CCE Digital Evidence Collection & Preservation

Question 1

What is the primary purpose of creating a forensic image of a digital device?

Accepted Answer

To preserve evidence integrity

Answer

To upgrade the operating system

Answer

To ensure faster access to files

Answer

To format the device for reuse

Question 2

What is the correct order of volatility when collecting digital evidence?

Accepted Answer

RAM, Cache, Network logs, Disk

Answer

Cache, RAM, Disk, Network logs

Answer

RAM, Cache, Disk, Network logs

Answer

Disk, Cache, RAM, Network logs

Question 3

Which tool is commonly used to create a verified forensic image?

Accepted Answer

FTK Imager

Answer

Wireshark

Answer

VirtualBox

Answer

Disk Cleanup

Question 4

What does the hash value of a forensic image ensure?

Accepted Answer

The image is identical to the original

Answer

The image will open quickly

Answer

The data can be decrypted

Answer

The storage space is optimized

Question 5

Why is write-blocking important during digital evidence collection?

Accepted Answer

To prevent modification of evidence

Answer

To speed up file transfer

Answer

To compress the data

Answer

To detect hidden partitions

Question 6

What is the purpose of maintaining a chain of custody form?

Accepted Answer

To document handling of evidence

Answer

To encrypt the data for transfer

Answer

To track software updates

Answer

To list passwords and usernames