I85PREP
⌘ K
CFCE study materials
CFCE study resources

CFCE practice questions

One question at a time. Build your CFCE understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Forensic Readiness, Legal and Ethical Considerations

In a forensic-readiness program, what is the primary purpose of establishing a documented chain of custody before any incident occurs?

  1. To reduce the number of personnel who may access production systems
  2. To ensure that any evidence later collected can be shown to be authentic and unaltered Correct answer.
  3. To guarantee that evidence will be admissible in every jurisdiction
  4. To satisfy insurance carriers that assets are properly valued

Explanation

Chain of custody is a documented, unbroken record of who handled evidence, when, and why. Preparing the forms and procedures in advance lets an organization demonstrate authenticity and integrity of evidence gathered during a later incident. Admissibility depends on many factors beyond the chain, so no procedure can guarantee it everywhere.

Question 2Forensic Readiness, Legal and Ethical Considerations

A forensic examiner images a suspect laptop and computes a SHA-256 hash of the source drive and of the image. The two hashes match. What does this establish?

  1. That the examiner followed proper legal authority to seize the device
  2. That the operating system on the drive was not tampered with before seizure
  3. That the image is a bit-for-bit copy of the source at the time of acquisition Correct answer.
  4. That the original drive contained no deleted files

Explanation

Matching cryptographic hashes over the source and the acquired image demonstrate integrity: the copy is identical to the original at acquisition time. Hashing says nothing about deleted content, legal authority, or events that occurred before the drive was seized.

Question 3Forensic Readiness, Legal and Ethical Considerations

Which activity best exemplifies proactive forensic readiness rather than reactive incident response?

  1. Rebuilding a compromised server from a known-good baseline
  2. Acquiring a memory image after a suspected intrusion is confirmed
  3. Interviewing employees after a data leak is discovered
  4. Deploying centralized logging with synchronized time sources before an incident Correct answer.

Explanation

Forensic readiness is about building capabilities before an incident so evidence is available and trustworthy when needed. Centralized logging with synchronized clocks preserves timeline accuracy and is a classic readiness control. The other choices occur after an event has been detected.

Question 4Forensic Readiness, Legal and Ethical Considerations

Why do forensic practitioners prefer writing acquired images to a write-blocked destination and verifying with a hash?

  1. To bypass the need for a warrant when copying data
  2. To compress the image so it fits on smaller media
  3. To prevent accidental modification of the source and to prove the copy's integrity Correct answer.
  4. To speed up the imaging process on large drives

Explanation

Write blocking prevents any write from reaching the source medium, preserving its original state. Hashing the source and the copy then documents that the image matches the source. Neither measure affects legal authority or is primarily about speed or size.

Question 5Forensic Readiness, Legal and Ethical Considerations

An organization wants to rely on its own acceptable-use policy to monitor employee endpoints during an investigation. Which condition most strengthens the policy's legal defensibility?

  1. Monitoring is performed only after an incident is confirmed
  2. Employees receive the policy, acknowledge it in writing, and it clearly states monitoring may occur Correct answer.
  3. The policy is written in general terms so it can be reinterpreted later
  4. The policy is stored only on the intranet and never distributed

Explanation

For an acceptable-use policy to support monitoring, employees must be on notice of the monitoring and have acknowledged the terms. Clear language plus documented acknowledgment reduces claims of a reasonable expectation of privacy. Vague or undisclosed policies undermine that position.

Question 6Forensic Readiness, Legal and Ethical Considerations

During a joint investigation, a company receives a civil subpoena and a separate law-enforcement request for the same forensic image. What is the most appropriate first step for the forensic team?

  1. Release the image to both requesters immediately to show cooperation
  2. Route both requests to legal counsel to determine scope, authority, and any conflicts Correct answer.
  3. Refuse both requests until a court order is issued
  4. Delete the image to avoid conflicting obligations

Explanation

Legal counsel should evaluate each request's authority, scope, and any confidentiality or privilege issues before evidence is disclosed. Releasing evidence without review can violate privacy law or privilege, and refusing or destroying evidence can carry sanctions. Counsel coordinates the response across civil and criminal tracks.

Question 7Forensic Readiness, Legal and Ethical Considerations

An examiner must preserve volatile data on a running server that is believed to contain malware. Which order of volatility principle should guide collection?

  1. Collect the most volatile data first, such as memory and network connections Correct answer.
  2. Collect data alphabetically by file name to ensure completeness
  3. Collect only data that is already documented in the case file
  4. Collect the most persistent data first, such as backups and archives

Explanation

The order of volatility holds that the most perishable data, such as RAM, running processes, and network state, should be captured before it disappears. Persistent media and archives are collected afterward. Following this order preserves the maximum amount of evidence.

Question 8Forensic Readiness, Legal and Ethical Considerations

A forensic analyst finds that the suspect's system clock was set three hours behind the logging server's clock. How should the analyst handle timeline correlation?

  1. Assume the offset was caused by daylight saving time and ignore it
  2. Document the offset, normalize host timestamps to a common reference, and note the adjustment in the report Correct answer.
  3. Adjust the host timestamps in the evidence files themselves to match the server
  4. Discard the host timestamps as unreliable and rely only on server logs

Explanation

Clock skew must be documented and corrected analytically, not by modifying evidence. Normalizing timestamps to a common reference in the report preserves accuracy while keeping the original data intact. The adjustment and its basis should be explained so reviewers can follow the reasoning.

Question 9Forensic Readiness, Legal and Ethical Considerations

A company is subject to a regulation requiring breach notification within 72 hours of awareness. What forensic-readiness step best supports meeting that deadline?

  1. Requiring every incident to be reviewed by the board before any action
  2. Waiting until the forensic report is complete before notifying anyone
  3. Storing all logs on individual endpoints to reduce central exposure
  4. Pre-drafting notification templates and a decision matrix for scoping affected data Correct answer.

Explanation

Meeting a short notification deadline requires pre-built processes: templates, roles, and criteria for determining scope and whether notification is triggered. These readiness artifacts let the organization act quickly while the investigation continues. Waiting for a complete report or adding slow approvals risks missing the deadline.

Question 10Forensic Readiness, Legal and Ethical Considerations

Which statement best describes the role of an expert witness compared with a fact witness in a forensic case?

  1. An expert witness may offer opinions based on specialized knowledge; a fact witness testifies to direct observations Correct answer.
  2. An expert witness is always an employee of the party that retained them
  3. An expert witness testifies only to what was directly observed; a fact witness may offer opinions
  4. Both witnesses are barred from reviewing evidence before testifying

Explanation

An expert witness is permitted to give opinion testimony grounded in specialized knowledge and reliable methodology, subject to the court's qualification. A fact witness testifies about what they personally saw or did. The distinction affects how each witness's testimony is prepared and challenged.

Question 11Forensic Readiness, Legal and Ethical Considerations

A forensic lab documents its tool validation for a disk-imaging utility. Why is this documentation important for legal and ethical reasons?

  1. It removes the need to hash the acquired images
  2. It guarantees the tool will be accepted in every court
  3. It proves the utility was the least expensive option available
  4. It demonstrates that the tool produces reliable, repeatable results that can withstand challenge Correct answer.

Explanation

Tool validation records show that a method reliably does what it claims and can be reproduced by others. This supports the reliability of the evidence and helps the examiner defend the methodology under scrutiny. Validation does not eliminate hashing or guarantee acceptance everywhere.

Question 12Forensic Readiness, Legal and Ethical Considerations

During an investigation, an examiner discovers evidence of a serious crime unrelated to the original civil matter. What is the most ethically and legally sound course of action?

  1. Consult with counsel and follow applicable disclosure obligations while preserving the evidence Correct answer.
  2. Ignore the evidence because it falls outside the engagement scope
  3. Conceal the evidence to protect the client's interests
  4. Publish the findings on social media to ensure transparency

Explanation

Unrelated evidence of serious crime triggers legal and ethical duties that vary by jurisdiction and engagement. The examiner should preserve the evidence, avoid unilateral disclosure, and consult counsel about mandatory reporting or disclosure obligations. Concealment or public posting would be improper.

Question 13Forensic Readiness, Legal and Ethical Considerations

An organization wants to collect forensic images of employee laptops without disrupting business operations. Which readiness measure best balances operational and legal needs?

  1. Relying on user-created screenshots of their own drives as evidence
  2. Pre-deploying an endpoint agent that can capture a verified image with documented authorization workflows Correct answer.
  3. Disabling disk encryption on all laptops to simplify imaging
  4. Requiring employees to hand over laptops for weeks during any investigation

Explanation

A pre-deployed, authorized capture capability lets the organization preserve evidence quickly while keeping disruption low. Documented authorization workflows ensure the collection is legally defensible. The other options either harm operations, weaken security, or produce unreliable evidence.

Question 14Forensic Readiness, Legal and Ethical Considerations

A forensic report states a conclusion that goes beyond what the analyzed artifacts support. From an ethical standpoint, what is the primary concern?

  1. The report may be too long for the court to read
  2. The conclusion may mislead the trier of fact and undermine the examiner's credibility Correct answer.
  3. The conclusion may increase the cost of litigation
  4. The report may require additional hashing

Explanation

Expert opinions must stay within the bounds of the evidence and the examiner's expertise. Overstating conclusions risks misleading the court and violates the duty of objectivity owed by forensic professionals. Length, cost, and hashing are not the ethical issue here.

Question 15Forensic Readiness, Legal and Ethical Considerations

Which practice best supports the ethical handling of personally identifiable information discovered during a forensic examination?

  1. Retaining copies of PII indefinitely in personal storage
  2. Applying data-minimization principles and restricting access to those who need it Correct answer.
  3. Publishing anonymized samples of the PII to demonstrate thoroughness
  4. Sharing all discovered PII with the entire investigative team by default

Explanation

Forensic work frequently exposes PII that is not relevant to the matter. Ethical handling calls for minimizing collection and exposure and limiting access to personnel with a legitimate need. Indefinite retention, broad sharing, or publication increases privacy harm without investigative benefit.

Question 16Forensic Readiness, Legal and Ethical Considerations

A court challenges an examiner's methodology for carving deleted files. Which combination best supports admissibility of the resulting evidence?

  1. A claim that the method is proprietary and cannot be disclosed
  2. Documented, repeatable methodology, validated tools, and an explanation of error rates and limitations Correct answer.
  3. Anecdotal success in prior cases and verbal assurances of accuracy
  4. Assurance that no other examiner has ever questioned the method

Explanation

Reliability of a forensic technique is supported by documentation, validation, known error rates, and transparency about limitations. These elements let the court assess whether the method reliably produces accurate results. Secrecy, anecdotes, or appeals to precedent do not substitute for that showing.

Question 17Forensic Readiness, Legal and Ethical Considerations

A multinational company must respond to a law-enforcement request for data stored in another country where local law restricts transfers. What is the most appropriate approach?

  1. Assess the conflicting legal obligations with local and foreign counsel before any transfer Correct answer.
  2. Transfer the data immediately because the requesting country's law takes precedence
  3. Encrypt the data and send the key separately to avoid the restriction
  4. Refuse all requests permanently to avoid any legal risk

Explanation

Cross-border requests can create conflicts between the requesting state's authority and local data-protection or blocking laws. The organization should identify the applicable rules with counsel and use lawful mechanisms such as mutual legal assistance or applicable agreements. Unilateral transfer or permanent refusal ignores the conflict.

Question 18Forensic Readiness, Legal and Ethical Considerations

An examiner's draft report contains a conclusion later shown to be incorrect after new evidence emerges. What is the most defensible professional response?

  1. Argue that the original conclusion remains valid to protect credibility
  2. Withdraw from the case without explanation
  3. Document the new evidence, issue a corrected report, and disclose the change to the retaining party Correct answer.
  4. Quietly revise the draft and keep no record of the change

Explanation

Forensic professionals have a duty of candor and accuracy. When new evidence undermines a conclusion, the proper response is to document it, correct the report, and disclose the change so the court and retaining party are not misled. Concealment or defensiveness harms both justice and credibility.

Question 19Forensic Readiness, Legal and Ethical Considerations

A readiness assessment finds that logs are retained for only seven days, while incidents are typically detected after thirty days. Which conclusion is most sound?

  1. Only application logs need longer retention
  2. Log retention is adequate because detection occurs after the fact
  3. Retention should be extended to cover realistic detection and investigation windows Correct answer.
  4. Logs should be disabled to reduce storage costs

Explanation

Forensic readiness requires that evidence survive until it is likely to be needed. If detection lags retention, relevant logs will be lost before investigations begin, so retention should be aligned with realistic detection and investigation timelines. Disabling logs or assuming adequacy defeats the purpose.

Question 20Forensic Readiness, Legal and Ethical Considerations

Which statement correctly distinguishes spoliation from a chain-of-custody defect?

  1. Both terms apply only to paper documents, not digital evidence
  2. Spoliation is the loss or destruction of evidence; a chain-of-custody defect is a gap in the record of handling Correct answer.
  3. Both terms refer only to intentional misconduct by examiners
  4. Spoliation is a gap in the record of handling; a chain-of-custody defect is the loss of evidence

Explanation

Spoliation concerns the loss, destruction, or material alteration of evidence, potentially triggering sanctions. A chain-of-custody defect is a break or gap in documentation of who handled evidence and when. The two are related but distinct concepts, and both can apply to digital evidence.

Question 21Evidence Handling, Chain of Custody and Documentation

A responder arrives at a workstation where a suspected intrusion occurred. According to the order of volatility, which item should be captured first?

  1. Archived log files stored on a backup server
  2. Printed hardcopy of the user's login records
  3. Contents of RAM and running network connections Correct answer.
  4. The file allocation table on the hard disk

Explanation

The order of volatility ranks evidence by how quickly it degrades, and volatile memory plus live network state disappear once the machine loses power. Persistent media and archived copies survive longer, so they are collected later. Capturing RAM and active connections first preserves the most perishable evidence.

Question 22Evidence Handling, Chain of Custody and Documentation

Which practice best establishes that a digital image taken from a suspect laptop is a true copy of the original media?

  1. Storing the image on the same drive that holds the original
  2. Asking the system owner to confirm the copy looks complete
  3. Photographing the laptop screen while the acquisition runs
  4. Recording the hash value of the source and the image and comparing them Correct answer.

Explanation

A cryptographic hash computed before and after acquisition is the accepted method for demonstrating that the image matches the source bit for bit. If the two digests match, any alteration during copying is effectively ruled out. This verification is what makes the copy defensible as evidence.

Question 23Evidence Handling, Chain of Custody and Documentation

During seizure of a smartphone at a scene, which action preserves the most evidential value?

  1. Isolate the device from networks and document its state before touching it Correct answer.
  2. Scroll through the message app to check for relevant content
  3. Power it off immediately and remove the SIM card
  4. Hand the device to the complainant for safekeeping

Explanation

Network isolation prevents remote wiping or new traffic from altering the stored data, and documenting the on-screen state captures context that may be lost later. Any interaction with the device must be recorded and justified. Preserving state before handling is the core principle for mobile evidence.

Question 24Evidence Handling, Chain of Custody and Documentation

What is the primary purpose of a chain-of-custody form?

  1. To estimate the cost of the forensic examination
  2. To summarize the investigator's theory of the offense
  3. To record every transfer of evidence with time, date, and handler Correct answer.
  4. To list the software tools installed on the forensic workstation

Explanation

A chain-of-custody record provides an unbroken, chronological account of who held the evidence, when, and for what purpose. It lets a court or reviewer trace the item from seizure to presentation. Any gap in that record undermines the claim that the evidence is unaltered.

Question 25Evidence Handling, Chain of Custody and Documentation

An investigator photographs a seized external drive at the scene. Which element should appear in the photo documentation?

  1. The drive alongside a scale and a case identifier label Correct answer.
  2. Only the drive's brand name close-up
  3. The investigator's written conclusions about the drive contents
  4. A screenshot of the drive mounted on the examiner's laptop

Explanation

Scene photographs should show the item in context with a scale and a case identifier so the image can be linked to the correct seizure. This makes the photo self-authenticating and reproducible. Conclusions and later lab views are not part of scene documentation.

Question 26Evidence Handling, Chain of Custody and Documentation

Which statement correctly describes the difference between a write blocker and forensic imaging software?

  1. The write blocker logs network traffic, while imaging software filters it
  2. The write blocker creates the image, while imaging software computes the hash
  3. The write blocker prevents modification of the source, while imaging software creates the copy Correct answer.
  4. The write blocker encrypts the source, while imaging software decrypts it

Explanation

A hardware or software write blocker sits between the examiner's system and the source media to block any write command, protecting the original. Imaging software then reads that protected source and produces a verified duplicate. The two tools serve complementary roles in acquisition.

Question 27Evidence Handling, Chain of Custody and Documentation

A forensic examiner receives a sealed evidence bag whose seal is broken but whose custody form shows no corresponding entry. What is the correct documentation response?

  1. Ask the courier to sign the form retroactively
  2. Record the discrepancy in the case notes and notify the case manager before proceeding Correct answer.
  3. Reseal the bag and continue as if nothing happened
  4. Discard the evidence as unusable

Explanation

Any break in the seal without a matching custody entry is a documented anomaly that must be captured in the record and escalated. Concealing it or backdating signatures would be a falsification of the custody trail. Transparency protects both the evidence and the examiner.

Question 28Evidence Handling, Chain of Custody and Documentation

An examiner images a 500 GB drive and the acquisition log shows the source hash and the image hash differ. What is the most appropriate next step?

  1. Report the image as evidence without mentioning the mismatch
  2. Edit the log to show matching hashes
  3. Accept the image because hashes are only advisory
  4. Treat the acquisition as failed and re-image using a verified method Correct answer.

Explanation

A hash mismatch means the copy cannot be shown to equal the source, so the acquisition must be treated as failed and repeated with a verified procedure. Altering or omitting the result would be misconduct. The mismatch itself should be documented in the case record.

Question 29Evidence Handling, Chain of Custody and Documentation

Which documentation approach best supports later reconstruction of a live-response session on a server?

  1. A verbal briefing to the team lead with no written record
  2. A list of only the files that appeared relevant
  3. Contemporaneous notes with timestamps, commands run, and outputs captured Correct answer.
  4. A summary written from memory the following week

Explanation

Live response is not repeatable, so contemporaneous notes recording time, command, and output are the only reliable way to reconstruct what was done. Memory-based summaries and verbal briefings lose detail and cannot be tested. Completeness matters more than a curated list of interesting files.

Question 30Evidence Handling, Chain of Custody and Documentation

A laptop is seized from a suspect's home and transported to the lab. Which entry belongs on the custody form at the moment of transfer from the seizing officer to the lab intake examiner?

  1. Only the case number and the item description
  2. The suspect's statement about the laptop
  3. Date, time, releasing officer, receiving examiner, and purpose of transfer Correct answer.
  4. The estimated forensic examination hours

Explanation

Each transfer entry should identify when the item moved, who released it, who received it, and why, so the item's whereabouts are continuous. Case number and description identify the item but do not document the handoff. Statements and effort estimates belong elsewhere.

Question 31Evidence Handling, Chain of Custody and Documentation

When packaging a hard drive recovered from a scene, which method best preserves the device and its data?

  1. Leave it connected to the running system during transport
  2. Place it in an anti-static, padded container and label it with the case and item number Correct answer.
  3. Store it next to strong magnets in the transport vehicle
  4. Wrap it loosely in a plastic bag with no padding

Explanation

Proper packaging protects the drive from physical shock and static discharge while the label links it to the case record. Magnetic exposure and continued operation both risk altering or destroying data. A padded anti-static container is the standard approach.

Question 32Evidence Handling, Chain of Custody and Documentation

Why should an examiner document the tool name and version used for each acquisition and analysis step?

  1. To avoid the need for a chain-of-custody form
  2. To satisfy software licensing requirements
  3. So the results can be independently reproduced and the method defended Correct answer.
  4. To speed up the examination of similar cases

Explanation

Recording tool identity and version allows another examiner to reproduce the same result and lets the court assess the reliability of the method. It also distinguishes results produced by different tool builds. Custody documentation remains mandatory regardless of tooling.

Question 33Evidence Handling, Chain of Custody and Documentation

An examiner finds a text file on an image that appears to contain a confession. How should this artifact be documented in the report?

  1. State that the suspect wrote the confession and sign it
  2. Describe the file, its location, its hash, and the content verbatim without asserting authorship Correct answer.
  3. Summarize the file as irrelevant to the case
  4. Omit the file because its origin is uncertain

Explanation

The report should describe what was found, where it was found, and its integrity value, while leaving attribution to the trier of fact. Asserting authorship goes beyond what the technical evidence supports. Omitting or dismissing the file misrepresents the findings.

Question 34Evidence Handling, Chain of Custody and Documentation

Which record best demonstrates that a forensic image was stored without alteration between acquisition and analysis?

  1. A list of the analyst's credentials
  2. Periodic hash verification entries logged in the evidence management system Correct answer.
  3. A note that the image was copied to a colleague's laptop
  4. A statement that the storage room is locked

Explanation

Recurring hash checks in the evidence management system show that the stored image still matches the value recorded at acquisition. Physical security and credentials support the process but do not prove data integrity. Only a hash comparison addresses alteration directly.

Question 35Evidence Handling, Chain of Custody and Documentation

A defense reviewer requests the acquisition log for an image. Which set of details should the log contain to support the acquisition?

  1. The suspect's contact details and the offense charged
  2. Source identifier, examiner, time, tool and version, hash algorithm and values Correct answer.
  3. Only the final hash of the image
  4. Only the examiner's name and the date

Explanation

A complete acquisition log ties the source, the person performing the work, the time, the tooling, and the hash values together. This combination lets a reviewer confirm that the copy corresponds to the identified source. Missing any of these elements weakens the record.

Question 36Evidence Handling, Chain of Custody and Documentation

Two examiners disagree about whether a log entry should be corrected because the original time was recorded incorrectly. What is the accepted documentation practice?

  1. Erase the original entry and write the correct time
  2. Leave the error and rely on memory at trial
  3. Overwrite the file with a clean version
  4. Add a dated, signed correction note that preserves the original entry Correct answer.

Explanation

Records should never be erased; corrections are made by adding a signed, dated note that explains the change while leaving the original visible. This preserves the audit trail and shows the record was not manipulated. Silent overwriting destroys that transparency.

Question 37Evidence Handling, Chain of Custody and Documentation

Which statement best describes the relationship between evidence integrity and admissibility?

  1. A documented, unbroken integrity record supports admissibility but does not guarantee it Correct answer.
  2. A matching hash automatically guarantees the evidence will be admitted
  3. Admissibility depends only on the seriousness of the offense
  4. Integrity records are irrelevant once the evidence is in the lab

Explanation

Courts weigh authentication, relevance, and other legal rules alongside the technical integrity record. A clean custody and hash trail strengthens the case for admission but does not compel it. Integrity documentation therefore matters throughout the life of the evidence.

Question 38Evidence Handling, Chain of Custody and Documentation

A USB device is found plugged into a running server during an incident. Which action sequence best preserves both volatile and persistent evidence?

  1. Format the USB device to remove malware
  2. Copy the USB contents to a shared network drive
  3. Capture live state and record the device's mount status, then power down and seize the device Correct answer.
  4. Remove the USB device immediately and reboot the server

Explanation

Recording live state and mount status before shutdown preserves information that disappears on power loss, while the subsequent seizure secures the physical device. Immediate removal or rebooting destroys volatile context and may alter the device. Formatting or casual copying destroys or contaminates evidence.

Question 39Evidence Handling, Chain of Custody and Documentation

An examiner's report states that a particular user account created a file. The underlying evidence shows only that the file was created during a session when that account was logged on. Which critique of the report is most accurate?

  1. It is irrelevant because file creation times are unreliable
  2. It is correct because accounts are always personal
  3. It is understated because more users could be involved
  4. It overstates attribution because account logon does not prove who was at the keyboard Correct answer.

Explanation

Attribution requires more than a logged-on account, since credentials can be shared, stolen, or left active on an unattended machine. The report should describe the technical finding and note the limits of what it supports. Overstating attribution is a common and serious documentation error.

Question 40Evidence Handling, Chain of Custody and Documentation

A lab uses a validated imaging tool but a newer version produces a different hash for the same source drive than the prior version. What is the most defensible documentation response?

  1. Assume the newer version is correct and discard the older image
  2. Switch to manual copying without any tool
  3. Investigate the discrepancy, document findings, and use a verified method before relying on either image Correct answer.
  4. Report both hashes as if they were identical

Explanation

Differing hashes from the same source indicate that something in the acquisition changed, such as settings, read behavior, or tool defect. The examiner must investigate, document the cause, and confirm a verified method before using the result. Assuming correctness or concealing the difference undermines the evidence.

Question 41Evidence Handling, Chain of Custody and Documentation

During a cross-border case, an examiner must transfer an image to a foreign agency. Which documentation element is most important to preserve the chain of custody across jurisdictions?

  1. A note that the image was encrypted
  2. A verbal agreement between the two examiners
  3. A copy of the offense report only
  4. A transfer record naming both parties, the medium, the hash, and the date and time Correct answer.

Explanation

Cross-jurisdiction transfers multiply the opportunities for gaps, so the record must identify sender, recipient, medium, hash, and timing. This lets either side verify that the received image matches what was sent. Informal agreements and unrelated documents do not establish custody.

Question 42Evidence Handling, Chain of Custody and Documentation

An examiner discovers that a colleague's case notes were written after the examination was completed but dated to the examination day. What is the appropriate professional response?

  1. Report the discrepancy through the established review process and document it factually Correct answer.
  2. Ignore it because the notes are accurate in content
  3. Add your own backdated notes to match
  4. Delete the colleague's notes to avoid confusion

Explanation

Backdating notes misrepresents when the record was created and can undermine every finding in the case. The correct response is to raise the issue through the review process and document it factually. Altering or deleting records compounds the problem.

Question 43Evidence Handling, Chain of Custody and Documentation

Which item should be documented when a forensic workstation is used to examine evidence, to support later review of the analysis?

  1. The workstation identifier, examiner, tool versions, and hash of the examined image Correct answer.
  2. The number of other cases pending in the lab
  3. The examiner's personal schedule for the week
  4. The workstation's purchase price and warranty status

Explanation

Linking the analysis to a specific workstation, examiner, tool set, and verified image hash allows another reviewer to reproduce and check the work. Administrative details about cost or workload do not affect the reliability of the findings. Reproducibility is the goal of this documentation.

Question 44Evidence Handling, Chain of Custody and Documentation

A responder needs to preserve the contents of a running virtual machine's memory before shutting it down. Which documentation practice is most important alongside the capture?

  1. Recording the physical location of the host in the building
  2. Listing the virtual machine's guest operating system only
  3. Recording the capture time, method, and hash of the resulting memory file Correct answer.
  4. Noting only the hypervisor vendor

Explanation

A memory capture is only useful if the record shows when and how it was taken and provides a hash to verify integrity. These details let a reviewer confirm the file was not altered afterward. Vendor, location, and OS details alone do not establish integrity.

Question 45Storage Media, File Systems and Data Structures

In a FAT file system, what is the primary purpose of the file allocation table itself?

  1. It caches recently used directory entries for faster lookup
  2. It holds the actual user data for files larger than one cluster
  3. It records the cluster chain linking the pieces of each file and marks free or bad clusters Correct answer.
  4. It stores the file name and timestamps for each directory entry

Explanation

The FAT is an array indexed by cluster number; each entry points to the next cluster in a chain or holds an end-of-chain, free, or bad marker. Directory entries separately hold names and metadata, while file content lives in data clusters.

Question 46Storage Media, File Systems and Data Structures

Which NTFS metadata file stores the attributes and cluster run locations for every file and directory on the volume?

  1. $LogFile
  2. $Boot
  3. $MFT Correct answer.
  4. $Bitmap

Explanation

The Master File Table ($MFT) contains one record per file or directory, including attribute headers and data run lists. Other metadata files serve logging, cluster allocation, and boot purposes.

Question 47Storage Media, File Systems and Data Structures

On an ext4 file system, what does an inode store?

  1. The journal of pending metadata transactions
  2. File metadata such as ownership, permissions, timestamps, and block pointers Correct answer.
  3. The file's data blocks only
  4. The file name and its parent directory

Explanation

An inode holds metadata and pointers to data blocks, but not the file name; names live in directory entries that map names to inode numbers. Journaling data is kept in the journal, and data blocks are referenced rather than contained.

Question 48Storage Media, File Systems and Data Structures

What is the smallest addressable unit on a hard disk drive as reported by its physical geometry?

  1. A page
  2. A cluster
  3. A block
  4. A sector Correct answer.

Explanation

Disk drives expose sectors, traditionally 512 bytes and commonly 4096 bytes on modern drives. Clusters and blocks are file-system allocation units, and pages are memory units.

Question 49Storage Media, File Systems and Data Structures

In a GUID Partition Table (GPT) scheme, where is the primary partition entry array located?

  1. In the last sector of the disk
  2. Immediately after the protective MBR, before the GPT header
  3. After the GPT header, typically in the following sectors Correct answer.
  4. In the volume boot record of the first partition

Explanation

GPT places a protective MBR in LBA 0, the GPT header in LBA 1, and the partition entry array in the sectors following the header. A backup copy of both header and entries is kept at the end of the disk.

Question 50Storage Media, File Systems and Data Structures

Which file system structure on a FAT volume stores the volume label, cluster size, and number of FATs?

  1. The BIOS Parameter Block in the boot sector Correct answer.
  2. The root directory
  3. The partition table
  4. The end-of-chain marker

Explanation

The BIOS Parameter Block within the boot sector describes geometry such as bytes per sector, sectors per cluster, and the count of FAT copies. Directory entries and partition tables are distinct structures.