CHAPTER 1 DIGITAL FORENSIC UPDATED ACTUAL QUESTIONS AND
CORRECT ANSWERS VERIFIED 2027 EDITION
1. What do you call a list of people who have had physical possession of the evidence? Chain of
custody Affidavit Evidence log Evidence record
Chain of custody
2. T or F Embezzlement is a type of digital investigation typically conducted in a business
environment.
True
3. T or F You shouldn't include a narrative of what steps you took in your case report
False
4. What's the purpose of an affidavit? To specify who, what, when, and where—that is, specifics on
place, time, items being searched for, and so forth. To list problems that might happen when
conducting an investigation. To provide facts in support of evidence of a crime to submit to a judge
when requesting a search warrant. To determine the OS of the suspect computer and list the software
needed for the examination.
To provide facts in support of evidence of a crime to submit to a judge when requesting a search warrant
5. T or F Under normal circumstances, a private-sector investigator is considered an agent of law
enforcement.
False
6. Why should evidence media be write-protected? To make image files smaller in size To make sure
data isn't altered To comply with Industry standards To speed up the imaging process
To make sure data isn't altered
7. List three items that should be on an evidence custody form.
Case number, name of the investigator and nature of the case
8. Policies can address rules for which of the following? When you can log on to a company network
from home The amount of personal e-mail you can send The Internet sites you can or can't access Any
of the above
Any of the above
9. A warning banner should never state that the organization has the right to monitor what users do.
False
10. What is one of the necessary components of a search warrant?
Signature of an impartial judicial officer
11. T or F You should always prove the allegations made by the person who hired you.
False
12. Why should you do a standard risk assessment to prepare for an investigation?
To list problems that might happen when conducting an investigation
13. Digital forensics and data recovery refer to the same activities.
False
1
CORRECT ANSWERS VERIFIED 2027 EDITION
1. What do you call a list of people who have had physical possession of the evidence? Chain of
custody Affidavit Evidence log Evidence record
Chain of custody
2. T or F Embezzlement is a type of digital investigation typically conducted in a business
environment.
True
3. T or F You shouldn't include a narrative of what steps you took in your case report
False
4. What's the purpose of an affidavit? To specify who, what, when, and where—that is, specifics on
place, time, items being searched for, and so forth. To list problems that might happen when
conducting an investigation. To provide facts in support of evidence of a crime to submit to a judge
when requesting a search warrant. To determine the OS of the suspect computer and list the software
needed for the examination.
To provide facts in support of evidence of a crime to submit to a judge when requesting a search warrant
5. T or F Under normal circumstances, a private-sector investigator is considered an agent of law
enforcement.
False
6. Why should evidence media be write-protected? To make image files smaller in size To make sure
data isn't altered To comply with Industry standards To speed up the imaging process
To make sure data isn't altered
7. List three items that should be on an evidence custody form.
Case number, name of the investigator and nature of the case
8. Policies can address rules for which of the following? When you can log on to a company network
from home The amount of personal e-mail you can send The Internet sites you can or can't access Any
of the above
Any of the above
9. A warning banner should never state that the organization has the right to monitor what users do.
False
10. What is one of the necessary components of a search warrant?
Signature of an impartial judicial officer
11. T or F You should always prove the allegations made by the person who hired you.
False
12. Why should you do a standard risk assessment to prepare for an investigation?
To list problems that might happen when conducting an investigation
13. Digital forensics and data recovery refer to the same activities.
False
1
