2. Acquisition and Analysis

Any Digital Forensic examination should only be carried out by properly qualified and experienced Digital Forensic examiners in carefully controlled conditions.

• True

• False

A Digital Forensic examiner will be expected to hold at least which two of the following:

• Certified Forensic Investigation Practitioner — Industry certification

• Degree in Digital Forensics — university course

• Level 2 certificate in digital forensics — online course

• Basic certificate in digital forensics — college course

Which two of the following show why it is important to conduct an investigation on a copy of the data instead of the original

• To allow other investigators to work on the data to speed up the investigation

• To allow the investigation to be replicated

• some tools will only work on copied data

• To prevent any aspect of the investigation from tampering with the original evidence

What is being used in the image shown to preserve the digital evidence?

• Faraday bag

• Evidence bag

• Plastic bag

• Nearaweek bag

Devices that appear to have been destroyed, may allow some data to be extracted using a process known as:

• File Carving

• Data Restore

• Ctrl Alt Delete technique

• Software Align

Which of the following is the correct order of the Digital Forensic examination process?

• 
• 
• 
• 

Why must a chain of custody be maintained?

• A court case could be thrown out of court

• To ensure that police officers are completing their paperwork

• So that the device can be returned to its rightful owner

• To prove who the device belongs to

The first step in making sense of the evidence is to put the evidence in the order in which it was first created and last modified. This is known as:

• A timeline

• A chain of evidence

• Software analysis

• A report

In Scotland, it is the ??? who decides if there is sufficient evidence to proceed to a court trial.

• Procurator Fiscal

• Lead investigator

• Police Constable

• Judge

Which three of the following statement s describes forensic readiness?

• How prepared a digital forensic investigator is to present their evidence in a court of law

• How easy it is for the digital forensic investigator to find evidence which proves that someone is guilty

• A machine which has been imaged for the forensic purposes

• How prepared an organisation is to respond to an incident