Digital Evidence: Acquisition & Preservation Quiz

What is the first step in the digital forensic investigation methodology?

• Document any change to evidence

• Prepare for a Chain of Custody

• Handle evidence with care

• Respect ethically confidential information

Which of the following is NOT a characteristic of digital evidence?

• Authentic

• Admissible

• Inaccessible

• Reliable

What does the term 'first responder' refer to?

• The last person to arrive at a crime scene

• A person who first arrives at a crime scene

• A digital forensics officer only

• A network administrator only

What type of acquisition involves copying data from a powered-off system?

• Dynamic acquisition

• Live acquisition

• Volatile acquisition

• Static acquisition

Which of the following is a rule of forensic investigation?

• Handle evidence without care

• Do not document any changes to evidence

• Minimize the option of examining the original evidence

• Always examine the original evidence first

What is the purpose of creating hash values for every softcopy?

• To prove integrity

• To enhance visibility

• To increase storage capacity

• To compress the data

What is volatile data?

• Data that is lost when power is off

• Data that is encrypted

• Data that is easily accessible

• Data that is permanently stored

Which method is preferred for acquiring data from a running computer?

• Remote acquisition

• Manual acquisition

• Live acquisition

• Static acquisition

What is the main disadvantage of raw format in digital evidence?

• It is too slow for data transfers

• It cannot be compressed

• It requires as much storage as the original disk

• It is not readable by most tools

What does the term 'chain of custody' refer to?

• The analysis of evidence

• The process of collecting evidence

• The storage of evidence

• The documentation of evidence handling