Forensics and Evidence Collection Quiz

What you'll be asked

1. In the context of digital forensics, what is the primary purpose of maintaining a 'Chain of Custody'?
2. When collecting digital evidence from a live system, which of the following should be collected FIRST according to the Order of Volatility?
3. Why is it standard practice to create a cryptographic hash (e.g., SHA-256) of a disk image immediately after acquisition?
4. You are performing a forensic investigation and need to analyze a hard drive. What is the most important tool to use when connecting the suspect drive to your forensic workstation?
5. During a memory dump analysis, you discover a suspicious process residing in a memory address space that is not associated with any loaded executable file on the disk. This is a primary indicator of what type of malicious activity?

Answers and explanations come after you submit.