Computer Forensics Fundamentals ECSS Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which forensic process phase involves creating a bit-for-bit copy of the storage media?

   • APreservation
   • BIdentification
   • CPresentation
   • DAnalysis
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A forensic investigator is working on a case that involves a company's email server. The investigator needs to access the emails of a specific employee. The company's legal team has provided a court order that authorizes the search of the employee's emails. However, the employee is a citizen of a country with strict data protection laws. What is the most important consideration for the investigator?

   • AThe court order is sufficient to access the emails regardless of data protection laws.
   • BThe investigator should ignore the data protection laws because the court order overrides them.
   • CThe investigator should ask the employee for consent to access the emails.
   • DThe investigator must ensure that the court order complies with the applicable data protection laws.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which of the following is an example of digital evidence?

   • AA printed email message that was found on a suspect's desk
   • BA log file from a web server that records user access requests
   • CA witness's verbal testimony about what they saw on a computer screen
   • DA handwritten note containing a password for a suspect's email account
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which activity is most closely associated with e-discovery rather than computer forensics?

   • AAnalyzing malware to determine its origin
   • BRecovering deleted files from a mobile device
   • CCreating a forensic image of a suspect's hard drive
   • DSearching email archives for documents relevant to a civil lawsuit
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A forensic investigator is working on a case where the suspect's computer was found turned on. The investigator needs to collect volatile data, such as RAM contents, before powering off the system. However, the investigator also needs to preserve the hard drive for later analysis. What is the most appropriate sequence of actions?

   • APower off the system immediately to preserve the hard drive.
   • BImage the hard drive first, then collect volatile data.
   • CCollect volatile data and image the hard drive simultaneously.
   • DCollect volatile data first, then power off the system and image the hard drive.
   Reveal Solution Discussion Select an answer first