Questions

1. Digital evidence is _______________.

   a. Volatile b. Non-volatile c. Good to have d. Not needed when you have a confession

2. Why would it be a good idea to wipe a drive before reusing it to store evidence?

   a. Chain of custody.b. To make sure it is formatted correctly.c. To ensure no prior data exists on the device.d. It's the examiner's choice (the examiner can decide the course of action).

3. You must use a write blocker on the source device when creating a forensic image.

   a. True b. False

4. Who controls the Forensically Sound Examination Environment?

   a. Suspect b. First responder c. Examiner d. Depends on the situation

5. The examiner must validate all tools before use.

   a. True b. False

6. When creating a forensic image, which is the best option?

   a. Forensic copy b. Forensic image c. Logical forensic image d. Backup copy

7. A dd image can be compressed.

   a. True b. False

The answers can be found at the back of this book, under Assessments. 

...