ISA Digital Forensics & Investigation

Question 1

Which principle ensures that digital evidence is not altered during collection and analysis?

Accepted Answer

Write blocking

Answer

Chain of custody

Answer

Order of volatility

Answer

Evidence integrity

Question 2

In digital forensics, 'order of volatility' refers to:

Accepted Answer

The priority order for collecting evidence based on how quickly it may be lost

Answer

The sequence in which malware spreads through a network

Answer

The ranking of data by its sensitivity classification

Answer

The order in which logs are deleted by attackers

Question 3

What is the primary purpose of a forensic disk image?

Accepted Answer

To create an exact bit-for-bit copy of the original storage media

Answer

To compress evidence files for storage

Answer

To encrypt the evidence for secure transport

Answer

To index all files on the drive for faster searching

Question 4

Which hashing algorithm is most commonly used to verify forensic evidence integrity?

Accepted Answer

SHA-256 or SHA-512

Answer

MD5 or SHA-1

Answer

CRC32

Answer

HMAC-MD5

Question 5

What does 'chain of custody' document in a digital forensic investigation?

Accepted Answer

The chronological history of evidence handling from collection to court

Answer

The sequence of commands executed by an attacker

Answer

The list of tools used during forensic analysis

Answer

The network path data traveled during the incident

Question 6

During a live forensic investigation, which data source should be acquired FIRST according to the order of volatility?

Accepted Answer

System RAM and running processes

Answer

Hard disk drive contents

Answer

Network configuration files

Answer

Log files stored on disk

Question 7

What is the role of a forensic examiner when acquiring evidence from a suspect's smartphone?

Accepted Answer

Place the device in airplane mode or a Faraday bag to prevent remote wipes

Answer

Boot the device into recovery mode to access all data

Answer

Connect the device to the internet to retrieve cloud backups

Answer

Perform a factory reset to reveal hidden partitions