CSI CSI - Crime Scene Investigator Digital and Electronic Evidence Questions and Answers 1 — Questions and Answers
Question 1: What is the first step when encountering a powered-on computer at a crime scene?
- Unplug it immediately
- Document its current state before any action (Correct answer)
- Shut it down using the operating system
- Remove the hard drive
Correct answer: Document its current state before any action
Documenting the current state preserves volatile data and maintains the chain of custody before any action is taken.
Question 2: Which type of data is considered 'volatile' in digital forensics?
- Hard drive data
- Data stored in RAM (Correct answer)
- Files on a USB drive
- Data on optical discs
Correct answer: Data stored in RAM
Volatile data such as RAM contents is permanently lost when a device loses power.
Question 3: What does a 'write blocker' do in a digital forensic investigation?
- Prevents writing to reports
- Prevents modification of digital evidence during acquisition (Correct answer)
- Blocks network access on a device
- Erases digital media securely
Correct answer: Prevents modification of digital evidence during acquisition
A write blocker allows data to be read and copied while preventing any writes that would alter the original evidence.
Question 4: What is a forensic image in a digital investigation?
- A photograph of the crime scene
- An exact bit-for-bit copy of digital storage media (Correct answer)
- A compressed backup of visible files
- A screenshot of a suspect's screen
Correct answer: An exact bit-for-bit copy of digital storage media
A forensic image is a sector-by-sector duplicate that preserves all data including deleted files and unallocated space.
Question 5: Which hashing algorithm is commonly used to verify the integrity of digital evidence?
- ZIP
- AES
- MD5 or SHA-256 (Correct answer)
- SSL
Correct answer: MD5 or SHA-256
MD5 and SHA-256 generate unique hash values that confirm a forensic copy is identical to the original.
Question 6: What is metadata in the context of digital evidence?
- The content of a file
- Data about data, such as file creation dates and author information (Correct answer)
- Deleted file fragments in unallocated space
- Encrypted file content
Correct answer: Data about data, such as file creation dates and author information
Metadata provides details about a file's origin, creation, modification dates, and access history that may be forensically significant.
CSI CSI - Crime Scene Investigator Digital and Electronic Evidence Questions and Answers 1
What is the first step when encountering a powered-on computer at a crime scene?