Computer Forensics Investigation Process ECSS Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   An investigator is called to a crime scene where a computer is running and the screen shows an open email account. The suspect is not present. Which action should the investigator take to preserve volatile evidence?

   • AClose the email application and shut down the computer normally
   • BCopy the email files from the temporary internet folder
   • CPhotograph the screen and then immediately pull the power cord
   • DUse a forensic tool to capture the contents of RAM
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   During a forensic investigation, the investigator finds a file that appears to be relevant. The file is on a network share that is still accessible. What should the investigator do to preserve this evidence?

   • ACopy the file to a forensic workstation and compute a hash
   • BOpen the file to verify its contents
   • CTake the network share offline and then image the relevant files
   • DDelete the file to prevent further access
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A company is investigating a data breach. The forensic team has already identified the affected systems and preserved the evidence. They are now in the process of extracting relevant information from the acquired images. Which phase of the computer forensics investigation process does this represent?

   • AEvidence collection and acquisition
   • BEvidence identification and preservation
   • CDocumentation and reporting
   • DEvidence analysis and examination
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A forensic examiner needs to acquire the contents of a suspect's laptop hard drive. The laptop is running and the user is logged in. The examiner wants to preserve the integrity of the evidence and maintain a proper chain of custody. Which step should the examiner perform FIRST?

   • ACollect volatile data such as RAM, network connections, and running processes
   • BRemove the hard drive and place it in an evidence bag
   • CPhotograph the scene and the laptop's screen
   • DCreate a forensic image of the hard drive using a write-blocker
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A forensic examiner has completed the analysis and must write the final report. The report will be read by both technical and non-technical audiences. What is the best approach?

   • AWrite a detailed technical report with all findings and a separate executive summary
   • BWrite only a high-level summary to avoid overwhelming readers
   • CInclude only the conclusions and recommendations
   • DWrite a technical report with no explanation of terms
   Reveal Solution Discussion Select an answer first