Foundational Concepts & Principles Flashcards

In digital forensics, what does the term 'chain of custody' primarily ensure?

Answer: A documented trail of who handled evidence and when

Chain of custody documents every person who handled the evidence and when, ensuring its integrity and admissibility in court.

What is the primary purpose of write-blocking hardware in digital forensics?

Answer: To prevent any data from being written to the original evidence drive

Write blockers prevent any modifications to the original evidence drive during the imaging or examination process.

Which file system metadata attribute records the last time a file's content was modified on NTFS?

Answer: Last Written time ($STANDARD_INFORMATION)

The Last Written timestamp in $STANDARD_INFORMATION records when the file's data content was last changed.

What forensic principle states that 'every contact leaves a trace'?

Answer: Locard's Exchange Principle

Locard's Exchange Principle, developed by Edmond Locard, states that any contact between two objects results in an exchange of material.

In FTK, what is a 'case' most accurately described as?

Answer: A container that organizes evidence, bookmarks, and analysis data for an investigation

In FTK, a case is the organizational unit that holds all evidence items, bookmarks, labels, and analysis results for a specific investigation.

What does 'slack space' refer to in digital forensics?

Answer: The unused space between the end of a file and the end of its last cluster

Slack space is the unused area from the logical end of a file to the end of the last cluster allocated to it, which may contain remnant data.

Which of the following best describes 'volatile data' in a forensic investigation?

Answer: Data that is lost when power is removed from a system

Volatile data, such as RAM contents, running processes, and network connections, is lost when the system loses power.