Gathering Evidence

What are some reasons for not pulling the plug on a computer that may contain evidence(check all that apply)

• Any evidence on RAM is under threat of destruction

• Interacting with a running computer in any way causes changes to the system

• Sudden loss of power could damage the data

• System may be unencrypted when powered on but return to an encrypted stage when powered off

What are some reasons to pull the plug on a computer that may contain evidence(check all that apply)

• Any evidence on RAM is under threat of destruction

• Interacting with a running computer in any way causes changes to the system

• Sudden loss of power could damage the data

• Change to a system may invalidate evidence

Which type of evidence is the least volatile

• Data on hard disk

• Routing table

• CPU

• Temporary file system/swap space

Which are the ideal ways to isolate a cell phone that may contain evidence(check all that apply)

• Access data via find my phone

• Turn it off

• Put it in a Faraday bag

• Put it in an empty paint can

What is a clone?

• Member of the republic's army

• bit-for-bit copy of a hard drive

• A program for file carving

• Copy-and-pasted copy of a hard drive

Why is it important to clone hard drives that may contain evidence?(check all that apply)

• Clone gets data in unallocated space such as deleted or partially overwritten files

• Clone also gets file system data

• Clones allow for a "do over" if investigation alters the system

• Clones only get active data

In what circumstances might an investigator have to clone a drive on site?(check all that apply)

• If they do not have the proper warrants to take the drive to a lab

• If the device is a personal computer

• If the device is a server generating revenue for a business

• If the investigation is a missing persons case

Why are hash values valuable to forensic investigators?(check all that apply)

• They can be used to verify that a system is identical to the original

• Any change to a system will change the hash value

• They are used to create and edit files

• They are used to help clone a device