Handling Complex Evidence Scenarios Questions

Domain specific topic focused on forensic and investigative edge cases where evidence or required artifacts are atypical or damaged. Topics include locating evidence in unexpected locations, working with devices in unknown power states, handling encrypted or partially damaged storage, contaminated evidence, chain of custody decisions, triage under incomplete procedures, and articulating a reasoned decision making process when no clear playbook exists. Emphasis is on methodology, tools, documentation, trade offs, and maintaining integrity of investigative outcomes.

EasyTechnical

19 practiced

You receive a hard drive that has visible greasy residue and potential biological contamination. Outline safe handling procedures including PPE, documentation, sampling for biological testing, how to store and transport the device, and the steps you would take to preserve digital evidence while protecting staff and facilities.

Sample Answer

**Situation & immediate actions**I would treat the drive as both evidentiary and potentially biohazardous. I would secure the scene, limit personnel, and notify the lab biosafety officer and evidence custodian before touching the device.

**PPE and safe handling**- Don PPE: nitrile double-gloves, impermeable gown or Tyvek suit, N95 or P100 respirator, eye protection/face shield, and shoe covers.- Use forceps/tweezers where possible. Follow proper donning/doffing and dispose of outer gloves as contaminated.

**Documentation**- Photograph the drive in situ and close-ups of residue. Record time, personnel, PPE used, and chain-of-custody entries.- Label evidence with biohazard notice and case identifiers.

**Sampling for biological testing**- Coordinate with biosafety/forensic biology team. Collect sterile swabs (pre-moistened) from representative areas for PCR/culture; include negative controls and document locations.- Place swabs into appropriate transport medium and log samples separately.

**Storage & transport**- First place device in a leak-proof inner container (plastic evidence bag) labeled as biohazard, then into a secondary rigid container with absorbent material.- Store refrigerated if biological testing requires it; follow local biocontainment and transport regulations (UN3373 or other as applicable).- Transport with biosafety-trained courier and include chain-of-custody manifest.

**Preserving digital evidence while protecting staff**- Do NOT attempt chemical cleaning or field decontamination before imaging. If contamination prevents safe access, coordinate with a certified decontamination facility to render device safe while preserving forensic integrity.- Whenever possible create a forensic bit-for-bit image using a hardware write-blocker inside a controlled biosafety workspace (BSC or containment area) with PPE. If imaging outside containment, image an isolated workstation inside an outer sealed enclosure or use a forensic duplicator that can be placed into a containment hood.- After imaging, verify hashes, document methods, and store the original in biohazard-sealed evidence storage. Note any contamination and decontamination steps in reports.

**Rationale**This approach preserves evidentiary integrity (imaging before alteration), maintains chain-of-custody, and minimizes biological risk by involving biosafety experts and using proper PPE, packaging, and documented sampling.

EasyTechnical

21 practiced

Explain the differences between a bitstream (forensic) image and a logical copy. When is a bitstream image preferred during an investigation, what types of evidence are preserved only in bitstream images, and what metadata or slack-space artifacts are typically missing in logical copies?

EasyTechnical

22 practiced

List at least ten different artifact sources you would consult when building a timeline for a Windows workstation compromise. For each artifact type, give one specific file or command (for example: Windows Event Logs — *.evtx; MFT — $MFT; Prefetch — *.pf) and a short rationale for its value in a timeline.

Sample Answer

**Context:** As a digital forensic examiner building a Windows workstation compromise timeline, consult diverse artifacts to correlate timestamps, user activity, execution and persistence.

- **Windows Event Logs — *.evtx** Rationale: System, Security and Application logs show process starts, logons, service installs and errors with reliable timestamps.

- **Master File Table — $MFT** Rationale: Records file creation, modification and deletion timestamps for nearly all filesystem activity.

- **Prefetch — *.pf** Rationale: Indicates executed binaries, run counts and last run times useful to prove program execution.

- **Registry hives — NTUSER.DAT, SYSTEM, SOFTWARE** Rationale: Persistence keys, Autoruns, MRU lists and LastWrite times reveal configuration changes and user activity.

- **Shimcache/AppCompatCache — SYSTEM or registry extracts** Rationale: Tracks programs executed even if deleted; useful for historical execution evidence.

- **Jump Lists — AutomaticDestinations-ms** Rationale: Documents recently opened files and apps with access times tied to user sessions.

- **Browser history — places.sqlite/cookies, WebCacheV01.dat** Rationale: Timeline of web navigation, downloads, and possible C2/beacon URLs.

- **Recycle Bin metadata — $I files** Rationale: Shows deletion times and original paths for recovered/deleted artifacts.

- **Scheduled Tasks — .job files / Task Scheduler XML** Rationale: Schedules and last run times for automated or malicious tasks.

- **Shim/Prefetch-like artifacts — LNK files (.lnk)** Rationale: Link files store access times, target metadata and possible network share usage.

- **Memory image — Volatility plugins (pslist, netscan)** Rationale: Live processes, network connections, and in-memory artifacts with precise execution context.

- **UserAssist — NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist** Rationale: Tracks user-run executables with counts and LastExecuted timestamps.

Each source provides independent timestamps and context; correlating them strengthens the timeline and highlights anomalies.

MediumTechnical

19 practiced

Case study: A breach used ephemeral AWS EC2 instances spun up and terminated within minutes, coordinated by serverless functions. CloudTrail shows gaps and attackers deleted some logs. Design an investigative plan to locate artifacts across the cloud environment (including CloudTrail, VPC Flow Logs, S3 access logs, EBS snapshots, and IAM changes), preserve volatile cloud artifacts, and produce a defensible chain-of-evidence for the cloud provider and court.

Sample Answer

Situation & objectiveI would treat this as an active, high-risk incident where ephemeral EC2 + serverless functions were used and some CloudTrail records were deleted. Goal: locate all possible artifacts, preserve volatile/cloud-native evidence defensibly, and produce an auditable chain-of-evidence suitable for the cloud provider and court.

Immediate preservation (first 1–4 hours)- Triage & containment: disable compromised IAM keys, restrict suspicious roles, add deny-listers; avoid deleting resources.- Preserve account state: enable/confirm CloudTrail logging to an immutable S3 bucket with MFA Delete and Object Lock (governance/legal hold).- Snapshot volatile artifacts: - Create EBS snapshots of any active instances (create-snapshot API). Copy snapshots to a separate, controlled AWS account/region. - Export ENI/instance metadata (instance-id, AMI, launch time, public IPs, security groups) using DescribeInstances and DescribeNetworkInterfaces; store JSON in evidence bucket.- Export serverless state: export Lambda function code, versions, execution role, and CloudWatch Log Groups (export logs to S3). Capture Step Functions/State Machine definitions and X-Ray traces if present.

Artifact locations and collection plan- CloudTrail: - Retrieve all trails; collect event files and digest files from S3. If deletions occurred, retrieve object versions and Glacier archives (initiate restores). - Validate integrity using CloudTrail digest signatures and hash comparison.- VPC Flow Logs: - Collect flow log files from S3/CloudWatch — include ones associated to affected subnets/ENIs. - Correlate 5-tuple flows to ephemeral instance IPs and timings.- S3 access logs: - Enable/collect access logs and S3 server access logging bucket; retrieve versions/object locks to recover deleted logs.- EBS snapshots: - Collect snapshot metadata and copy snapshots to evidence account; compute and record SHA256 for each snapshot. - Optionally attach copies to forensic instances for image-level analysis.- IAM Changes: - Query IAM CloudTrail events and AWS Config history for CreateUser/CreateRole/AttachPolicy/UpdateAssumeRolePolicy. Capture policy documents and role trust relationships.- Other: CloudWatch Events, Lambda execution logs, STS token activity, Route53 changes, AMI creation events.

Forensic integrity & chain-of-custody- Use scripted, idempotent collection (AWS CLI/SDK) with documented commands and timestamps; log collector identity and access token used.- For every artifact: record source path, AWS account/region, retrieval time (UTC), retriever identity, and SHA256 checksum immediately after download.- Store originals in write-once S3 (Object Lock/legal hold) and keep a separate, hashed working copy for analysis.- Maintain signed, sequential chain-of-custody forms (electronic) and preserve CloudTrail digest files to prove original log integrity.

Analysis & reconstruction- Correlate timelines: CloudTrail events, VPC Flow logs, Lambda invocations, and EBS snapshot timestamps.- Build session graphs tying IAM principals → STS tokens → ENIs/Public IPs → S3/API access.- Recover deleted items via S3 versioning/Glacier restores and cross-account snapshot copies.

Legal/coordination- Immediately notify legal/compliance; preserve evidence under legal hold.- Prepare forensic reports documenting methods, tools, command outputs, hashes, timeline, and confidence levels.- Where possible, request provider-assisted recovery (AWS Support/LAW enforcement) to obtain provider-side logs (control plane, console access logs) beyond customer-visible artifacts.

Example artifact-preservation commands (document and store outputs)- create EBS snapshot, copy to evidence account, compute checksum- aws s3api get-object --bucket trail-bucket --key path/to/log --output file; sha256sum file

Outcome expectations & limitations- Expect gaps where attacker deleted logs; S3 versioning/Glacier and provider-side logs may recover missing pieces.- Emphasize defensibility: immutable storage, hashed evidence, detailed chain-of-custody, and provider collaboration.

HardTechnical

17 practiced

You must collect volatile configuration and runtime state from a proprietary enterprise router with limited CLI and no standard forensic interface. The device may be rebooted by the attacker soon. Describe remote and physical methods to acquire running-config, NVRAM, logs, and evidence of tampering while preserving service where required, including vendor firmware dump techniques and when to consider JTAG or chip-off.

Sample Answer

**Situation & goal (brief)** You must forensically collect volatile config/runtime state from a proprietary enterprise router with limited CLI and no forensic API, while preserving service where required and acting before an attacker reboots.

**Remote acquisition methods (preserve service first)** - Query available CLI non-disruptively: show running-config, show startup-config, show logging, show tech-support. Save outputs with timestamps and command echo disabled if possible. - Live memory and process indicators: if CLI supports, dump process list, routing/ARP tables, NAT sessions, open sockets. Export via SCP/SFTP/TFTP to forensic server using secure channel. Use read-only accounts or “show” commands — do not reboot or write. - Network-level capture: mirror relevant ports (SPAN) to record traffic, capture DHCP/DNS, and management sessions. Preserve syslog stream; pull current buffer via syslog/tcp if supported. - Vendor management interfaces: use SNMP v3 read-only to pull MIBs for running config, counters, and logs (snmpwalk). Document community strings/creds and timestamps.

**When service can be interrupted / deeper remote grabs** - Use vendor diagnostic or support-mode to request a firmware/config dump (some vendors allow “backup config” or “support dump” commands). Authenticate with audited account; transfer image to secure storage. - If firmware supports FTP/SCP of NVRAM or flash partitions, request a read-only image.

**Physical acquisition methods (when remote insufficient / imminent reboot risk)** - Console port capture: attach serial console and record all output; if possible, run commands to dump state. Use hardware keyloggers or a terminal server to record interactions. - Cold backup of flash/NVRAM: with device powered (if volatile state needed), attach hardware readout tools (e.g., bus pirate, SPI reader) to flash/NVRAM pins only if you have hardware schematics and preserve chain-of-custody. Photograph and document PCB, connectors, and serial numbers. - Vendor firmware dump: use vendor service-mode or maintenance cable to request a vendor-authorized dump; document justification and chain-of-custody.

**JTAG / Chip-off guidance** - Consider JTAG when: remote methods fail, device will be wiped/rebooted, and volatile/embedded storage is the only source. JTAG can extract memory and flash with minimal soldering if pads exposed. - Consider chip-off when: JTAG unavailable (disabled or pads absent), or controller encrypted and you need raw NAND for offline recovery. Chip-off is destructive/last resort—requires lab, validated tools, and full documentation; expect lengthy decryption/reconstruction. - Always weigh evidentiary value vs. service impact and legal authority; seek written authorization for destructive actions.

**Preservation & documentation** - Timestamp all actions (NTP-synced), capture console/video evidence, preserve original media hashes, and maintain chain-of-custody. Note commands run, accounts used, and any service disruption. Prefer non-invasive reads first; escalate to hardware methods only with approvals.

**Example quick checklist** - Record network & console output (video) - Pull running-config, logs, ARP/NAT/session tables to secure host - Mirror traffic and capture syslog stream - Request vendor support dump; if denied, plan physical extraction (JTAG → chip-off) with authorization.

Unlock Full Question Bank

Get access to hundreds of Handling Complex Evidence Scenarios interview questions and detailed answers.

Join thousands of developers preparing for their dream job.