Computer Forensics Investigation Process ECSS Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   An investigator discovers that the suspect's computer is encrypted with BitLocker. The computer is currently powered on and the user is logged in. The investigator must preserve the ability to decrypt the drive later. Which action is most appropriate?

   • ACapture the memory, including the decryption keys, before powering off
   • BCopy the encrypted files to an external drive
   • CDisable BitLocker through the control panel
   • DImmediately power off the computer to prevent data changes
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   An analyst is examining a forensic image and finds a suspicious file. The file's extension is .jpg, but the file header indicates it is a ZIP archive. The analyst needs to determine the true nature of the file. Which technique is most appropriate?

   • ARename the file to .zip and open it
   • BPerform file signature analysis to identify the actual file type
   • CCheck the file size to guess the type
   • DLook at the file's icon in the operating system
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A forensic investigator has completed the analysis of a compromised workstation and is preparing the final report. The report will be submitted to the company's legal counsel. Which element is MOST important to include in the report to ensure it is defensible in court?

   • AThe suspect's social media posts
   • BA chronological account of the investigation, including actions taken and the chain of custody
   • CA detailed description of the tools used and their versions
   • DA summary of the investigator's personal opinions about the suspect
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A forensic analyst is examining an image of a suspect's hard drive. The analyst needs to find evidence that a specific file was accessed on a particular date. Which type of analysis would be most appropriate?

   • AReviewing the file system metadata, such as MAC times
   • BCarving deleted files from unallocated space
   • CAnalyzing network logs from the corporate firewall
   • DPerforming a keyword search across all files
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A forensic examiner is acquiring a hard drive from a suspect's computer. The examiner does not have a hardware write-blocker available. The examiner must acquire the drive without altering the original evidence. Which method is the BEST alternative?

   • AUse a network acquisition tool to copy the drive over the network
   • BBoot the suspect's computer from a forensic live CD and use software to create an image
   • CConnect the drive to a forensic workstation as a secondary drive and image it
   • DCopy the files from the drive using the operating system's copy command
   Reveal Solution Discussion Select an answer first