Cap 3 English

Digital evidence is _______________.

• Volatile

• Non-volatile

• Good to have

• Not needed when you have a confession

Why would it be a good idea to wipe a drive before reusing it to store evidence?

• Chain of custody

• To make sure it is formatted correctly

• To ensure no prior data exists on the device

• It's the examiner's choice (the examiner can decide the course of action)

You must use a write blocker on the source device when creating a forensic image.

• True

• False

Who controls the Forensically Sound Examination Environment?

• Suspect

• First responder

• Examiner

• Depends on the situation

The examiner must validate all tools before use.

• True

• False

When creating a forensic image, which is the best option?

• Forensic copy

• Forensic image

• Logical forensic image

• Backup copy

A dd image can be compressed.

• True

• False

What is the primary purpose of using a write blocker in digital forensics?

• To speed up the imaging process

• To prevent data alteration on the source device

• To enhance the quality of the forensic image

• To allow multiple users to access the device simultaneously

Which of the following is a characteristic of volatile digital evidence?

• It remains unchanged when the device is powered off

• It is stored on a hard drive

• It is lost when the device is powered off

• It is always encrypted

In digital forensics, what is the significance of maintaining a chain of custody?

• To ensure the evidence is admissible in court

• To increase the speed of the investigation

• To reduce the cost of the investigation

• To allow public access to the evidence