Forensics and Evidence Collection Quiz

What you'll be asked

1. Which of the following is the primary goal of the 'Order of Volatility' when collecting digital evidence?
2. When performing a forensic image of a hard drive, why is it critical to calculate a cryptographic hash (e.g., SHA-256) of the original drive and the resulting image?
3. You are documenting the chain of custody for a seized laptop. What information is LEAST important to include in the log?
4. In a live memory acquisition scenario, why is it generally preferred to use a tool that runs from an external, trusted drive rather than installing software on the target system?
5. A forensic analyst is examining a server and discovers that the system time is offset by 15 minutes compared to the actual time. What is the most critical step the analyst must take during documentation?

Answers and explanations come after you submit.