Digital Forensic Procedure

Question 1

What are Digital Forensics?

Answer 1

Systematic process of investigating and analyzing digital devices and data to uncover evidence for legal purposes

Question 2

What does the 1st phase of Digital Forensics - Identification do?

Answer 2

Focus on scene safety, prevention of evidence contamination, and scope determination

Question 3

What does the 2nd phase of Digital Forensics - Collection do?

Answer 3

Refers to the process of gathering, preserving, and documenting physical or digital evidence in various fields

Question 4

What is the Order of Volatility?

Answer 4

Dictates the sequence in which data sources should be collected and preserved based on their susceptibility to rapid changes during system operation

Question 5

What is the Order of Volitility?

Answer 5

■ Collect data from the system’s memory
■ Capture data from the system state
■ Collect data from storage devices
■ Capture network traffic and logs
■ Collect remotely stored or archived data

Question 6

What is a Chain of Custody

Answer 6

Documented and verifiable record that tracks the handling, transfer, and preservation of digital evidence from the moment it is collected until it is presented in a court of law

Question 7

What is Disk Imaging? (copying storage device)

Answer 7

Involves creating a bit-by-bit or logical copy of a storage device, preserving its entire content, including deleted files and unallocated space

Question 8

What does File Carving do?

Answer 8

Focuses on extracting files and data fragments from storage media without relying on the file system

Question 9

What does the 3rd phase of Digital Forensics - Analysis do?

Answer 9

Systematically scrutinizing data to uncover relevant information like, timestamps, user interactions, and signs of criminal activity

Question 10

What does the 4th phase of Digital Forensics - Reporting do?

Answer 10

Involves documenting the findings, processes, and methodologies used during a digital forensic investigation in a final report

Question 11

What is a Legal Hold?

Answer 11

Formal notification that instructs employees to preserve potentially relevant electronic data, documents and records

Question 12

What is an E-Discovery (Electronic Discovery)?

Answer 12

Process of identifying, collecting, and presenting electronically stored information for potential legal proceedings