Chapter 5 — Quiz
14 questions: 10 multiple choice, 2 true/false, 2 short answer. Answers and a scoring band are at the bottom — work the whole set before you look.
Multiple choice
Q1. This book frames the forensic process in four phases. In order, they are: - A) Analysis → identification → reporting → preservation - B) Identification → preservation → analysis → reporting - C) Preservation → identification → analysis → reporting - D) Reporting → analysis → preservation → identification
Q2. In the chapter's process diagram, what runs underneath all four phases as a continuous activity rather than a separate stage? - A) Hashing - B) Write-blocking - C) Documentation / the audit trail - D) Legal authorization
Q3. Why is plugging a suspect NTFS drive into a running Windows machine "to take a quick look" the cardinal sin? - A) Windows is too slow to read forensic images - B) The OS writes to the drive on its own — journal updates, timestamp changes, indexing — altering the evidence before you click anything - C) Windows cannot read NTFS without reformatting - D) It voids the drive's warranty
Q4. A forensic image differs from an ordinary backup because it captures: - A) Only the allocated files, but compressed - B) Only the partition table and boot sector - C) Every sector of the device — including unallocated space, slack, and hidden regions — not just the files the file system admits to - D) A list of file names and their sizes
Q5. The primary reason a hardware write-blocker is preferred over a software one for evidence is that it: - A) Images significantly faster - B) Enforces read-only in the data path independent of the host OS, and specific models are independently tested by NIST's CFTT program - C) Computes SHA-256 automatically - D) Is cheaper than a software license
Q6. MD5, SHA-1, and SHA-256 produce digests of, respectively: - A) 64, 128, and 256 bits - B) 128, 160, and 256 bits - C) 256, 384, and 512 bits - D) 32, 40, and 64 bits
Q7. Modern acquisitions compute MD5 and SHA-256 (or use SHA-256) mainly because: - A) MD5 is fully collision-resistant - B) Courts will not accept SHA-256 alone - C) A crafted collision requires controlling both inputs in advance, and no one has produced a single input that collides under two different algorithms at once — so dual-hashing closes the cross-examination - D) MD5 is faster than copying the drive
Q8. A matching acquisition hash proves: - A) Who created the data and when - B) That the device belonged to the suspect - C) Integrity — the bits did not change between two points in time — and nothing more - D) That the suspect is guilty
Q9. A chain of custody primarily proves: - A) That the bits are mathematically unchanged - B) That the handling was sound — who had the evidence, when, and what they did, with no unexplained gaps - C) That the drive was encrypted - D) That the warrant was valid
Q10. A warrant authorizes a search for evidence of financial fraud. Mid-examination you encounter apparent evidence of a different crime. The disciplined response is to: - A) Keep searching the new area to be sure before reporting - B) Stop, do not expand the search, document precisely what you saw and how, and obtain expanded authorization before continuing - C) Delete the unrelated material to avoid scope problems - D) Finish the fraud search and quietly note the rest in your personal file
True/False
Q11. Because a hash will match only if the bits are identical, a matching hash also proves who authored the file and that it belonged to the device's owner. (True / False)
Q12. On a machine that arrives powered on, you should decide what to do about volatile data (RAM, running state, encryption keys) before you decide about the power cord. (True / False)
Short answer
Q13. Name the four phases of the forensic process and, in one short clause each, say what each accomplishes.
Q14. The chapter says "the method that convicts the guilty is the method that clears the innocent." Explain, in one or two sentences, the examiner's duty that this captures, and why an examiner who reports only the half that helps the client is "not an examiner."
---
Answer key
Q1 — B. Identification (find every source of data), preservation (protect the original from alteration), analysis (examine the protected copy), reporting (explain the findings). Other frameworks rename them — NIST 800-86 says collection → examination → analysis → reporting — but the arc is identical.
Q2 — C. Documentation is not a fifth phase; the audit trail runs the full length of the process. ACPO Principle 3: an independent third party should be able to examine your processes and reach the same result.
Q3 — B. Windows writes to a disk simply by mounting it — $LogFile` journal updates, `System Volume Information`/`$RECYCLE.BIN creation, thumbnail caches, and last-access timestamp changes — altering the MFT, the journal, and the very timestamps and unallocated space that hold the answers, all before you consciously do anything. The defense is hardware that makes writing physically impossible.
Q4 — C. A backup (or any file copy) follows file-system pointers and captures only allocated files; a forensic image copies every sector in order regardless of what points to it, so it preserves unallocated space (where deleted data persists), file slack, partition gaps, and hidden HPA/DCO regions — exactly where evidence lives.
Q5 — B. Hardware blocking sits in the data path and is enforced independently of any OS setting you might forget, and CFTT-tested models give you the independent validation Daubert asks for. Speed and price are not the legal reason; the imaging software, not the blocker, computes hashes.
Q6 — B. MD5 = 128 bits (32 hex characters), SHA-1 = 160 bits (40 hex), SHA-256 = 256 bits (64 hex).
Q7 — C. A crafted collision requires an attacker to control both inputs in advance — it cannot retroactively make your faithfully imaged drive collide with a different drive — and computing two different algorithms makes a simultaneous collision infeasible, turning a cross-examination wedge into a non-issue. (A is false: MD5 is not collision-resistant.)
Q8 — C. A hash proves integrity — the bytes did not change between two points in time. It does not prove authorship, origin, ownership, or guilt; those are separate questions answered by metadata, timelines, artifacts, and corroboration.
Q9 — B. The chain of custody is the documented, gap-free history of who handled the evidence, when, and what they did, with a two-signature record for every transfer. The hash proves the bits; the chain proves the handling. Courts require both.
Q10 — B. Charging ahead into a new area exceeds your authority and can suppress the very evidence you found (fruit of the poisonous tree). Stop, document what you saw and how you came to see it, and get a second warrant before continuing.
Q11 — False. A matching hash proves integrity only — that the bits are identical between two points in time. It says nothing about who authored the data, when content was first written, or whose device it was. Confusing "the hash matches" with "the suspect did it" is a category error.
Q12 — True. RAM holds running processes, network connections, decrypted contents, and encryption keys that vanish the instant power is lost; on an encrypted system, pulling the plug can lock you out of the disk forever. The order of volatility says decide about the volatile data first (introduced here; owned by Chapter 15).
Q13. Identification — find every source of data, including the volatile and the hidden. Preservation — protect the original from any alteration (write-block, image, hash, chain of custody). Analysis — examine the verified copy and test hypotheses, seeking the truth. Reporting — explain the findings to a non-technical reader without sacrificing precision. Full credit for all four with a correct clause each.
Q14. It captures the duty to seek both inculpatory and exculpatory evidence — your loyalty is to the facts, not to the side that retained you. The same disciplined examination that proves a USB device was attached at 02:14 also proves, in the next case, that it was not; an examiner who reports only the favorable half has become an advocate, and the court will eventually treat them as one (and discount their findings).
Scoring: Count the 12 objective questions (Q1–Q12) plus your self-graded short answers. 13–14: you own the method — you could explain the whole arc to a judge. 10–12: solid; re-read "Preservation" and "Chain of custody." 7–9: review the four phases, hashing, and legal authorization before the case studies. Below 7: re-read the chapter from "From 'poking around' to a repeatable method" through "Two workflows, one foundation," then retake.