Digital Evidence Collection

What is the main role of the Digital Forensics Team during incident response?

• Collect and analyze digital media

• Analyze network cables

• Create a diagram of the scene

• Identify evidence items using numbered placards

What should be done when encountering a computer that is turned on?

• Dump the RAM

• Turn it off immediately

• Remove the battery from laptops

• Leave it on

What is the purpose of maintaining the Chain of Custody in digital forensics?

• To ensure evidence is accounted for at all times

• To modify evidence

• To delete evidence

• To analyze original media

What should be done with evidence items after they are collected?

• Analyze them immediately

• Discard them

• Turn them into an evidence storage room

• Keep them in the field

What is the recommended approach for evidence acquisition in digital forensics?

• Ignore the evidence

• Analyze the original media

• Work with a forensic copy

• Create multiple copies

Which tool is commonly used for computer-based acquisition and analysis in digital forensics?

• Cellebrite

• MSAB XRY

• EnCase

• Oxygen

What is the purpose of Chain of Custody in digital forensics?

• To modify evidence

• To ensure evidence is accounted for at all times

• To delete evidence

• To analyze original media

Which step should be taken first when collecting evidence from a crime scene?

• Analyze the evidence on-site

• Document the evidence location

• Collect all evidence items

• Inform the authorities

Why is it important to maintain the integrity of digital evidence?

• To manipulate the evidence

• To ensure admissibility in court

• To speed up the investigation

• To share evidence with the public

What is the purpose of documenting the chain of custody in digital forensics?

• To track the movement of evidence

• To delete evidence

• To analyze original media

• To modify evidence