4. Learning Aim E2

Question 1

What is the importance of maintaining an accurate record during a forensic investigation?

Answer 1

Timeliness of recording evidence

Evidence should be recorded at the time of the incident or as soon as possible to ensure reliability.

Question 2

What can happen if evidence is not recorded in a timely fashion?

Answer 2

• Evidence could be destroyed/modified by the attacker
• Evidence may be lost by turning off the computer
• Evidence could be accidentally destroyed by an employee

Loss of evidence can hinder prosecution efforts.

Question 3

Why is it important to have regular snapshots of the system?

Answer 3

To recover back to an earlier state and access evidence that may have been removed

Snapshots help maintain accurate, timely evidence.

Question 4

When recording findings, what are the key pieces of information to include?

Answer 4

• Evidence Item
• Method of Acquiring Evidence
• Evidence Detail
• Evidence Reliability
• Conclusions

Each piece of information contributes to the overall understanding of the evidence.

Question 5

How is the reliability of evidence judged?

Answer 5

Based on the source and timeliness of the evidence

Automatic evidence is generally reliable, while evidence from people requires careful consideration.

Question 6

What should be recorded if evidence is altered during an investigation?

Answer 6

• Time and date of alteration
• Description of the alteration
• Who made the alteration

Recording alterations is crucial for assessing evidence reliability.

Question 7

What is the benefit of creating visual evidence during forensic analysis?

Answer 7

Visual evidence is often more reliable than written or verbal records

It allows for independent analysis of the data.

Question 8

What must be ensured about visual evidence to maintain its relevance?

Answer 8

It must be clearly legible and timely recorded

Important information should not be cropped out or ignored.

Question 9

True or false: Evidence should be recorded at the time of the incident or as soon after as possible.

Answer 9

TRUE

Timely recording is essential for maintaining evidence reliability.

Question 10

What are the potential issues with evidence from people?

Answer 10

• Poor memory
• Possible bias or dishonesty
• Timeliness of the evidence

These factors can affect the reliability of the evidence.