Question 1
Which principle states that every contact between a forensic examiner and evidence leaves a trace, forming the foundation of digital forensics?
Correct Answer:
Locard's Exchange Principle
Question 2
In digital forensics, what is the correct order of evidence collection according to the Order of Volatility (most volatile first)?
Correct Answer:
CPU registers, RAM, swap space, hard disk
Question 3
Which hashing algorithm is most commonly used to verify the integrity of a forensic disk image and is required by many law enforcement standards?
Correct Answer:
SHA-256
Question 4
FTK Imager is used to create a forensic image of a suspect drive. Which image format preserves metadata, allows compression, and is natively segmented, making it the de-facto standard?
Correct Answer:
E01 (Expert Witness Format)
Question 5
When acquiring a live system's RAM, which tool is commonly used on Windows to capture a full physical memory dump for later analysis?
Correct Answer:
DumpIt
Question 1
Exam overview

About this Exam

Prepare with the eCDFP Practice Questions - Certified Digital Forensics Professional (eCDFP) Exam practice quiz. This question bank includes 100 questions covering forensic, windows, file, examiner, and ntfs. Use it to review important concepts, identify knowledge gaps, and build confidence for the related exam, course, or assessment.

More details

Additional Information

eCDFP Practice Questions - Certified Digital Forensics Professional (eCDFP) Exam

This practice set contains 100 questions from the matching question bank and focuses on forensic, windows, file, examiner, and ntfs. Work through each question carefully, review the provided solutions, and revisit topics that need more study before your next attempt.

This is an independent study resource intended for practice and review; it is not an official examination or an endorsement by any organization named in the title.

Quiz information

Frequently Asked Questions

The complete question count is available after full access is unlocked.
No fixed duration is currently configured for this quiz.
Question explanations are included where they are available in the quiz content, helping you review the reasoning after answering.
Yes. You can retake the practice test again as you continue studying during your available access period.
After your access is confirmed, you can continue into the complete practice exam from this quiz flow.
Unless explicitly stated otherwise, this page provides independent practice material for study and exam preparation and is not the official examination itself.
Keep studying

Related Questions