DFE - Modules 1-2 - Exercises

According to the module, what is the primary goal of the forensic investigation process?

• To punish cybercriminals immediately

• To have a better understanding of an incident by identifying and analyzing evidence

• To develop new software tools for hacking

• To erase all digital data from devices

In the pre-investigation phase, what is one key activity mentioned?

• Analyzing evidentiary data

• Setting up a computer forensics lab

• Writing the final investigation report

• Testifying in court

What is a Computer Forensics Lab (CFL) described as in the module?

• A public library for reading about crimes

• A designated location for conducting computer-based investigations of collected evidence

• A room for storing personal computers

• An online forum for discussing cybercrimes

When planning and budgeting for a forensics lab, what factor should be considered first?

• The color of the walls

• Types of investigations (e.g., criminal, civil, corporate) based on crime statistics

• The number of coffee machines

• The brand of office chairs

In the physical security considerations for a forensics lab, what is recommended to prevent eavesdropping on electromagnetic signals?

• Using loud music

• Shielding emissions through a process called TEMPEST

• Opening all windows

• Painting the walls black

Who is responsible for photographing the crime scene and evidence in the investigation team?

• Incident Analyzer

• Photographer

• Attorney

• Evidence Manager

In the investigation phase, what is the purpose of data acquisition?

• To delete data from devices

• To extract Electronically Stored Information (ESI) from suspect devices using established methods

• To create new data files

• To share data on social media

What must investigators ensure about the storage device before acquiring data?

• It is full of unrelated files

• It is forensically clean and write protection is initiated

• It is connected to the internet

• It has no password

In data analysis, what is one task mentioned?

• Ignoring file dates

• Analyzing the date and time of file creation and modification

• Printing all files immediately

• Sharing files with the public

What is the main focus of the post-investigation phase?

• Setting up the lab

• Reporting and documenting all actions and findings

• Acquiring new hardware

• Deleting evidence