I85PREP
⌘ K
CF-L3 / CCFT study materials
CF-L3 / CCFT study resources

CF-L3 / CCFT practice questions

One question at a time. Build your CF-L3 / CCFT understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Forensic Fundamentals, Legal and Ethical Considerations

Which principle holds that when two objects come into contact, material is transferred between them?

  1. Every trace must be hashed
  2. Every contact leaves a trace Correct answer.
  3. Every witness must be subpoenaed
  4. Every device must be imaged twice

Explanation

Locard's exchange principle states that when two objects come into contact, material is transferred between them, which is why trace evidence is sought at scenes. It is a foundational transfer principle and has nothing to do with hashing, testimony, or acquisition procedures.

Question 2Forensic Fundamentals, Legal and Ethical Considerations

What is the primary purpose of a chain-of-custody record for digital evidence?

  1. To document every transfer and handling of the evidence Correct answer.
  2. To record the licensing terms of forensic tools
  3. To document the examiner's hourly billing
  4. To replace the need for hashing the image

Explanation

A chain of custody is the documented, unbroken record of who handled the evidence, when, and for what purpose, from seizure through presentation in court. It supports the argument that the item is what it purports to be and has not been tampered with.

Question 3Forensic Fundamentals, Legal and Ethical Considerations

When collecting evidence from a running system, which item should generally be collected first?

  1. CPU registers and cache memory Correct answer.
  2. The hard disk drive
  3. Optical media in the drive
  4. Backup tapes stored in a safe

Explanation

The order of volatility begins with CPU registers and cache, then memory and network state, then disk storage, and finally archival or backup media. Collecting the most perishable data first preserves evidence that would otherwise be lost.

Question 4Forensic Fundamentals, Legal and Ethical Considerations

In digital forensics, a cryptographic hash of an acquired image is primarily used to:

  1. Restore deleted files from the image
  2. Demonstrate that the image has not changed Correct answer.
  3. Encrypt the contents of the image
  4. Compress the image for storage

Explanation

A cryptographic hash acts as a digital fingerprint: recomputing it later and obtaining the same value shows the data has not changed. Hashing provides integrity assurance and does not encrypt, compress, or recover anything.

Question 5Forensic Fundamentals, Legal and Ethical Considerations

Why is a hardware write blocker used during acquisition of a suspect drive?

  1. It prevents any write operation from reaching the source device Correct answer.
  2. It increases the transfer speed of the imaging process
  3. It encrypts the resulting image automatically
  4. It repairs defective sectors on the source drive

Explanation

A write blocker intercepts commands from the forensic workstation so that no write instruction reaches the source device, preserving the original in an unaltered state. It does not affect speed, encrypt output, or repair the drive.

Question 6Forensic Fundamentals, Legal and Ethical Considerations

Which statement reflects the first ACPO principle for digital evidence?

  1. Every case must be independently reviewed by at least two qualified examiners
  2. No action should change data that may later be relied upon in court Correct answer.
  3. All images must be kept in encrypted containers
  4. Only sworn police officers may handle digital evidence at a scene

Explanation

The first ACPO principle states that no action taken by law enforcement or their agents should change data which may subsequently be relied upon in court. The remaining principles address competence to access original data, audit trails and reproducibility, and the case officer's overall responsibility.

Question 7Forensic Fundamentals, Legal and Ethical Considerations

An expert witness retained by the prosecution in a criminal case owes a primary duty to:

  1. The investigating law enforcement agency
  2. The party that retained and paid the expert
  3. The prosecution team
  4. The court Correct answer.

Explanation

An expert witness owes a duty of independence to the court, and that duty overrides any obligation to the party who retained or paid the expert. Testimony must be objective regardless of which side commissioned it.

Question 8Forensic Fundamentals, Legal and Ethical Considerations

A forensic image of a hard drive is best described as:

  1. A sector-by-sector copy including unallocated space Correct answer.
  2. A compressed backup of the user's documents
  3. A list of file names, sizes, and timestamps
  4. A screenshot record of the desktop session

Explanation

A forensic image is a bit-for-bit duplicate of the entire storage medium, capturing allocated files, unallocated space, slack space and metadata. A file listing, backup, or screenshot does not preserve the full contents of the medium.

Question 9Forensic Fundamentals, Legal and Ethical Considerations

Under the Frye standard, expert testimony based on a scientific technique is admissible when the technique is:

  1. Documented in at least one peer-reviewed article
  2. Certified by the tool's commercial vendor
  3. Approved by the investigating agency's laboratory
  4. Generally accepted in the relevant scientific community Correct answer.

Explanation

Frye asks whether the scientific principle or technique is generally accepted in the relevant scientific community. It is a general-acceptance test rather than the multi-factor reliability inquiry used under Daubert.

Question 10Forensic Fundamentals, Legal and Ethical Considerations

During an investigation, an occupant voluntarily signs a consent form permitting a search of a shared home computer. What is the key requirement for this consent search to be valid?

  1. The consent must be renewed every 24 hours
  2. The consent must be recorded on video
  3. The consent must be voluntary and given by someone with authority over the device Correct answer.
  4. The consent must be approved by a judge in advance

Explanation

A consent search is valid only where consent is given voluntarily by a person with actual or apparent authority over the place or item to be searched, and the search must stay within the scope of that consent. Judicial pre-approval and recording are not legal prerequisites.

Question 11Forensic Fundamentals, Legal and Ethical Considerations

A company's automated server logs are offered as evidence at trial. Which rationale most commonly supports their admission?

  1. They are sworn statements by the server's owner
  2. They are records made in the regular course of business Correct answer.
  3. They are the personal opinions of the system administrator
  4. They are protected by attorney-client privilege

Explanation

Automated logs and similar records are typically admitted under the business records exception to the hearsay rule because they are generated in the regular course of a regularly conducted activity. They are not privileged communications and are not the personal opinions of an administrator.

Question 12Forensic Fundamentals, Legal and Ethical Considerations

After receiving a litigation hold notice, a company's IT staff delete several mailboxes to free storage. In e-discovery terms this conduct is called:

  1. Spoliation Correct answer.
  2. Normal retention
  3. Carving
  4. Data remanence

Explanation

Spoliation is the loss, destruction, or material alteration of evidence at a time when the party knew or reasonably should have known the evidence was relevant to litigation. A routine retention policy cannot justify deleting data after a hold notice has been received.

Question 13Forensic Fundamentals, Legal and Ethical Considerations

NIST SP 800-86 organizes the forensic process into which four phases?

  1. Seizure, imaging, hashing, archiving
  2. Acquisition, decryption, recovery, disclosure
  3. Collection, examination, analysis, reporting Correct answer.
  4. Identification, preservation, litigation, appeal

Explanation

NIST SP 800-86 describes the forensic process as collection, examination, analysis, and reporting. Each phase builds on a documented, repeatable record of what was done with the evidence.

Question 14Forensic Fundamentals, Legal and Ethical Considerations

An examiner in one country needs data held in another country's data centre. The most appropriate legal mechanism is typically:

  1. An informal request to the provider's support desk
  2. A mutual legal assistance treaty request Correct answer.
  3. A subpoena issued by the requesting country's police
  4. A warrant served on the local internet service provider

Explanation

Where data is held in another country, the usual lawful route is a mutual legal assistance request channelled through the central authorities of the two states. Domestic subpoenas and informal provider requests generally cannot compel production of data located abroad.

Question 15Forensic Fundamentals, Legal and Ethical Considerations

Why should an examiner document the tools and versions used during analysis?

  1. To avoid maintaining a chain of custody
  2. To show the results are reliable and reproducible Correct answer.
  3. To shorten the final report
  4. To reduce the size of the acquired image

Explanation

Documenting tools, versions, and settings allows another examiner to reproduce the work and demonstrates that the results are reliable. Reproducibility is central to the audit-trail expectations of forensic practice.

Question 16Forensic Fundamentals, Legal and Ethical Considerations

During imaging of a corporate laptop, the examiner encounters documents marked as attorney-client privileged communications. The appropriate action is to:

  1. Immediately submit them to the case file
  2. Delete the files to protect the client's privacy
  3. Segregate them and follow the agreed privilege protocol Correct answer.
  4. Stop the imaging and withdraw from the engagement

Explanation

Privileged material is typically segregated, hashed, and logged, then handled under the privilege protocol agreed with counsel, such as filter or taint-team review. The examiner must neither destroy evidence nor unilaterally disclose privileged content.

Question 17Forensic Fundamentals, Legal and Ethical Considerations

An evidence drive is shipped to a laboratory, and the image is re-hashed on arrival. The new hash differs from the acquisition hash. What is the most appropriate conclusion?

  1. The hashing algorithm was applied incorrectly the first time
  2. The evidence is admissible without further review
  3. The original hash value should be deleted
  4. The image may have been altered, and the integrity issue must be investigated Correct answer.

Explanation

A verified image should reproduce the acquisition hash on every subsequent check; a mismatch means the data changed after acquisition, so the integrity of the copy must be investigated before it is relied upon. The discrepancy cannot be explained away by assuming operator error.

Question 18Forensic Fundamentals, Legal and Ethical Considerations

Exigent circumstances justify a warrantless seizure of digital evidence when:

  1. The suspect refuses to answer questions
  2. The evidence is stored in a cloud account
  3. The case involves a minor offence
  4. There is an immediate risk that the evidence will be destroyed Correct answer.

Explanation

Exigent circumstances permit warrantless action where there is an immediate risk that evidence will be destroyed, a threat to life, or a risk of flight. Inconvenience, a suspect's silence, or the classification of the offence does not create exigency.

Question 19Forensic Fundamentals, Legal and Ethical Considerations

An examiner is asked by the retaining attorney to omit a finding that undermines the case. According to professional ethics, the examiner should:

  1. Omit it but mention it verbally at trial
  2. Report all findings completely and objectively Correct answer.
  3. Comply, since the attorney is the client
  4. Withdraw and destroy the working notes

Explanation

Forensic practitioners are expected to be objective and to report findings that both support and undermine the case. Selectively omitting adverse findings breaches impartiality and can amount to misleading the court.

Question 20Forensic Fundamentals, Legal and Ethical Considerations

A system administrator, acting on his own initiative and not at police direction, discovers illegal content on an employee's workstation and reports it. Under the private search doctrine the evidence is generally:

  1. Inadmissible because no warrant was obtained
  2. Admissible because the Fourth Amendment does not apply to private-party searches Correct answer.
  3. Inadmissible because the administrator lacked forensic training
  4. Admissible only if the administrator is a licensed investigator

Explanation

Constitutional search restrictions and the exclusionary rule generally do not apply to searches conducted by private parties acting on their own initiative, so evidence they discover is ordinarily admissible. The position can change if the private party acts as an agent of the state.

Question 21Forensic Fundamentals, Legal and Ethical Considerations

An examiner testifies using a proprietary tool that has never been independently validated and for which no error-rate data exist. Under Daubert, opposing counsel is most likely to challenge the testimony on the ground that:

  1. The examiner's fee arrangement is inappropriate
  2. The number of exhibits produced is excessive
  3. The case was filed in an inconvenient jurisdiction
  4. The technique's testability and known or potential error rate are not established Correct answer.

Explanation

Daubert directs the court to consider whether a technique can be and has been tested, its known or potential error rate, peer review and publication, and general acceptance. A tool with no validation or error-rate data is vulnerable on exactly those grounds.

Question 22Forensic Fundamentals, Legal and Ethical Considerations

A defence expert cannot reproduce the prosecution examiner's findings because tool settings and command output were never recorded. Which ACPO principle has most likely been breached?

  1. The principle that no action should change data relied upon in court
  2. The principle that the case officer holds overall responsibility
  3. The principle that original data must never be accessed
  4. The principle requiring an audit trail that lets an independent third party reproduce the result Correct answer.

Explanation

The third ACPO principle requires an audit trail or other record of all processes applied to digital evidence, so that an independent third party can examine those processes and achieve the same result. Undocumented settings and outputs make reproduction impossible.

Question 23Forensic Fundamentals, Legal and Ethical Considerations

While working for the prosecution, an examiner discovers material that tends to exonerate the accused. The examiner should:

  1. Suppress it because it falls outside the engagement's scope
  2. Document it and ensure it is disclosed Correct answer.
  3. Ask the investigator whether it should be included
  4. Destroy the related working notes

Explanation

Examiners must document and report findings fully, and in criminal matters the prosecution has a duty to disclose exculpatory evidence to the defence. Suppressing or destroying such a finding would be both an ethical breach and a serious legal violation.

Question 24Forensic Fundamentals, Legal and Ethical Considerations

A warrant authorizes a search of a computer for evidence of fraud. During analysis the examiner encounters material indicating an unrelated serious offence. Under the plain view doctrine as applied to digital evidence, the examiner may generally:

  1. Ignore the material because it falls outside the warrant
  2. Preserve the item and seek additional authorization before expanding the search Correct answer.
  3. Delete the material to keep the case focused
  4. Continue a broad search for any offence without further authority

Explanation

Under the plain view doctrine, an officer lawfully present may seize items whose incriminating character is immediately apparent. For digital media, examiners generally preserve such material and obtain further authorization before conducting a broader search for unrelated content.

Question 25Forensic Fundamentals, Legal and Ethical Considerations

Under the Federal Rules of Civil Procedure, a retained expert's written report must contain:

  1. Only the examiner's curriculum vitae together with the agreed fee schedule
  2. Opinions, their basis, facts considered, and the expert's qualifications Correct answer.
  3. A summary of the chain of custody and a list of the tools that were used
  4. Only the exhibits that the retaining attorney plans to introduce at trial

Explanation

Rule 26(a)(2)(B) requires a written report containing a complete statement of the opinions, the basis and reasons for them, the facts or data considered, the expert's qualifications, and the compensation. A curriculum vitae or exhibit list alone does not satisfy the disclosure obligation.

Question 26Forensic Fundamentals, Legal and Ethical Considerations

What is the main purpose of maintaining a chain of custody for digital evidence?

  1. To confirm that the item was analysed within the statutory time limit for seizure
  2. To establish that everyone who handled the item was a certified examiner
  3. To record the hourly fees charged by each examiner who handled the item
  4. To document each transfer of the item so its integrity can be demonstrated Correct answer.

Explanation

A chain of custody is a continuous, documented record of who had control of an item, when, and for what purpose, from seizure through analysis to court. It supports authentication of the evidence and rebuts claims of tampering or substitution. Any gap in the record must be explained and goes to the weight of the evidence, not automatically to admissibility.

Question 27Forensic Fundamentals, Legal and Ethical Considerations

An examiner is offered a fee arrangement under which payment depends on the client's case succeeding. What is the principal ethical concern with this arrangement?

  1. It gives the examiner a financial stake in the outcome, undermining independence and objectivity Correct answer.
  2. It bars the examiner from charging for time spent giving testimony
  3. It prevents the examiner from being deposed by the opposing party
  4. It is prohibited in all civil proceedings by the Federal Rules of Evidence

Explanation

An examiner's opinions must be reached independently and be supportable on the merits; contingent compensation creates a bias incentive and is generally treated as improper for a testifying expert. Courts and professional codes expect compensation that does not vary with the result of the case. Opposing counsel may raise the fee arrangement to impeach credibility, which is itself a reason to avoid it.

Question 28Forensic Fundamentals, Legal and Ethical Considerations

An examiner is responding to a live incident on a running server and wants to collect data in order of volatility. Which collection order follows accepted volatility guidance?

  1. Backup tapes first, then the hard disk image, then the contents of memory
  2. Full disk image first, then a memory capture, then the current network connection table
  3. CPU registers and cache first, then memory and network state, then disk contents Correct answer.
  4. Swap file first, then the hard disk image, then any printed system logs

Explanation

Accepted volatility guidance (RFC 3227) ranks data from most to least perishable: processor registers and cache, then routing tables, ARP cache, process table and memory, then temporary file systems and swap, then disk, then remote logs and archival media. Collecting the most perishable items first preserves data that would otherwise be lost as the system changes. Disk images and backups sit low in the order because they persist longest.

Question 29Forensic Fundamentals, Legal and Ethical Considerations

At trial, a party offers a printout of an electronic record instead of the underlying electronic file. Under the best-evidence (original writing) rule, the printout is:

  1. admissible only if both parties sign a stipulation accepting its accuracy
  2. inadmissible unless the original file has been destroyed or is unavailable
  3. admissible as a duplicate unless the original's authenticity is genuinely disputed Correct answer.
  4. inadmissible, because the rule requires production of the original electronic file

Explanation

The best-evidence rule requires the original writing, recording, or photograph to prove its content, but defines duplicates broadly to include accurate printouts and copies of electronic records. A duplicate is admissible to the same extent as the original unless a genuine question is raised about the original's authenticity or the circumstances make admitting the duplicate unfair. A party therefore need not produce the native file in every case.

Question 30Forensic Fundamentals, Legal and Ethical Considerations

A warrant authorises seizure of 'any and all electronic devices and data' at a residence in order to find evidence of one alleged tax offence. The strongest constitutional objection to the warrant is that it:

  1. is void because computer data can never be described with particularity
  2. requires the affiant to hold a recognised digital forensic certification
  3. lacks particularity because it fails to describe the items to be seized Correct answer.
  4. is invalid unless the officer who applied for it also executes it personally

Explanation

The Fourth Amendment requires warrants to state with particularity the place to be searched and the persons or things to be seized, so that officers are confined to the scope authorised. A warrant permitting seizure of all devices and all data for a single tax offence gives executing officers unconstrained discretion and is vulnerable as a general warrant. Courts often remedy this by limiting the seizure to media likely to contain the described evidence and by imposing search protocols for review.

Question 31Evidence Identification, Acquisition and Preservation

What is the primary purpose of maintaining a chain of custody for digital evidence?

  1. To record each transfer and handling of the item Correct answer.
  2. To replace the need for hashing the evidence image
  3. To speed up the technical examination process
  4. To establish the suspect's guilt before analysis begins

Explanation

Chain of custody is the chronological record of who seized, handled, transferred and stored an item, and when. An unbroken record supports authentication by showing the evidence is what it purports to be and has not been substituted or altered.

Question 32Evidence Identification, Acquisition and Preservation

Under the generally accepted order of volatility, which data should be collected first?

  1. Files stored on the hard disk drive
  2. Printed output left in the printer tray
  3. CPU registers and cache memory Correct answer.
  4. Backup tapes stored in an offsite vault

Explanation

Order of volatility ranks data by how quickly it is lost; registers, cache and RAM disappear when power is removed, while disk and archival media persist. Collection therefore begins with the most perishable sources.

Question 33Evidence Identification, Acquisition and Preservation

A hardware write blocker is used during acquisition to do which of the following?

  1. Repair damaged sectors on the source drive
  2. Compress the resulting image file to save storage space
  3. Block write commands from reaching the source drive Correct answer.
  4. Increase the transfer speed of the imaging process considerably

Explanation

A write blocker enforces read-only access at the hardware or software level so the examination host cannot modify the source medium. Preserving the source unchanged is what allows later verification of the image.

Question 34Evidence Identification, Acquisition and Preservation

Which value is most commonly recorded to demonstrate that a forensic image matches its source?

  1. The drive's manufacturer and serial number string
  2. A cryptographic hash of the acquired data Correct answer.
  3. The creation timestamp of the image file
  4. The number of partitions detected on the drive

Explanation

A cryptographic hash such as SHA-256 computed over the source and over the image provides a compact fingerprint. Identical values demonstrate the copy is a faithful, bit-for-bit reproduction.

Question 35Evidence Identification, Acquisition and Preservation

Where should the hash value of an acquired image first be recorded?

  1. In an email sent to the case agent after the analysis
  2. In the contemporaneous acquisition notes or evidence form Correct answer.
  3. On a handwritten label attached to the evidence bag
  4. Only in the final written report submitted to the court

Explanation

Hash values must be documented at the time of acquisition in contemporaneous records so later verification can be tied to the original collection event. Recording them only later weakens authentication.

Question 36Evidence Identification, Acquisition and Preservation

What distinguishes a bit-stream forensic image from a logical file copy?

  1. It captures every sector, including deleted and slack space Correct answer.
  2. It can be created without using any write-blocking device whatsoever
  3. It is admissible only in civil rather than criminal proceedings
  4. The image is always smaller in size than the logical copy

Explanation

A bit-stream image duplicates every addressable sector of the medium, including unallocated space, slack space and deleted content. A logical copy captures only selected files, so it omits data that may be evidentially significant.

Question 37Evidence Identification, Acquisition and Preservation

In which situation is a live acquisition most clearly justified?

  1. When full-disk encryption or remote wipe would destroy data Correct answer.
  2. When the disk has already been imaged by another examiner
  3. When the machine is powered off and stored in an evidence locker
  4. When the case involves only printed documentary evidence

Explanation

Live acquisition is justified when powered-off data would be unavailable or lost, for example with running encryption, volatile network state, or a device subject to remote wipe. Otherwise a static image of the powered-down system is preferred.

Question 38Evidence Identification, Acquisition and Preservation

A mobile phone is seized while switched on and connected to a cellular network. Placing it in a Faraday bag serves which purpose?

  1. Charge the battery during transport to the laboratory
  2. Cool the device to prevent overheating of its storage
  3. Isolate the device from networks to block remote wipe Correct answer.
  4. Allow the examiner to browse the device remotely

Explanation

A Faraday bag blocks radio signals, preventing the device from receiving calls, updates or remote-wipe commands while it is transported. It also keeps the device from reconnecting to networks that could alter its data.

Question 39Evidence Identification, Acquisition and Preservation

An examiner hashes the suspect drive before imaging and hashes the resulting image afterwards. The two values match. What does this demonstrate?

  1. The imaging process did not alter the data Correct answer.
  2. The hard drive contains no deleted or hidden data
  3. The suspect is the person who created the files
  4. The evidence is automatically admissible in a criminal court

Explanation

Matching hashes computed over the source and over the image show the copy is byte-for-byte identical to what was acquired, and that no alteration occurred during imaging. It speaks only to integrity, not to authorship or ultimate admissibility.

Question 40Evidence Identification, Acquisition and Preservation

According to accepted volatile-data collection guidance, which step comes before shutting the system down?

  1. Removing the hard drive and imaging it in the laboratory
  2. Reinstalling the operating system from original media
  3. Formatting the drive to expose hidden partitions
  4. Capturing RAM and network connection state Correct answer.

Explanation

Live memory and network state cannot be recovered once power is removed, so they must be captured before any shutdown or disk removal. Disk acquisition follows, since disk contents persist.

Question 41Evidence Identification, Acquisition and Preservation

Which collection sequence best follows the principle of volatility on a running Linux server?

  1. RAM and network state, then swap, then disk image Correct answer.
  2. Disk image, then CPU registers, then ARP cache, then RAM
  3. Disk image, then swap, then RAM, then network connections
  4. Swap partition, then disk image, then RAM, then route table

Explanation

Memory and live connection state evaporate the moment power is lost, whereas swap contents and on-disk data persist longer. Collecting from most volatile to least ensures nothing perishable is lost before capture.

Question 42Evidence Identification, Acquisition and Preservation

A gap appears in the chain-of-custody record between the officer who seized a laptop and the examiner who received it. What is the most likely consequence?

  1. The evidence's integrity can be challenged at trial Correct answer.
  2. The laptop must be returned to its owner immediately
  3. The examination must be repeated from the beginning
  4. The hash values recorded earlier become invalid automatically

Explanation

An undocumented interval creates an opportunity for the evidence to have been accessed or altered, which the opposing party can exploit to attack authenticity. The gap is usually addressed by testimony and supporting records rather than by voiding the evidence.

Question 43Evidence Identification, Acquisition and Preservation

Spoliation of evidence refers to which of the following?

  1. The written chain-of-custody record maintained by police
  2. The process of verifying a hash after the analysis
  3. The authorised imaging of a suspect's hard drive
  4. The loss or destruction of evidence relevant to a case Correct answer.

Explanation

Spoliation is the loss, alteration or destruction of evidence that is relevant to litigation, whether intentional or negligent. It can lead to sanctions and adverse inferences against the responsible party.

Question 44Evidence Identification, Acquisition and Preservation

An examiner arrives at a scene where a computer is running and encrypted. What is the best practice?

  1. Run antivirus software to clean the machine before shutdown
  2. Pull the power cord to freeze the disk contents
  3. Capture volatile data before deciding on shutdown Correct answer.
  4. Ask the user to log off and then restart the machine

Explanation

When encryption keys may reside only in memory, the running state is evidentially critical and volatile data should be captured first. The decision to shut down or keep the system running is then made deliberately and documented.

Question 45Evidence Identification, Acquisition and Preservation

Under Federal Rule of Evidence 902(14), electronic evidence may be self-authenticating when which condition is met?

  1. The evidence is kept on encrypted backup media
  2. A hash identifies the data and shows no change Correct answer.
  3. The file was produced by a commercial forensic tool
  4. A witness testifies that the file appears unaltered

Explanation

Rule 902(14) permits self-authentication where a certified process has been shown to produce accurate copies and a hash value demonstrates the data has not changed. The rule avoids the need for live testimony solely to establish authenticity.

Question 46Evidence Identification, Acquisition and Preservation

ISO/IEC 27037 provides guidance principally on which activity?

  1. Encryption algorithms for securing data stored in the cloud
  2. Certifying the professional competence of forensic examiners
  3. Writing admissibility reports for use in criminal trials
  4. Identifying, acquiring and preserving digital evidence Correct answer.

Explanation

ISO/IEC 27037 gives international guidance for the identification, collection, acquisition and preservation of digital evidence. It is aimed at practitioners who handle evidence before it reaches the laboratory.

Question 47Evidence Identification, Acquisition and Preservation

A forensic image of a hard drive is best described as which of the following?

  1. A printed listing of every file stored on the drive
  2. A compressed backup of selected user documents
  3. A screenshot of the file manager window
  4. A sector-by-sector duplicate of the original drive Correct answer.

Explanation

A forensic image reproduces the medium sector by sector, including unallocated and slack space, so it equals the source in verifiable form. It is created from a write-blocked source and validated by hashing.

Question 48Evidence Identification, Acquisition and Preservation

When seizing a powered-on smartphone, which action best preserves its data?

  1. Running a full factory reset to protect user privacy
  2. Isolating it from all networks without powering it down Correct answer.
  3. Switching the device off and charging it in the laboratory
  4. Removing the SIM card and forcing a reboot of the device

Explanation

Keeping the device powered on while shielding it from networks preserves live data and avoids triggering locks or encryption that a power cycle may engage. Network isolation prevents remote wipe and new data from arriving.

Question 49Evidence Identification, Acquisition and Preservation

Why do many examiners prefer SHA-256 over MD5 when verifying image integrity?

  1. SHA-256 can be computed without any specialised software
  2. SHA-256 does not require re-hashing after the analysis is complete
  3. SHA-256 resists deliberate collision attacks far better Correct answer.
  4. SHA-256 produces a shorter value that is easier to record

Explanation

MD5 has practical collision attacks, meaning two different inputs can share a digest. SHA-256's longer digest and stronger design make engineered collisions infeasible for practical purposes, so it provides stronger assurance of integrity.

Question 50Evidence Identification, Acquisition and Preservation

What should an examiner do first upon entering a scene containing digital devices?

  1. Document and photograph the scene before altering it Correct answer.
  2. Collect the devices immediately into evidence bags
  3. Disconnect all power sources in the room
  4. Search the devices immediately for the suspect's files

Explanation

Recording the scene as found preserves information about device placement, connections and power state that later explains the evidence. Any alteration before documentation is difficult to defend and cannot be undone.