CPI Technology & Digital Tools 2 — Questions and Answers
Question 1: Which type of metadata embedded in digital photos can reveal the exact GPS coordinates where the image was taken?
- IPTC data
- EXIF data (Correct answer)
- XMP sidecar
- ID3 tags
Correct answer: EXIF data
EXIF (Exchangeable Image File Format) data stores camera settings, timestamps, and GPS coordinates within digital image files.
Question 2: An investigator needs to capture a suspect's online activity without alerting the subject. Which tool is MOST appropriate for passive network traffic analysis?
- Nmap port scanner
- Wireshark packet analyzer (Correct answer)
- Metasploit framework
- Aircrack-ng
Correct answer: Wireshark packet analyzer
Wireshark is a passive packet-capture tool that monitors network traffic without sending probes, making it suitable for covert analysis.
Question 3: When performing open-source intelligence (OSINT) on a subject, which technique allows an investigator to find cached or deleted web pages?
- Using the Wayback Machine / archive.org (Correct answer)
- Running a WHOIS lookup
- Conducting a reverse DNS query
- Performing a traceroute
Correct answer: Using the Wayback Machine / archive.org
The Wayback Machine archives historical snapshots of websites, allowing investigators to view pages that have been modified or deleted.
Question 4: A cell phone's IMEI number is MOST useful in an investigation for:
- Decrypting stored messages
- Uniquely identifying the physical device regardless of SIM card (Correct answer)
- Determining the device's current GPS location
- Recovering deleted call logs
Correct answer: Uniquely identifying the physical device regardless of SIM card
The IMEI (International Mobile Equipment Identity) is a hardware identifier tied to the device itself, not the subscriber or SIM.
Question 5: Which court doctrine governs whether evidence obtained from a suspect's computer without a warrant is admissible?
- Plain view doctrine
- Fourth Amendment exclusionary rule (Correct answer)
- Best evidence rule
- Chain of custody doctrine
Correct answer: Fourth Amendment exclusionary rule
The Fourth Amendment's exclusionary rule bars admission of evidence obtained through unreasonable, warrantless searches of private digital devices.
Question 6: In digital forensics, a 'write blocker' is used to:
- Encrypt sensitive evidence before transport
- Prevent any data from being written to the evidence drive during imaging (Correct answer)
- Block unauthorized remote access to the forensic workstation
- Redact personally identifiable information from reports
Correct answer: Prevent any data from being written to the evidence drive during imaging
A write blocker is a hardware or software tool that allows read-only access to storage media, preserving its integrity during forensic imaging.
Question 7: Which social media investigation technique involves creating a fictitious online profile to observe a subject's activity without their knowledge?
- Sock puppet account (Correct answer)
- Honeypot deployment
- Man-in-the-middle attack
- Phishing campaign
Correct answer: Sock puppet account
A sock puppet is a fake identity used by investigators to passively monitor a subject's public or semi-public social media posts.
CPI Technology & Digital Tools 2
Which type of metadata embedded in digital photos can reveal the exact GPS coordinates where the image was taken?