Computer Forensics Investigation Process ECSS Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A forensic examiner is collecting evidence from a crime scene. The examiner finds a smartphone that is turned on and unlocked. The examiner needs to preserve the evidence on the phone. Which action is MOST appropriate?

   • AStart browsing the phone to look for evidence
   • BTurn off the phone immediately to prevent remote access
   • CPlace the phone in a Faraday bag to isolate it from the network
   • DConnect the phone to a computer to extract data
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A company suspects an employee of leaking sensitive data. The IT manager wants to preserve evidence for a potential legal case. Which sequence of steps should be followed?

   • ACollect all data first, then decide what is relevant
   • BDocument the findings, then collect the evidence
   • CAnalyze the data, then preserve the evidence
   • DIdentify potential evidence, preserve it, collect it, analyze it, and document findings
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A forensic examiner is collecting evidence from a crime scene. The examiner seizes a smartphone, a laptop, and an external hard drive. To maintain a proper chain of custody, what should the examiner do?

   • APlace all items in one large evidence bag to keep them together
   • BTurn on each device to verify it works before bagging
   • CPlace each item in a separate evidence bag and label it with a unique identifier
   • DLeave the devices in place until the suspect is arrested
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   An investigator is analyzing a forensic image of a computer used to browse the internet. The investigator needs to determine which websites were visited. Which data source would be most useful?

   • ABrowser history files and cache
   • BThe recycle bin
   • CThe Windows registry
   • DThe pagefile.sys file
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   During a forensic examination, an analyst finds a suspicious file that appears to have been downloaded from the internet. The analyst needs to determine when the file was created, modified, and last accessed. Which type of metadata should the analyst examine?

   • AFile system timestamps (MAC times)
   • BWindows registry keys
   • CBrowser history files
   • DNetwork packet headers
   Reveal Solution Discussion Select an answer first