Computer Forensics Fundamentals ECSS Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A forensic investigator is documenting the chain of custody for a seized smartphone. The investigator has collected the device, placed it in an evidence bag, and sealed it. The investigator then needs to transport the device to the forensic lab. Which action is most important during transportation?

   • APower off the device to prevent any remote wiping.
   • BMaintain a detailed log of who has possession of the device at all times.
   • CPlace the device in a Faraday bag to block wireless signals.
   • DKeep the device powered on to preserve any volatile data.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A forensic investigator is documenting the seizure of a laptop from an employee's office. The investigator photographs the scene, labels the laptop, and records the serial number. Which additional step is most critical to ensure the evidence remains admissible in court?

   • ACopy the hard drive contents to a backup drive on-site.
   • BPlace the laptop in an anti-static bag and seal it with evidence tape.
   • CImmediately power on the laptop to check for running processes.
   • DAsk the employee to provide the login password for later analysis.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A forensic examiner is analyzing a USB drive found at a crime scene. The drive contains a document that was created after the suspect's computer was seized. What does this indicate about the evidence?

   • AThe document was created by the suspect
   • BThe document is definitely fake
   • CThe document is not relevant to the case
   • DThe document may have been created on another device
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the purpose of maintaining a chain of custody for digital evidence?

   • ATo document every person who handled the evidence and prove it has not been tampered with
   • BTo allow multiple investigators to work on the same evidence simultaneously
   • CTo ensure the evidence is stored in a fireproof safe
   • DTo encrypt the evidence so that only authorized personnel can access it
   Reveal Solution Discussion Select an answer first
6. 20expert · medium

   A forensic examiner is testifying in court about the findings of a digital investigation. The defense attorney asks whether the examiner followed the standard forensic process. What is the examiner's BEST response?

   • AI am confident in my findings
   • BI followed the identification, preservation, analysis, and presentation phases
   • CI have conducted many investigations before
   • DI used a write-blocker and created a forensic image
   Reveal Solution Discussion Select an answer first