Evidence Collection and Mounting GLIR Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   You are collecting evidence from a compromised Linux server. You have already captured memory and network connections. Which of the following should you collect next according to the order of volatility?

   • ARunning processes
   • BSystem logs
   • CUser data files
   • DFilesystem contents
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   You are documenting the evidence collection process. Which of the following should be recorded to ensure the chain of custody is complete?

   • AThe color of the evidence bag and the label style.
   • BThe brand of the forensic workstation and the type of cables used.
   • CThe date and time of collection, the collector's name, and a description of the evidence.
   • DThe weather conditions at the time of collection.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   You are documenting the mounting of a forensic image for a court case. You have recorded the exact command, the options used, and the timestamp. Which additional piece of information is most important to include for chain of custody?

   • AThe hash value of the image before and after mounting
   • BThe serial number of the computer used for analysis
   • CThe version of the Linux kernel used
   • DThe name of the analyst who performed the mounting
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   You are documenting the mounting of a forensic image. You have recorded the command, options, and timestamp. What else should you record to ensure the process is reproducible by another analyst?

   • AThe color of the server case
   • BThe kernel version and the version of the mount command
   • CThe IP address of the analysis workstation
   • DThe name of the file manager used to browse the mounted filesystem
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   You are documenting the evidence collection process for a legal case. The defense attorney questions the integrity of the evidence. Which documentation would best support the chain of custody?

   • AA detailed log of every command executed, with timestamps and the analyst's initials.
   • BA verbal explanation of the process to the attorney.
   • CA list of the tools used, without the specific commands.
   • DA summary report of the findings, without technical details.
   Reveal Solution Discussion Select an answer first