I85PREP
⌘ K
Mile2 CDFE study materials
Mile2 CDFE study resources

Mile2 CDFE practice questions

One question at a time. Build your Mile2 CDFE understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Digital Forensics Fundamentals

Which term describes the principle that a forensic examiner must be able to demonstrate that digital evidence was not altered between seizure and presentation?

  1. Hashing rate
  2. Data carving
  3. Live acquisition
  4. Chain of custody Correct answer.

Explanation

Chain of custody is the documented, unbroken record of who handled evidence, when, and for what purpose. It supports the claim that the evidence presented is the same material originally collected. Carving and live acquisition are collection techniques, not integrity documentation.

Question 2Digital Forensics Fundamentals

A forensic workstation computes an MD5 value of a disk image immediately after acquisition and again before analysis. What is the primary purpose of comparing these values?

  1. To determine the file system type
  2. To compress the image for storage
  3. To verify the image has not changed since acquisition Correct answer.
  4. To decrypt encrypted partitions

Explanation

Recomputing a cryptographic hash and matching the original value demonstrates the image is bit-for-bit identical to the state at acquisition. Any change to the data would produce a different hash. Compression, decryption, and file system identification are unrelated to hash comparison.

Question 3Digital Forensics Fundamentals

During a forensic investigation, which data source is considered the most volatile and should generally be collected first?

  1. Log files on disk
  2. Files in the Recycle Bin
  3. Contents of RAM Correct answer.
  4. Archived email stores

Explanation

Order of volatility dictates collecting the most perishable data first, and memory contents are lost when power is removed. Disk-based artifacts such as Recycle Bin files, logs, and archives persist longer. This is why live memory capture precedes disk imaging in many incidents.

Question 4Digital Forensics Fundamentals

What distinguishes a forensic copy (bit-stream image) from a logical backup?

  1. A forensic copy is always smaller than a logical backup
  2. A forensic copy only stores files the operating system can currently read
  3. A forensic copy captures every sector including slack and unallocated space Correct answer.
  4. A forensic copy excludes deleted file remnants by design

Explanation

A bit-stream image duplicates the entire storage medium sector by sector, preserving deleted data, slack space, and unallocated clusters. A logical backup captures only selected files and metadata, so it omits much of forensic value. Size and exclusion of remnants are not properties of forensic copies.

Question 5Digital Forensics Fundamentals

Which statement best describes the role of a write blocker during disk acquisition?

  1. It encrypts the suspect drive during imaging
  2. It repairs damaged file system structures
  3. It prevents any write operation from reaching the evidence drive Correct answer.
  4. It speeds up the transfer by caching sectors

Explanation

A hardware or software write blocker intercepts commands so the evidence drive can be read without modification. This preserves integrity and supports later hash verification. Encryption, caching, and repair are not functions of a write blocker, and repair would itself alter evidence.

Question 6Digital Forensics Fundamentals

An examiner finds a file listed in the MFT but with its cluster allocations freed and reused. Which forensic concept does this illustrate?

  1. File signature spoofing
  2. Metadata versus content divergence Correct answer.
  3. Live response triage
  4. Steganographic embedding

Explanation

File system metadata can persist after content is deleted, so the directory entry may remain while the actual clusters are reallocated. This divergence between metadata and content is central to recovering and interpreting deleted files. Spoofing, steganography, and triage describe different phenomena.

Question 7Digital Forensics Fundamentals

Which of the following is the best example of volatile data that should be captured during live response?

  1. A spreadsheet stored in a user's Documents folder
  2. A previously exported event log archive
  3. The current network connection table Correct answer.
  4. A system's installed application list stored in the registry

Explanation

Active network connections exist only in memory and vanish on shutdown, making them volatile. Documents, registry hives, and exported log archives reside on disk and persist. Capturing connection state supports identifying remote sessions and exfiltration.

Question 8Digital Forensics Fundamentals

What is the primary reason forensic examiners document the tool name and version used during analysis?

  1. To guarantee the tool produces no false positives
  2. To satisfy software licensing audits
  3. To allow the results to be reproduced and evaluated by others Correct answer.
  4. To reduce the time required to write the report

Explanation

Recording tool identity and version lets another examiner repeat the process and assess whether results are reliable. Reproducibility underpins the credibility of forensic findings in reports and testimony. Licensing, report speed, and infallibility are not the rationale.

Question 9Digital Forensics Fundamentals

An examiner images a 500 GB drive but the resulting file is 480 GB and its hash does not match a second acquisition. Which explanation is most consistent with these observations?

  1. The drive contains 20 GB of compressed data
  2. The hash algorithm is unsuitable for large drives
  3. The acquisition tool skipped bad sectors or used compression Correct answer.
  4. The drive was write-blocked during acquisition

Explanation

A bit-stream image should normally equal the source size unless the tool compressed the output or skipped unreadable sectors. Either condition also explains why a repeat acquisition produced a different hash. Compression and error skipping both alter the byte stream or its representation.

Question 10Digital Forensics Fundamentals

A suspect deleted a file on an NTFS volume. Investigators want to determine the original creation time. Where is this most likely to be found?

  1. In the $MFT record for the file Correct answer.
  2. In the pagefile.sys header
  3. In the volume boot record
  4. In the $Bitmap only

Explanation

NTFS stores standard information attributes including creation, modification, and access timestamps in the file's $MFT record. Even after deletion the record may persist until reused. $Bitmap tracks cluster allocation, not timestamps.

Question 11Digital Forensics Fundamentals

Which Windows artifact most directly records programs that were executed on a system, including timestamps of first and last run?

  1. NTUSER.DAT
  2. Boot Configuration Data
  3. SAM hive
  4. Prefetch files Correct answer.

Explanation

Prefetch files in the Windows Prefetch directory record execution counts and last-run times for applications. They are a primary source for proving program execution. NTUSER.DAT stores user settings, SAM stores accounts, and BCD controls boot options.

Question 12Digital Forensics Fundamentals

An examiner needs to establish that a USB storage device was connected to a Windows host. Which registry location is most relevant?

  1. HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR Correct answer.
  2. HKLM\SYSTEM\CurrentControlSet\Services\Tcpip
  3. HKCU\Control Panel\Desktop
  4. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts

Explanation

The USBSTOR key under Enum records USB mass storage devices along with vendor, product, and serial identifiers. It is a standard artifact for proving device connection. Tcpip, Desktop, and Fonts keys serve unrelated purposes.

Question 13Digital Forensics Fundamentals

A forensic examiner must preserve email evidence from a corporate Exchange environment. Which approach best maintains evidentiary integrity?

  1. Forwarding relevant messages to a personal mailbox
  2. Exporting mailboxes to PST with logged hashes and custody records Correct answer.
  3. Printing messages and stapling them to the case file
  4. Taking screenshots of the inbox view

Explanation

Exporting mailbox data to a container such as PST while logging hashes and custody preserves content and metadata in a verifiable way. Forwarding alters headers, screenshots omit metadata, and printing loses most technical detail. Integrity depends on capturing native data with documentation.

Question 14Digital Forensics Fundamentals

During analysis of a memory image, an examiner finds a process with no corresponding executable on disk. What is the most likely interpretation?

  1. The memory image is corrupted
  2. The process is a kernel driver
  3. The process may be injected or fileless malware Correct answer.
  4. The process is a normal system service

Explanation

A running process whose backing executable is absent from disk suggests code injection or fileless execution, both common in modern malware. Legitimate services normally have on-disk binaries. Corruption and driver status do not specifically explain the mismatch.

Question 15Digital Forensics Fundamentals

Which log source on a Linux system most reliably records authentication attempts and sudo usage?

  1. /proc/cpuinfo
  2. /var/log/syslog or /var/log/auth.log depending on distribution Correct answer.
  3. /etc/passwd
  4. /etc/fstab

Explanation

Authentication events and sudo invocations are written to auth.log on Debian-based systems and to secure or syslog on others. These logs provide timestamped records of logins and privilege escalation. The other files hold account data, CPU details, and mount configuration.

Question 16Digital Forensics Fundamentals

An examiner recovers a JPEG from unallocated space by locating its header and footer without file system metadata. What technique is being used?

  1. Normalization
  2. Carving Correct answer.
  3. Hashing
  4. Indexing

Explanation

Carving reconstructs files from raw data by matching known headers and footers, independent of file system structures. It is valuable for deleted or fragmented content in unallocated space. Hashing, normalization, and indexing serve other forensic purposes.

Question 17Digital Forensics Fundamentals

A forensic report states a conclusion about a suspect's activity based only on a single timestamp from one artifact. What is the strongest criticism of this finding?

  1. It fails to include the examiner's resume
  2. It relies on a single source without corroboration Correct answer.
  3. It does not mention the acquisition tool vendor
  4. It uses too many data sources

Explanation

Sound forensic conclusions are corroborated across independent artifacts because timestamps can be altered, misinterpreted, or affected by time zone handling. Relying on one source weakens the finding. Excessive sources and missing personal or vendor details are not the core methodological flaw.

Question 18Digital Forensics Fundamentals

What is the primary forensic value of the Windows registry hive named UsrClass.dat?

  1. It holds the boot configuration
  2. It contains the event log database
  3. It records shellbag entries reflecting folder browsing Correct answer.
  4. It stores local account password hashes

Explanation

UsrClass.dat contains shellbags that record folders a user opened in Explorer, which can show access to removable or network paths. Account hashes reside in SAM, boot settings in BCD, and logs in EVTX files. Shellbags are frequently used to demonstrate user interaction with directories.

Question 19Digital Forensics Fundamentals

An examiner observes that a file's $STANDARD_INFORMATION creation time is later than its $FILE_NAME creation time in NTFS. What does this most likely indicate?

  1. The file was created by the operating system installer
  2. Timestomping or metadata manipulation may have occurred Correct answer.
  3. The file is stored in an alternate data stream
  4. The volume uses FAT32 rather than NTFS

Explanation

NTFS keeps two timestamp sets, and inconsistencies between them can reveal manipulation such as timestomping. Attackers often alter $STANDARD_INFORMATION while $FILE_NAME retains the original value. Installer creation, FAT32, and alternate data streams do not explain the mismatch.

Question 20Digital Forensics Fundamentals

Which statement correctly distinguishes hashing from encryption in a forensic context?

  1. Encryption is used to verify integrity, hashing to hide content
  2. Hashing is reversible with the right key, encryption is not
  3. Hashing produces a fixed-length digest used for integrity, encryption transforms data for confidentiality Correct answer.
  4. Both operations always produce output the same size as the input

Explanation

A cryptographic hash maps any input to a fixed-length digest and is used to verify integrity, while encryption transforms data so it can only be read with a key. Hashing is one-way, whereas encryption is reversible with the proper key. These roles are often confused.

Question 21Digital Forensics Fundamentals

An investigator finds that a log entry's timestamp is three hours ahead of the file system timestamps on the same host. Which explanation is most plausible?

  1. The log is written in a different time zone than the file system Correct answer.
  2. The log file was corrupted
  3. The file system does not support timestamps
  4. The host clock was intentionally reset

Explanation

Different time zone handling between an application log and file system metadata commonly produces consistent offsets. Investigators must normalize timestamps to a common zone before correlating events. Clock resets, corruption, and unsupported timestamps would not typically yield a uniform offset.

Question 22Digital Forensics Fundamentals

A suspect used a virtual machine to conduct illegal activity. Which artifact set is most useful for demonstrating the VM existed and was used?

  1. The host's print spooler files
  2. The host's font cache
  3. The BIOS CMOS checksum
  4. VM configuration files, virtual disk files, and host link files Correct answer.

Explanation

VM configuration and virtual disk files establish the VM's presence, while host link files and prefetch entries can show the hypervisor was launched. Together they correlate VM existence with user activity. Print spooler, CMOS, and font cache data do not address VM usage.

Question 23Digital Forensics Fundamentals

An examiner recovers data from a solid-state drive and notices the source image contains far more zeroed sectors than expected. What is the most likely cause?

  1. The write blocker blocked all reads
  2. The drive's TRIM function erased deleted data at the controller level Correct answer.
  3. The imaging tool applied compression to the output
  4. The file system was formatted with FAT32

Explanation

TRIM and garbage collection on SSDs can erase deleted blocks before imaging, producing large zeroed regions and reducing recoverable artifacts. This is a known limitation of SSD forensics. Compression alters image size, FAT32 is unrelated, and a write blocker does not prevent reads.

Question 24Digital Forensics Fundamentals

A network capture shows a host contacting an unfamiliar IP every 60 seconds with small, uniform payloads. Which hypothesis best fits this pattern, and what should the examiner do next?

  1. User browsing activity; review browser history only
  2. Normal background updates; no action needed
  3. Possible beaconing; correlate with host process and DNS logs Correct answer.
  4. Disk failure; image the drive immediately

Explanation

Regular, periodic small connections to an external address are characteristic of command-and-control beaconing. The examiner should correlate network data with host process and DNS records to identify the responsible program. Dismissing it as updates, assuming disk failure, or limiting review to browser history would miss the evidence.

Question 25Digital Forensics Fundamentals

During testimony, an examiner is asked how the acquisition tool handled a bad sector. The examiner did not document this. What is the most defensible response?

  1. Acknowledge the gap and explain how it affects interpretation of the image Correct answer.
  2. Assert that bad sectors never contain evidence
  3. State that the tool always skips bad sectors
  4. Refuse to answer the question

Explanation

Candidly acknowledging an undocumented detail and explaining its impact on the findings maintains credibility and lets the trier of fact weigh the evidence. Absolute claims about tool behavior or evidentiary value are unsupported, and refusing to answer undermines testimony. Transparency is a core forensic obligation.

Question 26Digital Forensics Fundamentals

Which term describes the principle that digital evidence must be preserved in an unaltered state from the moment of seizure through presentation in court?

  1. Forensic soundness
  2. Chain of custody
  3. Integrity of evidence Correct answer.
  4. Order of volatility

Explanation

Integrity of evidence means the data has not been changed and can be verified, typically through hashing at acquisition and re-verification later. Chain of custody documents who handled the evidence, while order of volatility guides collection priority rather than preservation of content.

Question 27Digital Forensics Fundamentals

During a live response on a running Windows server, which action best follows the order of volatility?

  1. Export the Security event log to a USB drive
  2. Photograph the server room and label the cables
  3. Capture RAM contents before shutting the machine down Correct answer.
  4. Remove the hard drive and image it in the lab

Explanation

Order of volatility directs investigators to collect the most perishable data first, and system memory is lost the moment power is removed. Disk imaging and log export can occur afterward because those stores persist, so memory capture precedes them.

Question 28Digital Forensics Fundamentals

Which statement best distinguishes a forensic image from a simple file copy?

  1. An image includes deleted and slack space plus verification hashes Correct answer.
  2. A file copy always captures unallocated clusters
  3. A file copy preserves file metadata such as timestamps
  4. An image compresses data so it fits on smaller media

Explanation

A forensic image captures the entire source bit-for-bit, including unallocated space, slack space, and deleted content, and is typically verified with a hash. Ordinary file copies transfer only selected files and omit unallocated areas and verification data.

Question 29Digital Forensics Fundamentals

An examiner is asked to describe the role of a write blocker during acquisition. Which description is accurate?

  1. It repairs file system errors on the source before imaging
  2. It encrypts the acquired image to protect confidentiality
  3. It prevents write commands from reaching the source device Correct answer.
  4. It calculates the hash of the destination image automatically

Explanation

A hardware or software write blocker intercepts and blocks write commands so the source media is not modified during acquisition. Hashing is performed by imaging tools, and encryption protects the resulting image rather than the source.

Question 30Digital Forensics Fundamentals

A case involves a seized smartphone that is powered on and locked. Which consideration most directly affects whether the examiner can acquire application data?

  1. The color profile of the device display
  2. The device's encryption state and lock status Correct answer.
  3. The carrier's billing cycle for the SIM
  4. The physical dimensions of the handset

Explanation

Modern mobile devices use file-based or full-disk encryption tied to the lock state, so whether the device is locked and encrypted determines what acquisition methods can recover. Display settings, SIM billing, and physical size do not affect data accessibility.

Question 31Digital Forensics Fundamentals

An examiner needs to prove that a seized hard drive has not changed since acquisition. Which practice provides the strongest support?

  1. Listing the drive model in the final report
  2. Storing the drive in an antistatic bag
  3. Comparing the acquisition hash against a current hash of the same data on the seized hard drive Correct answer.
  4. Recording the drive's serial number in the case notes

Explanation

A current cryptographic hash of the seized drive, calculated over the same data range as the acquisition hash, checks the original drive's current contents. Matching hashes support that those contents are unchanged. Checking only a working copy would establish the copy's agreement with the acquired data.

Question 32Digital Forensics Fundamentals

Which factor most affects whether a deleted file can be recovered from a magnetic hard drive?

  1. The user account that created the file
  2. The file's original icon assignment
  3. Whether its clusters have been overwritten by new data Correct answer.
  4. The number of folders in the parent directory

Explanation

Deletion typically removes metadata pointers while leaving cluster contents intact, so recovery succeeds only while those clusters remain unallocated and unoverwritten. Icon assignment, directory counts, and creator account do not determine cluster reuse.

Question 33Digital Forensics Fundamentals

An examiner is preparing to testify about conclusions drawn from tool output. Which practice best supports admissibility of that testimony?

  1. Avoiding any mention of tool limitations
  2. Presenting only the findings that support the prosecution
  3. Validating results and documenting the methodology used Correct answer.
  4. Relying on default tool settings without recording them

Explanation

Testimony is strengthened when the examiner can show that the method was validated, reproducible, and fully documented, including tool limitations. Selectively presenting findings or hiding configuration undermines credibility and completeness.

Question 34Digital Forensics Fundamentals

A company wants to collect evidence from a cloud SaaS application where the provider controls the underlying infrastructure. Which approach best addresses the examiner's limitation?

  1. Subpoena the provider's data center floor plan
  2. Image the provider's physical servers directly
  3. Use the provider's export and audit log features Correct answer.
  4. Rely on screenshots taken by an employee

Explanation

In SaaS environments the customer cannot access physical media, so evidence is gathered through provider export tools, audit logs, and API records, with documentation of the request. Physical imaging and infrastructure details are outside the customer's control.

Question 35Digital Forensics Fundamentals

An examiner finds a file whose content begins with a valid header but whose extension is .txt. Which technique best identifies the true file type?

  1. Checking the file's last access timestamp
  2. Comparing the file signature to known magic numbers Correct answer.
  3. Counting the number of lines in the file
  4. Relying on the extension shown in the directory listing

Explanation

File signatures, or magic numbers, at known offsets identify content type independently of the extension, which users can change. Timestamps and line counts do not reliably indicate format.

Question 36Digital Forensics Fundamentals

An examiner is comparing two disk images of the same source taken at different times. Which observation most strongly suggests the source was altered between acquisitions?

  1. The imaging tool version is the same
  2. The file names are identical
  3. The image sizes are both large
  4. The acquisition hashes differ Correct answer.

Explanation

A cryptographic hash changes if even one bit of content changes, so differing hashes between acquisitions of the same source indicate alteration or a different source. Identical names, large sizes, and matching tool versions do not demonstrate content change.

Question 37Digital Forensics Fundamentals

An examiner must document the handling of a seized laptop from seizure to courtroom. Which record is essential for that purpose?

  1. A list of installed antivirus products
  2. A copy of the manufacturer warranty
  3. A chain-of-custody form with signatures and dates Correct answer.
  4. A network diagram of the office

Explanation

A chain-of-custody record tracks every transfer and access with signatures and dates, showing that evidence was continuously accounted for. Warranty, antivirus, and network documents do not establish handling history.

Question 38Digital Forensics Fundamentals

An examiner is analyzing a Windows system and needs to determine which user account was logged on when a specific document was last modified. Which combination of evidence is most probative?

  1. The number of installed printers
  2. The document's file extension and size
  3. File system timestamps correlated with Security log logon events Correct answer.
  4. The desktop wallpaper configured for the machine

Explanation

Attribution requires correlating the file's modification timestamp with logon session records so the active account at that moment can be identified. Extension, size, wallpaper, and printer counts do not tie a specific user to the modification.

Question 39Digital Forensics Fundamentals

An examiner discovers that a suspect used timestomping to make a malicious file appear older. Which approach best tests this hypothesis?

  1. Trusting the $STANDARD_INFORMATION timestamps alone
  2. Comparing $STANDARD_INFORMATION and $FILE_NAME timestamps for anomalies Correct answer.
  3. Reviewing the printer spooler log
  4. Checking the file's extension against its icon

Explanation

Timestomping tools often alter the easily writable $STANDARD_INFORMATION attribute while the $FILE_NAME attribute retains different values, so discrepancies between the two are a strong indicator. Relying on one attribute alone or on unrelated artifacts will miss the manipulation.

Question 40Digital Forensics Fundamentals

During review, an examiner finds that a critical log was stored on a network share that multiple administrators could modify. How should this affect the weight given to that log?

  1. It should be treated as unimpeachable because it is a log
  2. Its evidentiary weight is reduced absent corroboration of integrity Correct answer.
  3. It should be discarded entirely without further review
  4. It becomes more reliable because many people viewed it

Explanation

Logs on shared, writable storage lack a controlled integrity mechanism, so their weight depends on corroboration such as hashes, central log collection, or independent artifacts. Automatic acceptance or blanket rejection both ignore the need to assess reliability.

Question 41Forensic Readiness and Evidence Handling

In a forensic readiness program, what is the primary purpose of establishing a documented chain of custody before an incident occurs?

  1. To guarantee that evidence will be admissible in any jurisdiction worldwide
  2. To prove the identity, sequence, and integrity of custody transfers so evidence can be trusted later Correct answer.
  3. To transfer legal liability for data loss from the organization to the forensic examiner
  4. To allow investigators to skip hashing because custody records replace integrity verification

Explanation

A chain of custody is a chronological record of who handled evidence, when, and under what conditions. Prepared in advance through readiness planning, it lets the organization demonstrate that evidence was not altered from collection through presentation. It supports integrity and authenticity but cannot by itself guarantee admissibility in every jurisdiction.

Question 42Forensic Readiness and Evidence Handling

An analyst collects a volatile memory image from a running server. Which action best preserves the evidentiary value of that image at the moment of capture?

  1. Compressing the image with a proprietary tool to save storage space
  2. Copying the image to a shared network drive before any hashing occurs
  3. Computing a cryptographic hash of the image immediately and recording it in the case notes Correct answer.
  4. Renaming the image file to match the server hostname for easy identification

Explanation

Hashing the acquired image at the time of capture creates a verifiable baseline for later integrity checks. Subsequent comparisons against that hash can show whether the image changed. Compression, renaming, and uncontrolled copying do not establish integrity and can complicate verification.

Question 43Forensic Readiness and Evidence Handling

Which practice best supports forensic readiness through evidence source identification?

  1. Relying on a single centralized firewall log as the only evidence source
  2. Deleting old backups on a fixed schedule without documenting retention decisions
  3. Disabling verbose logging on production systems to reduce storage costs
  4. Maintaining an inventory of log sources, endpoints, and cloud services that could hold relevant data Correct answer.

Explanation

Forensic readiness requires knowing in advance where potential evidence lives so it can be preserved quickly. An inventory of log sources, endpoints, and cloud services maps those locations and their retention. Reducing logging, relying on one source, or deleting backups undocumented undermines that capability.

Question 44Forensic Readiness and Evidence Handling

A company wants to reduce the time between an incident and evidence collection. Which readiness control most directly addresses this goal?

  1. A quarterly review of firewall rule sets
  2. A policy requiring all employees to complete security awareness training
  3. Pre-approved forensic acquisition procedures and pre-staged collection toolkits Correct answer.
  4. An annual penetration test of the external network

Explanation

Pre-approved procedures and pre-staged toolkits let responders begin collection immediately without waiting for approvals or tool provisioning. This directly shortens the interval between detection and acquisition. Penetration tests, awareness training, and firewall reviews improve security but do not streamline evidence collection.

Question 45Forensic Readiness and Evidence Handling

What is the role of a write blocker during forensic acquisition of a storage device?

  1. It prevents any write operation to the source device while allowing reads Correct answer.
  2. It encrypts the acquired image so it cannot be read by unauthorized parties
  3. It authenticates the examiner against the case management system
  4. It compresses the source device to speed up the imaging process

Explanation

A write blocker is a hardware or software control that permits read access to the source while blocking writes. This preserves the original state of the media during acquisition. It does not encrypt, compress, or authenticate the examiner.

Question 46Forensic Readiness and Evidence Handling

During a readiness assessment, an organization finds that endpoint logs are retained for only 24 hours. Why is this a forensic readiness gap?

  1. Short retention prevents the use of write blockers during acquisition
  2. Short retention increases the cost of cloud storage subscriptions
  3. Short retention may destroy evidence before an incident is detected and investigated Correct answer.
  4. Short retention violates the principle of least privilege

Explanation

Forensic readiness depends on evidence still existing when it is needed. If logs are retained for only 24 hours, an incident detected later may have no usable log evidence. Retention length is a readiness decision tied to detection and investigation timelines, not to storage cost, least privilege, or write blocking.

Question 47Forensic Readiness and Evidence Handling

Which element is essential in a chain-of-custody record for a collected USB drive?

  1. The examiner's personal opinion about the suspect's motive
  2. The market value of the USB drive at the time of seizure
  3. The operating system version installed on the examiner's workstation
  4. The date, time, collector identity, and description of the item Correct answer.

Explanation

A chain-of-custody record must identify what was collected, when, and by whom so custody transfers can be traced. Description, date, time, and collector identity are core fields. Motive opinions, item market value, and examiner workstation details do not establish custody.

Question 48Forensic Readiness and Evidence Handling

An organization is drafting a forensic readiness policy. Which statement best reflects a sound evidence preservation principle?

  1. Evidence should be discarded once the initial triage report is written
  2. Evidence should be preserved in its original form and any change documented Correct answer.
  3. Evidence should be stored only on the system where it was collected
  4. Evidence should be modified as needed to make it easier to analyze

Explanation

Preservation requires keeping evidence in its original form and documenting any necessary change. This supports integrity and reproducibility. Modifying evidence for convenience, discarding it after triage, or leaving it on the source system undermines those goals.

Question 49Forensic Readiness and Evidence Handling

A responder needs to collect evidence from a running system where shutdown would destroy volatile data. What is the most appropriate order of operations?

  1. Acquire persistent storage first, then capture volatile data
  2. Reimage the system from backup, then capture volatile data
  3. Shut down the system, then acquire persistent storage
  4. Capture volatile data first, then acquire persistent storage Correct answer.

Explanation

Volatile data such as memory and active connections disappears when a system is shut down or restarted. Capturing volatile state before persistent storage follows the order of volatility. Shutting down or reimaging first would destroy volatile evidence.

Question 50Forensic Readiness and Evidence Handling

Why should a forensic readiness plan include legal counsel and privacy stakeholders during its design?

  1. To reduce the cost of forensic tool licenses
  2. To ensure collection and retention practices comply with applicable law and privacy obligations Correct answer.
  3. To allow examiners to bypass chain-of-custody requirements
  4. To ensure that all employee communications are monitored continuously

Explanation

Forensic readiness intersects with legal and privacy requirements that vary by jurisdiction and data type. Involving counsel and privacy stakeholders ensures collection and retention practices are lawful and defensible. Their involvement does not reduce tool costs, waive custody requirements, or justify blanket monitoring.