Digital Forensics Seizure and acquisition

What is the first step in a digital forensics investigation?

• Analyse the device
• Identify the user and owner
• Apply for a warrant
• Examine the contents

What must be obtained if permission to examine a digital device is not available?

• Court order
• Search warrant
• Police report
• Subpoena

Who supervises the execution of the warrant and security of the site?

• Security agent
• Digital Forensic Technician
• Lead investigator
• Law enforcement officer

Which principle states that no action should change data relied upon in court?

• Principle 1
• Principle 2
• Principle 3
• Principle 4

What is the role of a 'Write Blocker'?

• Delete original data
• Copy computer memory
• Secure the crime scene
• Block device from turning on

What must be done before any digital devices are touched?

• They must be switched off
• Record usernames and passwords
• Photograph the site and devices
• Remove all power sources

How should devices that can be remotely wiped be stored?

• In normal evidence bags
• In labelled boxes
• In Faraday bags
• In metal containers

What is 'Forensic Readiness'?

• Ability to analyse evidence
• Collection of evidence
• Preservation of evidence
• Built-in ability to collect, preserve, protect, and analyse digital evidence

Which of the following comes first in a Digital Forensic Examination?

• Reporting
• Acquisition
• Analysis
• Court appearance

What is a 'clone' or 'image' of data?

• Physical copy
• Exact digital copy
• Compressed file
• Encrypted file