Computer Forensics Investigation Process ECSS Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A forensic investigator has completed the analysis of a compromised server and must present findings to the company's legal team. What is the most important requirement for the final report?

   • AClearly document the chain of custody and the methods used
   • BSummarize only the conclusions without supporting data
   • CProvide recommendations for fixing the security vulnerability
   • DInclude detailed technical explanations of every tool used
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A forensic analyst is examining a Windows system and finds a suspicious executable. The analyst needs to determine if the executable was run on the system. Which artifact would provide the STRONGEST evidence of execution?

   • AWindows event logs
   • BThe file's creation timestamp
   • CPrefetch files
   • DBrowser history
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A forensic investigator arrives at a small office where a suspected data theft occurred. The suspect's desktop is powered on and logged in. The investigator must preserve volatile data before shutting down the system. Which action should the investigator take first?

   • ACopy the hard drive using a write-blocker
   • BCapture the contents of RAM using a trusted forensic tool
   • CPull the power cord immediately to freeze the system state
   • DTake photographs of the screen and then shut down normally
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   During a forensic analysis, an examiner is looking for evidence of a user's web browsing activity. The examiner wants to find URLs visited, search terms, and downloaded files. Which artifact should the examiner examine FIRST?

   • ABrowser history and cache files
   • BWindows event logs
   • CPrefetch files
   • DMaster File Table (MFT)
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A forensic team is investigating a case where a suspect's computer was found running. The team must decide whether to perform a live acquisition or a dead acquisition. The suspect is a high-ranking executive, and the legal team wants to minimize disruption to the company's operations. However, the investigation is time-sensitive, and the computer may contain volatile evidence. Which approach BEST balances the need to preserve evidence with the operational constraints?

   • APerform a live acquisition to capture volatile data, then shut down and create a forensic image
   • BPerform a dead acquisition immediately by pulling the power cord
   • CSkip the live acquisition and only create a forensic image of the hard drive
   • DAsk the executive to close all applications and then shut down the computer
   Reveal Solution Discussion Select an answer first