NO.22 Which United States law defines requirements for record keeping and destruction of electronic records for publicly traded companies?

NO.23 Which law requires both parties to consent to the recording of a conversation?

NO.24 An organization has identified a system breach and has collected volatile data from the system.
Which evidence type should be collected next?

NO.25 Which description applies to the Advanced Forensic Format (AFF)?

NO.26 A digital forensic examiner receives a computer used in a hacking case. The examiner is asked to extract information from the computer’s Registry.
How should the examiner proceed when obtaining the requested digital evidence?

NO.27 A forensic investigator needs to identify where email messages are stored on a Microsoft Exchange server.
Which file extension is used by Exchange email servers to store the mailbox database?

NO.28 A company has identified that a hacker has modified files on one of the company’s computers. The IT department has collected the storage media from the hacked computer.
Which evidence should be obtained from the storage media to identify which files were modified?

NO.29 A USB flash drive was seized as evidence to be entered into a trial.
Which type of evidence is this USB flash drive?

NO.30 How should a forensic scientist obtain the network configuration from a Windows PC before seizing it from a crime scene?

NO.31 How is the Windows swap file, also known as page file, used?

NO.32 Which characteristic applies to solid-state drives (SSDs) compared to magnetic drives?

NO.33 The chief executive officer (CEO) of a small computer company has identified a potential hacking attack from an outside competitor.
Which type of evidence should a forensics investigator use to identify the source of the hack?

NO.34 Which type of information does a Windows SAM file contain?

NO.35 Which information is included in an email header?

NO.36 While collecting digital evidence from a running computer involved in a cybercrime, the forensic investigator makes a list of items that need to be collected.
Which piece of digital evidence should be collected first?

NO.37 A victim of Internet fraud fell for an online offer after using a search engine to find a deal on an expensive software purchase. Once the victim learned about the fraud, he contacted a forensic investigator for help.
Which digital evidence should the investigator collect?

NO.38 Which U.S. law criminalizes the act of knowingly using a misleading domain name with the intent to deceive a minor into viewing harmful material?

NO.39 A forensic examiner is reviewing a laptop running OS X which has been compromised. The examiner wants to know if any shell commands were executed by any of the accounts.
Which log file or folder should be reviewed?

NO.40 A forensics investigator is investigating a Windows computer which may be collecting data from other computers on the network.
Which Windows command line tool can be used to determine connections between machines?

NO.41 An organization believes that a company-owned mobile phone has been compromised.
Which software should be used to collect an image of the phone as digital evidence?

NO.42 Thomas received an email stating he needed to follow a link and verify his bank account information to ensure it was secure. Shortly after following the instructions, Thomas noticed money was missing from his account.
Which digital evidence should be considered to determine how Thomas’ account information was compromised?

NO.43 A computer involved in a crime is infected with malware. The computer is on and connected to the company’s network. The forensic investigator arrives at the scene.
Which action should be the investigator’s first step?

NO.44 Which law or guideline lists the four states a mobile device can be in when data is extracted from it?