Digital Forensics Concepts and Application GCED Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   What is the primary purpose of maintaining a chain of custody for digital evidence?

   • ATo document every person who handled the evidence and when, ensuring its integrity and admissibility.
   • BTo allow multiple investigators to work on the same evidence simultaneously.
   • CTo encrypt all evidence to prevent unauthorized access.
   • DTo ensure that evidence is stored in a secure location.
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   During an incident, a forensic analyst must acquire memory from a compromised server. The server is running a critical application that cannot be stopped. The analyst has a memory acquisition tool that may crash the system if the tool is incompatible. Which approach BEST balances the need for evidence with the need to keep the system running?

   • AUse a trusted memory acquisition tool that is known to be stable on the server's OS version, and capture memory to a network share.
   • BRun multiple memory acquisition tools simultaneously to ensure at least one succeeds.
   • CPower off the server immediately and remove the memory modules for later analysis.
   • DSkip memory acquisition and rely on disk forensics to avoid any risk to the system.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   An analyst is examining a forensic image of a suspect's hard drive. The analyst finds a file that appears to contain incriminating data, but the file's extension has been changed to .txt. Which forensic artifact would MOST likely reveal the file's true nature?

   • AThe file's creation timestamp.
   • BThe file's access control list (ACL).
   • CThe file's magic number or file signature.
   • DThe file's location in the directory tree.
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   Which of the following is a common forensic artifact that can be found in a file system?

   • AThe system's power supply voltage.
   • BThe physical location of the computer.
   • CThe current IP address of the system.
   • DDeleted files that remain in unallocated space.
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A forensic examiner is investigating a suspect's computer and finds that the hard drive is encrypted with BitLocker. The suspect is refusing to provide the password. The examiner has a memory dump taken from the system while it was running. Which technique could potentially recover the encryption key?

   • ATry to reset the BitLocker password using a recovery tool.
   • BUse a brute-force attack on the BitLocker password.
   • CExamine the hard drive's unallocated space for the key.
   • DAnalyze the memory dump for the BitLocker key, which may be present in RAM.
   Reveal Solution Discussion Select an answer first