Practice Test Geeks(CFE) Certified Forensic Examiner Practice Test
← All CFE Flashcard Decks

Digital Evidence Collection and Preservation Flashcards

7 cards from real CFE practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.

Read the first 7 Digital Evidence Collection and Preservation flashcards as text

  1. When performing a live acquisition of a running system, which type of memory should be captured FIRST to preserve the most volatile data?

    Answer: CPU registers and cache

    CPU registers and cache are the most volatile data and will be lost immediately upon system shutdown, so they must be captured first.

  2. A forensic examiner uses write blockers during evidence collection primarily to:

    Answer: Prevent any data from being written to the source drive

    Write blockers prevent any writes to the source drive, ensuring the original evidence is not modified during the acquisition process.

  3. Which file system artifact records the last time a file was accessed on a Windows NTFS volume?

    Answer: $MFT $STANDARD_INFORMATION timestamps

    The $STANDARD_INFORMATION attribute in the NTFS Master File Table (MFT) stores MAC timestamps including last access time.

  4. During a mobile device acquisition, what is the significance of placing the device in airplane mode?

    Answer: It prevents remote wipe commands from reaching the device

    Airplane mode cuts all wireless connections, preventing remote wipe commands or data changes from reaching the device over cellular or Wi-Fi.

  5. A Faraday bag is used in digital forensics to:

    Answer: Block electromagnetic signals to and from a device

    A Faraday bag blocks all electromagnetic signals, isolating the device from cellular, Wi-Fi, and Bluetooth communications.

  6. What is 'slack space' in the context of digital forensics?

    Answer: The unused space between the end of a file and the end of its allocated cluster

    Slack space is the unused area between the logical end of a file and the physical end of the last cluster allocated to that file, which may contain remnants of old data.

  7. Which hashing algorithm is most commonly used in US federal law enforcement to verify digital evidence integrity due to its collision resistance?

    Answer: SHA-256

    SHA-256 is preferred in modern forensic practice due to its strong collision resistance, as MD5 and SHA-1 have known cryptographic weaknesses.