Practice Test Geeks(ACE) AccessData Certified Examiner Practice Test
← All ACE Flashcard Decks

Evidence Acquisition & Preservation Flashcards

7 cards from real ACE practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.

Read the first 7 Evidence Acquisition & Preservation flashcards as text

  1. When acquiring evidence from a live system, which method best preserves volatile memory that would be lost on shutdown?

    Answer: Perform a RAM dump before any disk imaging

    RAM dump captures volatile memory contents (running processes, encryption keys, network connections) that are destroyed when power is removed.

  2. Which hashing algorithm is currently recommended for verifying forensic image integrity due to its collision resistance?

    Answer: SHA-256

    SHA-256 provides stronger collision resistance than MD5 or SHA-1, both of which have known vulnerabilities that undermine forensic integrity.

  3. A suspect's laptop is found with BitLocker encryption enabled and running. What is the FIRST action an examiner should take?

    Answer: Acquire a RAM dump to capture the encryption key

    Capturing a RAM dump first recovers the BitLocker key from memory, enabling decryption; powering off would destroy the key.

  4. What is the purpose of using a Faraday bag during mobile device acquisition?

    Answer: Block wireless signals to prevent remote wipe commands

    A Faraday bag blocks cellular, Wi-Fi, and Bluetooth signals, preventing remote wipe or data modification commands from reaching the device.

  5. In FTK Imager, what format produces a single-file image with integrated hashing, compression, and case metadata?

    Answer: E01 (Expert Witness Format)

    E01 format embeds MD5/SHA-1 hashes, case metadata, and optional compression within a single segmented or monolithic file.

  6. Which action violates proper chain of custody during evidence handling?

    Answer: Allowing an untrained officer to handle the drive without documentation

    Allowing undocumented access by an untrained person creates a gap in chain of custody and may render the evidence inadmissible.

  7. What distinguishes a logical acquisition from a physical acquisition of a mobile device?

    Answer: Physical acquisition captures the complete bit-stream; logical captures only accessible files

    Physical acquisition captures the entire raw storage including deleted and unallocated space, while logical acquisition retrieves only the active file system.