CSI - Crime Scene Investigator Digital and Electronic Evidence Questions and Answers Flashcards
6 cards from real CSI practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 CSI - Crime Scene Investigator Digital and Electronic Evidence Questions and Answers flashcards as text
What is the first step when encountering a powered-on computer at a crime scene?
Answer: Document its current state before any action
Documenting the current state preserves volatile data and maintains the chain of custody before any action is taken.
Which type of data is considered 'volatile' in digital forensics?
Answer: Data stored in RAM
Volatile data such as RAM contents is permanently lost when a device loses power.
What does a 'write blocker' do in a digital forensic investigation?
Answer: Prevents modification of digital evidence during acquisition
A write blocker allows data to be read and copied while preventing any writes that would alter the original evidence.
What is a forensic image in a digital investigation?
Answer: An exact bit-for-bit copy of digital storage media
A forensic image is a sector-by-sector duplicate that preserves all data including deleted files and unallocated space.
Which hashing algorithm is commonly used to verify the integrity of digital evidence?
Answer: MD5 or SHA-256
MD5 and SHA-256 generate unique hash values that confirm a forensic copy is identical to the original.
What is metadata in the context of digital evidence?
Answer: Data about data, such as file creation dates and author information
Metadata provides details about a file's origin, creation, modification dates, and access history that may be forensically significant.