Computer Forensics Investigation Process ECSS Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A forensic investigator is writing the final report for a case. The report includes the findings, the tools used, and the chain of custody. Which additional element is REQUIRED for the report to be considered complete and professional?

   • AA detailed methodology section explaining the steps taken during the investigation
   • BA list of all the suspect's personal contacts
   • CA recommendation for the suspect's sentence
   • DA conclusion that states the investigator's opinion on the suspect's guilt
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A forensic team is collecting evidence from a large enterprise network. The suspect's workstation is in a remote office, and the corporate policy requires that the workstation remain available for business operations. The investigation is time-sensitive. Which collection method best satisfies both the investigation and business needs?

   • AAsk the user to copy the relevant files to a shared drive
   • BWait until the workstation is no longer needed and then collect it
   • CPerform a remote forensic acquisition over the network using a write-blocker
   • DFly a forensic team to the remote office to seize the workstation
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is the primary purpose of creating a cryptographic hash (e.g., SHA-256) of digital evidence during the identification and preservation phase?

   • ATo index the evidence for faster searching during analysis
   • BTo encrypt the evidence so that only authorized investigators can view it
   • CTo verify the integrity of the evidence by detecting any changes to the original data
   • DTo compress the evidence so that it occupies less storage space
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A forensic examiner must present findings in a civil lawsuit. The opposing counsel challenges the admissibility of the evidence. What should the examiner have done to ensure the evidence is admissible?

   • AKept the original evidence in the examiner's personal safe
   • BUsed proprietary tools without documenting their settings
   • CMaintained a detailed chain of custody and used validated forensic tools
   • DRelied on the investigator's memory to explain the analysis
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A forensic team is collecting evidence from a corporate office. They have identified a USB drive on the suspect's desk. What is the correct procedure for handling this evidence?

   • APlug the USB drive into a forensic workstation to check its contents
   • BPlace the USB drive in an anti-static bag, seal it in an evidence bag, and document it
   • CLabel the USB drive and leave it on the desk for later collection
   • DCopy the files from the USB drive to a network share
   Reveal Solution Discussion Select an answer first