Computer Forensics Fundamentals ECSS Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A company's legal team is preparing for a lawsuit and needs to collect emails from a former employee's mailbox. The IT team also suspects the former employee may have deleted emails to hide evidence. What is the BEST course of action?

   • AIgnore the deleted emails and collect only existing emails
   • BRestore the mailbox from backup and then collect the emails
   • CUse e-discovery tools to collect the mailbox and preserve it
   • DAsk the former employee to provide the emails
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A systems administrator discovers that an employee's workstation may have been used to access unauthorized data. The administrator immediately powers off the machine and calls the forensics team. Which action should the forensics team take FIRST upon arrival?

   • AInterview the employee to determine what they accessed.
   • BDocument the system state, including open windows and running processes, before disconnecting power.
   • CCheck the system's event logs for unauthorized access attempts.
   • DCreate a forensic image of the hard drive using a write-blocker.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   An investigator is examining a computer that was used to send threatening emails. The investigator finds the emails in the sent folder and also finds traces of the emails in the system's temporary files. Which type of digital evidence is the temporary file data?

   • AMetadata
   • BVolatile data
   • CEncrypted data
   • DPersistent data
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A company is facing a lawsuit and must produce all relevant emails. The IT team also suspects that an employee is involved in a separate security incident. The legal team wants to ensure that the email collection does not interfere with the security investigation. What is the BEST approach?

   • AStart the forensic investigation first, then perform e-discovery
   • BPerform e-discovery first, then start the forensic investigation
   • CCoordinate both processes to preserve evidence and avoid interference
   • DUse the same forensic image for both e-discovery and the security investigation
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A financial analyst is suspected of leaking client data. The security team has identified a USB drive that was connected to the analyst's workstation. The drive is currently in the analyst's possession. Which action should the forensic investigator take first to preserve the evidence?

   • ARun a quick antivirus scan on the drive to ensure it is safe to handle.
   • BInterview the analyst before touching the drive to establish intent.
   • CCopy the files from the USB drive to a network share for analysis.
   • DSeize the USB drive and create a bit-for-bit image of it using a write-blocker.
   Reveal Solution Discussion Select an answer first