Digital Forensics

1. A company's legal team determines that litigation is likely and instructs the IT department to preserve all email and documents related to a specific project. What is this directive called, who initiates it, and what obligation does it create for data custodians?

A. Forensic hold — initiated by the IT security team; requires evidence to be encrypted B. Legal hold — initiated by legal counsel; creates an ongoing obligation for custodians to preserve all relevant ESI and stop any deletion or modification until the hold is lifted C. Evidence hold — initiated by law enforcement; requires evidence to be submitted to authorities within 24 hours D. Retention hold — initiated by compliance; automatically applied based on data classification

2. A forensic analyst images a hard drive, computes a SHA-256 hash of the image, performs analysis, and then recomputes the hash. The hash values match. What does this confirm, and why is it critical for legal proceedings?

A. The drive was not encrypted and all files were readable during analysis B. The disk image was not modified during analysis — the hash proves integrity and establishes that evidence was not tampered with, which is required for chain of custody C. The drive contained no malware, since hash values confirm file authenticity D. The forensic software functioned correctly and no tool errors occurred during imaging

3. A forensic investigator arrives at a scene and must collect evidence from a running workstation suspected of compromise. Ordering from most urgent to collect first: RAM, disk image, browser history, firmware. What is the correct collection order, and why?

A. Disk image first, then RAM, then firmware, then browser history — disk contains the most complete evidence B. RAM first, then firmware, then disk image, then browser history — evidence must be collected from most volatile to least volatile to prevent loss C. Browser history first as it is most easily destroyed, then RAM, then disk, then firmware D. Order does not matter as long as all items are collected before the investigation closes

4. A forensic investigator discovers a laptop that is running with full-disk encryption enabled. It is currently powered on and the user session is active (drive is decrypted in memory). An inexperienced responder powers off the laptop to transport it safely. What evidence was lost, and what should have been done instead?

A. Nothing was lost; disk encryption does not affect forensic imaging since modern tools bypass encryption automatically B. RAM contents (running processes, decryption keys in memory, active network connections) were permanently lost; the disk image will now be encrypted and unreadable. Live collection of RAM should have occurred before powering off. C. Only the browser history was lost; disk images are unaffected by encryption on modern hardware D. The firmware was corrupted; UEFI stores decryption keys that are wiped on power loss

5. A forensic analyst receives an image of a suspect mobile phone and begins analysis directly from the original device image without making a working copy. What preservation principle was violated, and what is the risk?

A. No principle was violated; working directly from the original is acceptable when the device is in airplane mode B. The principle of working from copies was violated; any tool malfunction, analysis error, or accidental write operation could modify the original evidence, making it inadmissible and destroying the only copy C. The RFC 3227 collection order was violated; phones must be collected last because they are least volatile D. The chain of custody was broken because the analyst did not label the device before beginning

6. A legal team requests that the security department collect all emails, spreadsheets, and project management records relevant to a contract dispute and make them available for attorney review. No investigation into how the dispute occurred is required. What process is this, and how does it differ from digital forensics?

A. Digital forensics — reconstructing events from electronic evidence is always a forensic process B. E-discovery — collecting and producing ESI for legal review without requiring forensic analysis of how events occurred; differs from forensics in purpose (document production vs. event reconstruction) C. Legal hold — the obligation to preserve data that has not yet been collected for review D. Evidence seizure — the law enforcement process for taking custody of evidence

Matching: Forensic Concepts

Match each concept (1–4) to its correct description (A–D).

1Chain of custody

2RAM acquisition

3Write blocker

4Forensic report conclusion

AHardware device placed between an evidence drive and a forensic workstation that prevents any data from being written to the evidence drive during imaging

BThe documented, unbroken record of every person who handled evidence, every location it was stored, and every action taken on it from collection through legal proceedings

CThe section of a forensic report that synthesizes all findings and states what they indicate about the incident, who likely performed actions, and when; must acknowledge uncertainty

DThe most volatile acquisition type; must be performed on a live running system; captures running processes, injected code, encryption keys, and active network connections that are lost on reboot

Digital Forensics — Quiz