Chapitre 18
Investigations
et forensics

What is the PRIMARY purpose of maintaining a chain of custody?

1. To speed up the investigation
2. To document evidence handling continuously so its integrity can be proven
3. To encrypt the evidence
4. To reduce storage costs

A responder wants to seize a running computer. According to the order of volatility, what should be collected FIRST?

1. The hard drive image
2. The contents of RAM and CPU registers/cache
3. Backup tapes
4. Remote log archives

Why should an investigator NOT simply unplug a suspect machine immediately?

1. It voids the warranty
2. It destroys volatile evidence such as RAM contents and active connections
3. It corrupts the hard drive
4. It alerts the attacker by email

Which device prevents any writes to a source disk during imaging?

1. A firewall
2. A write blocker
3. A load balancer
4. A degausser

How does an investigator prove that a forensic image is identical to the original?

1. By comparing file names
2. By hashing both and confirming the hashes match
3. By checking the file sizes only
4. By encrypting the copy

Which type of forensic copy is required for evidentiary purposes?

1. A simple file copy
2. A bit-for-bit image
3. A compressed archive
4. A screenshot of the folder

Which three qualities must evidence have to be admissible?

1. Fast, cheap, and large
2. Relevant, material, and competent
3. Encrypted, compressed, and signed
4. Public, private, and shared

Evidence that was obtained illegally, without a warrant, is likely to fail which admissibility requirement?

1. Relevance
2. Materiality
3. Competence (reliability / lawful acquisition)
4. Volatility

What does the best evidence rule require?

1. The most expensive evidence
2. The original document rather than a copy, when available
3. The newest evidence
4. Only testimonial evidence

Automatically generated system logs are generally admissible despite the hearsay rule because of which exception?

1. The best evidence exception
2. The business records exception
3. The demonstrative exception
4. The chain of custody exception

A seized hard drive is what type of evidence?

1. Testimonial
2. Real (physical)
3. Demonstrative
4. Hearsay

A diagram created to help a jury visualize an attack is what type of evidence?

1. Real
2. Documentary
3. Demonstrative
4. Testimonial

Which forensic discipline analyzes captured RAM to find in-memory malware and keys?

1. Media analysis
2. Memory forensics
3. Network forensics
4. Mobile forensics

What is the difference between flow and full packet capture in network forensics?

1. Flow captures full content; full packet capture only metadata
2. Flow captures metadata; full packet capture records complete content
3. They are identical
4. Neither can be used as evidence

What is the FIRST stage of the EDRM eDiscovery model?

1. Production
2. Identification
3. Presentation
4. Review

Which EDRM stage corresponds to placing data under legal hold to prevent destruction?

1. Preservation
2. Analysis
3. Production
4. Presentation

What happens to control of an investigation when law enforcement is involved?

1. The organization gains full control
2. The organization often loses control of timing and confidentiality
3. Nothing changes
4. The investigation becomes secret to everyone including courts

If a case may lead to criminal prosecution, when should the strictest evidence standards be applied?

1. Only after the police are called
2. From the very start of evidence collection
3. Only if the suspect confesses
4. After the report is written

A break in the chain of custody most directly results in what?

1. Faster processing
2. Evidence being challenged or ruled inadmissible
3. Stronger encryption
4. Automatic conviction

Which principle guides handling of a digital crime scene?

1. Modify the original freely to speed analysis
2. Minimize interference and work on copies, preserving the original
3. Delete irrelevant files first
4. Reboot the system to clear malware

Which is the correct order of volatility from most to least volatile?

1. Disk, RAM, registers, archives
2. Registers/cache, RAM, swap, disk, remote logs, archives
3. Archives, disk, RAM, registers
4. RAM, registers, archives, disk

A witness's spoken account of events is what type of evidence?

1. Real
2. Documentary
3. Testimonial
4. Demonstrative

What distinguishes an interview from an interrogation?

1. An interview gathers information cooperatively; an interrogation is a more formal questioning of a suspect
2. They are identical
3. An interrogation is always illegal
4. An interview requires a warrant

Which analysis technique seeks the underlying cause of an incident rather than its symptoms?

1. Root cause analysis
2. Best evidence rule
3. Chain of custody
4. Fuzzing

Who should make the decision to involve law enforcement in a security incident?

1. The first technician on site
2. Management, weighing the loss of control and publicity
3. Any employee
4. The suspect