Sample questions
Bt Digital Forensics FundamentalsDifficulty 1
What is digital forensics fundamentally concerned with?
- aIdentifying, preserving, analyzing, and presenting digital evidence in a way that its integrity can be verified and it can withstand scrutiny.✓
- bRemoving all traces of an intrusion from a system as fast as possible so operations can resume.
- cEncrypting sensitive files so that only authorized investigators can ever open them.
- dA penetration-testing technique used to gain access to a system before an incident occurs, focused on exploiting weaknesses rather than examining evidence afterward.
Explanation:Digital forensics is about identifying, preserving, analyzing, and presenting evidence while keeping its integrity intact — it is not about post-incident cleanup, encrypting files, or offensive testing.
Bt Digital Forensics FundamentalsDifficulty 1
What does 'chain of custody' refer to in an investigation?
- aA legal requirement that evidence only ever be stored on removable media, regardless of how its custody is otherwise documented.
- bA checklist confirming that antivirus signatures on the evidence system are up to date.
- cThe order in which an analyst escalates an alert to management during triage, documented separately from any evidence-related records.
- dA documented, unbroken record of who handled a piece of evidence, when, and what was done to it, from collection to presentation.✓
Explanation:Chain of custody is the unbroken, documented record of everyone who handled a piece of evidence and what was done to it, which is what allows its integrity to be verified later.
Bt Digital Forensics FundamentalsDifficulty 1
Why does a broken or incomplete chain of custody weaken a forensic case?
- aBecause it means the evidence was collected using an outdated tool.
- bBecause unexplained gaps in who handled the evidence let opposing parties argue it may have been altered, making it less reliable or inadmissible.✓
- cBecause it means the analyst needs to redo the entire investigation from scratch, discarding all findings gathered up to that point regardless of whether they were independently obtained.
- dBecause it automatically proves the evidence is fake.
Explanation:A gap in custody documentation does not prove tampering happened, but it removes the ability to rule it out, which is exactly what an opposing party can use to challenge the evidence's reliability.
Bt Digital Forensics FundamentalsDifficulty 1
In the context of evidence collection, what does 'volatility' refer to?
- aHow dangerous a piece of malware is to the organization's network, independent of how quickly any related data might be lost.
- bHow difficult a piece of evidence is to encrypt during transport, rather than how quickly it might disappear if left uncaptured.
- cHow many analysts are required to sign off before evidence can be examined.
- dHow quickly a piece of data will be lost or overwritten if nothing is done to capture it.✓
Explanation:Volatility describes how quickly evidence disappears without intervention — RAM contents vanish on power loss, while disk data persists much longer, which is why volatile data is prioritized for early collection.
Bt Digital Forensics FundamentalsDifficulty 2
Per the general order of volatility, which should typically be captured first when both are within scope: RAM or a full disk image?
- aNeither matters, since both contain exactly the same information at any given moment.
- bThe disk image, because RAM contents are automatically preserved by the operating system after a crash.
- cRAM, because its contents disappear as soon as the system loses power, unlike data already written to disk.✓
- dThe disk image, because RAM cannot legally be used as evidence in most jurisdictions, and only persistent storage is considered valid for any subsequent legal proceeding.
Explanation:RAM is far more volatile than disk data: its contents are lost the moment power is removed, so it is generally prioritized for capture ahead of a disk image when both are in scope.
Bt Digital Forensics FundamentalsDifficulty 2
An analyst arrives at a workstation that is still powered on and believed to be compromised. What is the most appropriate immediate action?
- aAssess the situation and, if volatile data is within scope, capture memory and other volatile artifacts before considering how to power the system down.✓
- bImmediately pull the power cable to stop any further damage to the system.
- cLog in as the affected user and browse the file system to look for anything suspicious.
- dPerform a normal operating system shutdown so the system closes all applications cleanly, on the assumption that a graceful shutdown poses no risk to any potentially recoverable evidence.
Explanation:Pulling the plug or shutting down immediately loses volatile evidence and can trigger anti-forensic cleanup; a normal shutdown can also run scripts that destroy evidence. Assessing the situation and capturing volatile data first follows the order of volatility.