Font size
WorksheetsGathering Evidence
Total questions: 8
Worksheet time: 6mins
What are some reasons for not pulling the plug on a computer that may contain evidence(check all that apply)
Any evidence on RAM is under threat of destruction
Interacting with a running computer in any way causes changes to the system
Sudden loss of power could damage the data
System may be unencrypted when powered on but return to an encrypted stage when powered off
What are some reasons to pull the plug on a computer that may contain evidence(check all that apply)
Any evidence on RAM is under threat of destruction
Interacting with a running computer in any way causes changes to the system
Sudden loss of power could damage the data
Change to a system may invalidate evidence
Which type of evidence is the least volatile
Data on hard disk
Routing table
CPU
Temporary file system/swap space
Which are the ideal ways to isolate a cell phone that may contain evidence(check all that apply)
Access data via find my phone
Turn it off
Put it in a Faraday bag
Put it in an empty paint can
What is a clone?
Member of the republic's army
bit-for-bit copy of a hard drive
A program for file carving
Copy-and-pasted copy of a hard drive
Why is it important to clone hard drives that may contain evidence?(check all that apply)
Clone gets data in unallocated space such as deleted or partially overwritten files
Clone also gets file system data
Clones allow for a "do over" if investigation alters the system
Clones only get active data
In what circumstances might an investigator have to clone a drive on site?(check all that apply)
If they do not have the proper warrants to take the drive to a lab
If the device is a personal computer
If the device is a server generating revenue for a business
If the investigation is a missing persons case
Why are hash values valuable to forensic investigators?(check all that apply)
They can be used to verify that a system is identical to the original
Any change to a system will change the hash value
They are used to create and edit files
They are used to help clone a device
