Reporting

• What is 'voluntary surrender' in digital forensics?

  Owner gives permission for examination
• How should permission for examination be obtained?

  Voluntarily, via phone, email, or mail
• What is 'Forensic Readiness'?

  Ability to collect and analyze digital evidence
• What guidelines do most companies follow for digital evidence?

  ACPO guidelines
• Why should companies monitor computer use?

  To detect unusual activity early
• What can Artificial Intelligence software do in digital forensics?

  Spot unusual activity like malware
• Why must records of computer use be treated as potential evidence?

  To protect against loss or damage
• What is the 'chain of custody' in digital forensics?

  Record of evidence access and handling
• What does Forensic Readiness ensure in case of a crime?

  Availability of evidence for quick investigation
• What standard must companies demonstrate compliance with for evidence?

  BSI 0008
• What happens if evidence is not collected according to BS 0008?

  It will not be accepted in court
• What are the three basic phases of a Digital Forensics investigation?

  • Acquisition
  • Analysis
  • Reporting
• What is the purpose of the Acquisition stage in digital forensics?

  To collect and preserve original data
• What must be done before removing digital devices from a crime scene?

  Identify and record the devices
• Why is it crucial to preserve original data during acquisition?

  To ensure evidence can be challenged in court
• What do Digital Forensic Technicians do during acquisition?

  Capture and preserve device memory
• How should battery-powered devices be handled during acquisition?

  Unplugged and isolated from power supply
• What is the importance of using evidence bags for devices?

  To prevent changes to the devices
• What should be done if changes occur to a device during examination?

  Record the changes for court explanation
• What types of information can a Digital Forensics examiner access?

  Active programs, usernames, and logs
• What is FTK Imager used for?

  To capture memory of Windows computers
• What does EnCase software do in digital forensics?

  Analyzes data and produces court-accepted reports
• What is a 'pcap' file?

  A packet capture file for network analysis
• What records do phone service providers maintain?

  Call history and location data
• What challenges do manufacturers face with data encryption?

  It makes data recovery harder but not impossible
• How do mobile devices store location data?

  Records location even when not in use
• What is the role of network analysis software?

  To monitor and analyze network traffic
• What is the purpose of using a Write Blocker?

  To prevent changes to the original data
• What can be retrieved from smartphones during forensic examination?

  Deleted files and location history
• What is the significance of the 'First Principle' in digital forensics?

  Ensures proper procedures are followed
• How does the use of digital forensics evolve with cyberattacks?

  New challenges arise for data inspection
• What information does a detailed call history contain?

  Location, number called, date, time, duration
• Why do mobile devices contain deleted files?

  They can be retrieved and examined later
• What additional records do smartphones contain?

  Records of location and time when switched on
• What is the impact of encryption on data recovery?

  It makes recovery harder but not impossible
• How do cyberattacks affect data inspection for forensic examination?

  They introduce new challenges for data inspection
• What do criminals want users to overlook?

  The security aspects of the World Wide Web
• What does a VPN do for communications?

  It encrypts all communications for security
• What is steganalysis?

  A process to detect hidden files
• What is a steganogram?

  A package concealed within a cover file