Free Certified Digital Forensics Examiner Practice Questions

Sample Practice Questions

Try these 10 sample questions from the Certified Digital Forensics Examiner practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1An examiner is tracing the development of international standards for computer evidence. Which organization resulted from the series of law enforcement conferences that began in 1993?

   1. A.Scientific Working Group on Digital Evidence
   2. B.International Organization on Computer EvidenceCorrect answer: B
   3. C.Computer Analysis and Response Team
   4. D.National Institute of Standards and Technology

   Explanation: The FBI historical account states: "This conference again convened in Baltimore, Maryland, in 1995, Australia in 1996, and the Netherlands in 1997, and ultimately resulted in the formation of the International Organization on Computer Evidence." It separately describes SWGDE as addressing similar issues among federal agencies and CART as an FBI computer analysis team.

   Reference: Recovering and Examining Computer Forensic Evidence — Background

2. 2Before collecting volatile data, an examiner prepares a forensic toolkit. Which recorded value supports a later check that a toolkit executable has not changed?

   1. A.Its computed message digestCorrect answer: A
   2. B.Its software version identifier
   3. C.Its execution command line
   4. D.Its installed library inventory

   Explanation: NIST recommends: "The message digest of each tool should be computed and stored safely to verify file integrity." The digest can be compared with a later digest of the executable.

   Reference: Guide to Integrating Forensic Techniques into Incident Response — Section 5.2.1.1, Forensic Tool Preparation, p. 5-5

3. 3An examiner is planning evidence collection from a running host. Which item is an example of volatile operating-system data that can be lost when the host is powered down?

   1. A.Active network connection tableCorrect answer: A
   2. B.Filesystem configuration files
   3. C.Operating-system event logs
   4. D.Filesystem directory entries

   Explanation: NIST explains that "Volatile data refers to data on a live system that is lost after a computer is powered down, such as the current network connections to and from the system." The other options describe data stored in a filesystem.

   Reference: Guide to Integrating Forensic Techniques into Incident Response — Section 5.1, OS Basics, p. 5-1

4. 4An examiner acquires a powered-off storage device as a complete bitstream, including slack space that may contain deleted data. Which acquisition type describes this copy?

   1. A.Logical acquisition
   2. B.Targeted acquisition
   3. C.Physical acquisitionCorrect answer: C
   4. D.File-system acquisition

   Explanation: SWGDE states: "A physical acquisition is a bitstream duplicate of data contained on a device including slack space potentially containing deleted data." The described copy matches that definition.

   Reference: Best Practices for Computer Forensic Acquisition — Section 7.1, Physical

5. 5During a live memory acquisition, the running system changes data while it is being copied, leaving inconsistencies in the acquired image. What is this condition called?

   1. A.Data remanence
   2. B.Memory smearCorrect answer: B
   3. C.Media contamination
   4. D.File fragmentation

   Explanation: SWGDE explains that acquisition time can create “smear”, "where data is modified by the running system during the acquisition process creating inconsistencies in the acquired data." The changed data during capture is memory smear.

   Reference: Best Practices for Computer Forensic Acquisition — Section 7.3.2, Live Memory

6. 6An examiner reviews a shell-history entry for a command entered through an alias. Under the shell-history behavior described in SWGDE's technical guidance, which text is recorded?

   1. A.The alias as enteredCorrect answer: A
   2. B.The expanded command
   3. C.The absolute executable path
   4. D.The command's output text

   Explanation: SWGDE cautions: "the alias (not the actual command aliased) is recorded in the shell’s history file." The examiner may need the alias definition to interpret the executed command.

   Reference: Linux Tech Notes — Section 7.12.5, Aliased Commands

7. 7An examiner investigates disk-resident material used by an operating system to extend available memory by exchanging pages with RAM. What type of file is this?

   1. A.A swap fileCorrect answer: A
   2. B.An audit log file
   3. C.A filesystem journal
   4. D.A hibernation file

   Explanation: NIST states that "Most OSs use swap files in conjunction with RAM to provide temporary storage for data often used by applications" and describes "allowing pages (or segments) of data to be swapped in and out of RAM." These files can contain application and operating-system information.

   Reference: Guide to Integrating Forensic Techniques into Incident Response — Section 5.1.1, OS Data Sources, p. 5-2, Swap Files

8. 8An examiner notices that a file's internal header indicates a graphic format while the filename has a non-graphic extension. What is this mismatch called?

   1. A.File signature anomalyCorrect answer: A
   2. B.Hash collision
   3. C.File fragmentation
   4. D.File slack

   Explanation: NIST defines a file signature anomaly as "A mismatch between the internal file header and its external file name extension". The scenario describes that mismatch; it does not by itself establish intent.

   Reference: NIST Computer Security Resource Center Glossary: File Signature Anomaly — Definitions

9. 9During electronic discovery, a practitioner extracts collected electronically stored information and converts it into a form suitable for review and analysis. Which activity in ISO/IEC 27050-1 describes this work?

   1. A.ESI identification
   2. B.ESI preservation
   3. C.ESI processingCorrect answer: C
   4. D.ESI production

   Explanation: The ISO glossary describes ESI processing as extracting information and "converting it, if necessary, to forms more suitable for ESI review (3.16) and ESI analysis (3.10)". The practitioner is preparing the information for review and analysis.

   Reference: ISO/IEC JTC 1/SC 27 Glossary of IT Security Terminology — Glossary entry: ESI processing

10. 10In a federal proceeding, an examiner offers a duplicate to prove the content of a recording. Under Federal Rule of Evidence 1003, which circumstance can prevent the duplicate from being admissible to the same extent as the original?

    1. A.A genuine question is raised about the original's authenticityCorrect answer: A
    2. B.The original cannot be obtained through available judicial process
    3. C.The original was lost or destroyed without bad faith by its proponent
    4. D.The original is controlled by an opposing party who fails to produce it

    Explanation: Rule 1003 states: "A duplicate is admissible to the same extent as the original unless a genuine question is raised about the original’s authenticity or the circumstances make it unfair to admit the duplicate." The question concerns the first stated exception to equal admissibility.

    Reference: Federal Rules of Evidence — Rule 1003, p. 27