CSI CSI - Crime Scene Investigator Digital and Electronic Evidence Questions and Answers 2 — Questions and Answers
Question 1: When collecting a smartphone at a crime scene, what should an investigator do to prevent remote wiping?
- Plug it in to charge it
- Place it in airplane mode or a Faraday bag (Correct answer)
- Power it off immediately
- Connect it to a computer for extraction
Correct answer: Place it in airplane mode or a Faraday bag
Isolating the phone from networks prevents a suspect or third party from remotely wiping or altering the device's data.
Question 2: What is the primary purpose of a Faraday bag in digital evidence collection?
- To protect electronics from physical damage
- To block all wireless signals and prevent remote access (Correct answer)
- To keep electronics dry during transport
- To prevent static electricity damage
Correct answer: To block all wireless signals and prevent remote access
A Faraday bag blocks electromagnetic signals, preventing remote commands such as wipe orders from reaching the device.
Question 3: Which of the following is NOT a form of digital evidence?
- Browser history
- Text messages
- Fingerprint powder residue (Correct answer)
- Email communications
Correct answer: Fingerprint powder residue
Fingerprint powder residue is physical trace evidence, not digital evidence.
Question 4: What should be documented when seizing digital devices at a crime scene?
- Only the device serial number
- The device, its connections, surrounding environment, and current operational state (Correct answer)
- Only whether the device is powered on or off
- Only the brand and model of the device
Correct answer: The device, its connections, surrounding environment, and current operational state
Comprehensive documentation of all aspects of the device and its environment is essential to maintaining evidentiary value.
Question 5: In digital forensics, what does 'chain of custody' refer to?
- A series of passwords used to access devices
- The documented history of who collected, handled, and stored the evidence (Correct answer)
- The encryption sequence used to secure files
- A network of connected devices seized together
Correct answer: The documented history of who collected, handled, and stored the evidence
Chain of custody documents every person who handled the evidence to ensure its integrity and admissibility in court.
Question 6: What is 'slack space' in digital forensics?
- Unused space in a hard drive partition
- The area between the end of a file and the end of its allocated cluster that may retain old data (Correct answer)
- Empty folders remaining on a hard drive
- Free space on optical storage discs
Correct answer: The area between the end of a file and the end of its allocated cluster that may retain old data
Slack space can contain remnants of previously stored data that was not fully overwritten and may be forensically significant.
CSI CSI - Crime Scene Investigator Digital and Electronic Evidence Questions and Answers 2
When collecting a smartphone at a crime scene, what should an investigator do to prevent remote wiping?