Computer Forensics Fundamentals ECSS Practice Questions (Page 9)

Questions 41–43

1. 41application · medium

   A forensic investigator is preparing to testify in court about the findings of a digital evidence examination. The defense attorney questions the investigator's methodology. Which factor is most important for the investigator to demonstrate to support the admissibility of the evidence?

   • AThe investigator had prior experience with similar cases.
   • BThe investigator used the latest version of forensic software.
   • CThe investigator followed a standard forensic process and maintained a clear chain of custody.
   • DThe investigator's report was written in technical language.
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A forensic examiner is analyzing a computer that was used to send threatening emails. The examiner finds that the emails were sent from a web-based email service. What is the MOST important evidence to collect?

   • AThe IP address of the suspect's computer
   • BThe suspect's social media accounts
   • CThe email content from the webmail provider
   • DThe browser history and cache
   Reveal Solution Discussion Select an answer first
3. 43expert · hard

   A forensic examiner is working on a case where the evidence was initially collected by a non-forensic IT staff member who did not use a write-blocker. The defense is challenging the evidence's admissibility. What is the MOST important factor in determining whether the evidence can still be used?

   • AWhether the evidence is relevant to the case
   • BWhether the evidence was collected during business hours
   • CWhether the examiner can prove the evidence was not altered
   • DWhether the IT staff member had proper training
   Reveal Solution Discussion Select an answer first