CSI - Crime Scene Investigator Digital and Electronic Evidence Questions and Answers Flashcards
6 cards from real CSI practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 CSI - Crime Scene Investigator Digital and Electronic Evidence Questions and Answers flashcards as text
Which forensic tool is widely used for extracting and analyzing data from mobile devices?
Answer: Cellebrite UFED
Cellebrite UFED is an industry-standard forensic tool specifically designed for mobile device data extraction and analysis.
What does 'data carving' mean in digital forensics?
Answer: Recovering files from unallocated disk space based on file signatures without relying on file system metadata
Data carving recovers files by identifying known file headers and footers in raw disk data, even after deletion or formatting.
Which log is most useful for establishing a timeline of user activity on a Windows computer?
Answer: Windows Event Logs
Windows Event Logs record system events, user logins, application activities, and errors with precise timestamps.
What is the investigative significance of a file's 'last accessed' timestamp?
Answer: It records the most recent time the file was opened or read
The last accessed timestamp can place a suspect in contact with specific files at a specific date and time.
What is steganography, and why should a CSI be aware of it?
Answer: A technique for hiding data within ordinary-looking files such as images or audio
Steganography conceals criminal communications or data within innocent-looking media files that appear normal to casual inspection.
In digital forensics, what is 'live acquisition'?
Answer: Capturing volatile data from a running system before it is powered down
Live acquisition captures RAM contents, running processes, and network connections that would be permanently lost if the system were shut down.