics process does this documentation support?

What is the first step in the computer forensics process?

A forensic examiner is working on a case involving a stolen laptop. The examiner has identified a suspicious file on the laptop's hard drive and needs to determine if it was downloaded from the internet. Which combination of goals is the examiner applying?

A small business owner suspects an employee of leaking customer information. The owner has a copy of the employee's work computer's hard drive and wants to know if the employee accessed specific files. The owner asks a consultant for advice. What is the consultant's primary role in this situation?

Keep studying — Computer Forensics Foundations and Process