Introduction to Computer Forensics DFE Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A forensic analyst is examining a server that was compromised. The analyst finds log entries that appear to show an attacker's actions, but the timestamps are inconsistent with other system logs. The analyst suspects the logs were tampered with. Which characteristic of digital evidence is most relevant to this suspicion?

   • ADigital evidence is only found on the primary storage device
   • BDigital evidence is easily modified without leaving traces
   • CDigital evidence is always a true representation of events
   • DDigital evidence is often stored in multiple locations
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A forensic investigator is called to a scene where a suspect's computer is running, and the investigator must decide whether to perform a live acquisition or a dead acquisition. The suspect is known to have encrypted files, and the computer has been running for several hours. The investigator has a limited time to act. What is the most important consideration in this decision?

   • AThe need to capture volatile data, including decryption keys
   • BThe need to complete the acquisition quickly
   • CThe need to avoid altering the system state
   • DThe need to preserve the integrity of the hard drive
   Reveal Solution Discussion Select an answer first
4. 33application · easy

   A forensic examiner is asked to analyze a smartphone seized in a fraud investigation. The examiner needs to extract deleted text messages and call logs. Which definition best describes the examiner's overall task?

   • AInterviewing the suspect about their phone usage
   • BRecovering data using specialized forensic tools
   • CInvestigating digital evidence to uncover facts for legal proceedings
   • DAnalyzing the phone's hardware components
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A systems administrator discovers that an employee's workstation may have been used to exfiltrate customer data. The company's legal counsel has instructed the administrator to preserve all potential evidence for a civil lawsuit. The administrator powers off the machine and places it in a locked cabinet. Which critical aspect of the computer forensics process has the administrator most directly addressed?

   • AExtraction of digital evidence
   • BDocumentation of the investigation
   • CPreservation of digital evidence
   • DIdentification of relevant data
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   An analyst is examining a USB drive found at a crime scene. The drive contains a document that appears to have been edited after the crime was committed. Which characteristic of digital evidence is most important for the analyst to consider?

   • ADigital evidence is time-sensitive and can be altered by normal use
   • BDigital evidence is only valid if it is in its original format
   • CDigital evidence is always stored in a central location
   • DDigital evidence can be easily duplicated without loss of fidelity
   Reveal Solution Discussion Select an answer first