What is the primary purpose of creating a forensic image of a digital device?
Correct!
Wrong!
A forensic image is an exact, bit-by-bit copy of a digital device used to preserve original evidence while allowing analysis on a duplicate.
What is the correct order of volatility when collecting digital evidence?
Correct!
Wrong!
The order of volatility refers to the order in which data should be collected based on how quickly it is lost.
Which tool is commonly used to create a verified forensic image?
Correct!
Wrong!
FTK Imager is widely used to create forensic images and verify their integrity using cryptographic hashes.
What does the hash value of a forensic image ensure?
Correct!
Wrong!
A hash value (e.g., MD5, SHA-1) acts as a digital fingerprint to confirm that a forensic image has not been altered.
Why is write-blocking important during digital evidence collection?
Correct!
Wrong!
A write blocker prevents any changes to the original evidence device, preserving the integrity of the data.
What is the purpose of maintaining a chain of custody form?
Correct!
Wrong!
A chain of custody form documents who handled the evidence and when, maintaining its admissibility in court.