Computer Forensics Investigation Process ECSS Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   What is the purpose of examining the Windows Registry during the analysis phase of a computer forensics investigation?

   • ATo reconstruct the partition table of the hard drive
   • BTo identify user activity, installed programs, and system configuration
   • CTo recover deleted emails from the mail server
   • DTo recover deleted files from unallocated space
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which method is considered the most forensically sound for acquiring digital evidence from a computer's hard drive?

   • ABooting the computer and using the operating system's backup utility
   • BCopying only the files that appear relevant to the investigation
   • CRemoving the hard drive and connecting it to another computer without a write-blocker
   • DCreating a bit-for-bit forensic image of the entire drive using a write-blocker
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   During the initial stages of a computer forensics investigation, which action is most appropriate to preserve the integrity of digital evidence on a powered-on computer?

   • ABrowse the file system to identify potential evidence before taking any action
   • BCreate a logical copy of the hard drive using the operating system's copy command
   • CCapture volatile data (e.g., RAM) before shutting down the system
   • DImmediately pull the power plug to prevent further changes to the system
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A system administrator discovers that a server was accessed by an unauthorized user. The administrator immediately logs into the server to check running processes and takes a screenshot of the active session. Later, the incident response team arrives and begins the forensic process. Which action by the administrator most likely compromised the forensic integrity of the evidence?

   • ATaking a screenshot of the active session
   • BLogging into the server and running commands before the forensic team arrived
   • CNoting the date and time of the discovery
   • DContacting the incident response team before doing anything
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A forensic analyst is examining a Linux system and needs to determine which users were logged in at a specific time. Which log file should the analyst examine?

   • A/var/log/dpkg.log
   • B/var/log/kern.log
   • C/var/log/syslog
   • D/var/log/auth.log
   Reveal Solution Discussion Select an answer first