1|Page
D431 DIGITAL FORENSICS ACTUAL EXAM
120 QUESTIONS AND VERIFIED ANSWERS
2024. A+ GRADE
1. The process of acquiring and analyzing information stored on physical
storage media, such as computer hard drives, smartphones, GPS systems, and
removable media.
Includes both the recovery of hidden and deleted information and the process
of identifying who created a file or message.: Disk Forensics
2. The study of the source and content of email as evidence, including the
identification of the sender, recipient, date, time, and origination location of an
email message.: Email Forensics
3. The process of examining network traffic, including transaction logs and
real-time monitoring using sniffers and tracing.: Network Forensics
4. Is the process of piecing together where and when a user has been on the
internet.
For example, you can use internet forensics to determine whether inappropriate
internet content access and downloading were accidental.: Internet Forensics
,5. Also known as malware forensics, is the process of examining malicious
computer code: Software Forensics
6. The process of searching memory in real time, typically for working with
compromised hosts or to identify system abuse.: Live system forensics
7. Is the process of searching the contents of cell phones. A few years ago,
this was just not a big issue, but with the ubiquitous nature of cell phones
today, cell-phone forensics is a very important topic.
A cell phone can be a treasure trove of evidence. Modern cell phones are
essentially computers with processors, memory, even hard drives and operating
systems, and they operate on networks.
Phone forensics also includes voip and traditional phones and may overlap the
Foreign Intelligence S: Cell-Phone Forensics
8. From the time the evidence is first seized by a law enforcement officer or
civilian investigator until the moment it is shown in court, the whereabouts
and custody of the evidence, and how it was handled and stored and by
whom, must be able to be shown at all times. Failure to maintain the
________________________ can lead to evidence being excluded from trial.:
Chain of Custody
9. One very important principle is to touch the system as little as possible.
, 3|Page
It is possible to make changes to the system in the process of examining it,
which is very undesirable. Obviously, you have to interact with the system to
investigate it.
The answer is to make a forensic copy and work with that copy.
You can make a forensic copy with most major forensic tools such as
accessdata's Forensic Toolkit, Guidance Software's encase, or passmark's
osforensics. There are also open source soft: Don't Touch the Suspect Drive 10.
The next issue is documentation. The rule is that you document everything.
Who was present when the device was seized?
What was connected to the device or showing on the screen when you seized it?
What specific tools and techniques did you use?
Who had access to the evidence from the time of seizure until the time of trial?
All of this must be documented. And when in doubt, err on the side of over-
documentation. It really is not possible to document too much information
about an invest: Document trail
11. It is absolutely critical to the integrity of your investigation as well as to
maintaining the chain of custody that you secure the evidence. It is common to
have the forensic lab be a locked room with access given only to those who
must enter.
D431 DIGITAL FORENSICS ACTUAL EXAM
120 QUESTIONS AND VERIFIED ANSWERS
2024. A+ GRADE
1. The process of acquiring and analyzing information stored on physical
storage media, such as computer hard drives, smartphones, GPS systems, and
removable media.
Includes both the recovery of hidden and deleted information and the process
of identifying who created a file or message.: Disk Forensics
2. The study of the source and content of email as evidence, including the
identification of the sender, recipient, date, time, and origination location of an
email message.: Email Forensics
3. The process of examining network traffic, including transaction logs and
real-time monitoring using sniffers and tracing.: Network Forensics
4. Is the process of piecing together where and when a user has been on the
internet.
For example, you can use internet forensics to determine whether inappropriate
internet content access and downloading were accidental.: Internet Forensics
,5. Also known as malware forensics, is the process of examining malicious
computer code: Software Forensics
6. The process of searching memory in real time, typically for working with
compromised hosts or to identify system abuse.: Live system forensics
7. Is the process of searching the contents of cell phones. A few years ago,
this was just not a big issue, but with the ubiquitous nature of cell phones
today, cell-phone forensics is a very important topic.
A cell phone can be a treasure trove of evidence. Modern cell phones are
essentially computers with processors, memory, even hard drives and operating
systems, and they operate on networks.
Phone forensics also includes voip and traditional phones and may overlap the
Foreign Intelligence S: Cell-Phone Forensics
8. From the time the evidence is first seized by a law enforcement officer or
civilian investigator until the moment it is shown in court, the whereabouts
and custody of the evidence, and how it was handled and stored and by
whom, must be able to be shown at all times. Failure to maintain the
________________________ can lead to evidence being excluded from trial.:
Chain of Custody
9. One very important principle is to touch the system as little as possible.
, 3|Page
It is possible to make changes to the system in the process of examining it,
which is very undesirable. Obviously, you have to interact with the system to
investigate it.
The answer is to make a forensic copy and work with that copy.
You can make a forensic copy with most major forensic tools such as
accessdata's Forensic Toolkit, Guidance Software's encase, or passmark's
osforensics. There are also open source soft: Don't Touch the Suspect Drive 10.
The next issue is documentation. The rule is that you document everything.
Who was present when the device was seized?
What was connected to the device or showing on the screen when you seized it?
What specific tools and techniques did you use?
Who had access to the evidence from the time of seizure until the time of trial?
All of this must be documented. And when in doubt, err on the side of over-
documentation. It really is not possible to document too much information
about an invest: Document trail
11. It is absolutely critical to the integrity of your investigation as well as to
maintaining the chain of custody that you secure the evidence. It is common to
have the forensic lab be a locked room with access given only to those who
must enter.
