Help
Options
Didn't know it?
click below
click below
Knew it?
click below
click below
Don't Know
Remaining cards (0)
Know
retry
shuffle
restart
0:00
Embed Code - If you would like this activity on your web page, copy the script below and paste it into your web page.
Normal Size Small Size show me how
Normal Size Small Size show me how
Digital Forensics
Midterms
| Question | Answer |
|---|---|
| Which law outlines the admissibility of evidence in US courts? Group of answer choices Digital Forensics Act Federal Rules of Evidence Cybersecurity Law Locard's Evidence Rules | Federal Rules of Evidence |
| What is the primary goal of computer forensics? Group of answer choices To optimize network speed To detect and analyze digital evidence for legal use To develop cybersecurity strategies To monitor user activity | To detect and analyze digital evidence for legal use |
| Which of the following cybercrimes involves modifying data during transmission? Group of answer choices Cyber defamation Data manipulation Espionage Phishing | Data Manipulation |
| Which principle states that all processes applied to evidence must be documented? Group of answer choices ACPO Principle 3 Chain of custody Locard's Exchange Principle Understandable evidence | ACPO Principle 3 |
| Digital evidence can be located in which of the following devices? Group of answer choices Mobile phones All of the above Printers Network servers | All of the above |
| What does forensic evidence need to be considered "authentic"? Group of answer choices It must be encrypted It must be compressed into a secure format It must be verified by all parties It must be supported by the original source details | It must be supported by the original source details |
| What is the role of metadata in digital evidence? Group of answer choices Prevents tampering of files Hides sensitive information Encrypts files for secure transmission Tracks file creation and modification details | Tracks file creation and modification details |
| Which of the following is an example of volatile data? Group of answer choices System time and open files Hidden partitions Network logs Files stored on a hard drive | System time and open files |
| Why is forensic readiness important for organizations? Group of answer choices To identify vulnerabilities in their system To improve public relations To recover data more quickly after a system crash To minimize investigation costs and disru | To minimize investigation costs and disruptions |
| In the forensic investigation methodology, which of the following steps comes after the identification of evidence? Group of answer choices Documentation of findings Final reporting Data analysis Evidence acquisition | Evidence Acquisition |
| During the pre-investigation phase, setting up a forensic lab ensures: Group of answer choices Efficient analysis of evidence Evidence preservation Compliance with laws and regulations All of the above | All of the above |
| What is a critical factor when organizing gathered evidence for a report? Group of answer choices Categorizing information for clarity The location of the incident Redacting unnecessary details Anonymizing all data sources | Categorizing information for clarity |
| A forensic lab must follow which set of guidelines for evidence handling? Group of answer choices General data protection regulations Organizational privacy policies Evidence integrity principles Local industry compliance standards | Evidence integrity principles |
| Which of the following is an essential consideration when building an investigation team? Group of answer choices Budget allocation Specialized roles and responsibilities Marketing strategies Networking capabilities | Specialized roles and responsibilities |
| The investigator’s role in court includes: Group of answer choices Suggesting penalties for the defendant Analyzing cybersecurity risks Providing legal interpretations Presenting evidence and findings objectively | Presenting evidence and findings objectively |
| The forensic investigation report should include all of the following EXCEPT: Group of answer choices Opinions of the investigation team A detailed description of each investigative step Evidence supporting the findings Recommendations for le | Opinions of the investigation team |
| What is a primary role of a computer forensics lab? Group of answer choices Preserve and analyze digital evidence Prepare reports for employees Recover deleted data Analyze malware | Preserve and analyze digital evidence |
| What is the main focus of the post-investigation phase? Group of answer choices Evidence decryption Reporting findings to law enforcement Analyzing remaining threats Identifying cybersecurity risks | Reporting findings to law enforcement |
| What is the main goal of the investigation phase? Group of answer choices To acquire, analyze, and document evidence To train new employees To perform security audits To create malware samples for testing | To acquire, analyze, and document evidence |
| Evidence gathering should occur during which phase? Group of answer choices Pre-investigation Investigation Analysis Post-investigation | Investigation |
| What is the purpose of the pre-investigation phase? Group of answer choices To acquire evidence from a suspect’s device To compile a legal report To plan and prepare for the forensic investigation To analyze and document findings | To plan and prepare for the forensic investigation |
| Evidence acquired during an investigation must: Group of answer choices Be encrypted before presentation in court Verifying evidence integrity Remain unchanged to ensure integrity Be altered for clarity | Remain unchanged to ensure integrity |
| Chain of custody refers to: Group of answer choices The process of securing evidence against tampering A timeline of legal compliance during an investigation Transferring data securely between devices Deleting irrelevant evidence | The process of securing evidence against tampering |
| What is the first phase of the Forensic Investigation Process? Group of answer choices Pre-investigation Post-investigation Investigation Evidence analysis | Pre-investigation |
| Which rule ensures digital evidence is clear and understandable to the jury? Group of answer choices Admissible evidence Understandable evidence Reliable evidence Authentic evidence | Understandable evidence |
| What is the role of a forensic investigator? Group of answer choices To identify, collect, and analyze evidence To train employees on data compliance To optimize IT systems for efficiency To design secure network architectures | To identify, collect, and analyze evidence |
| According to Locard's Exchange Principle, what happens when a crime is committed? Group of answer choices All digital evidence is automatically stored on the cloud No physical evidence is left behind All traces of the activity are permanently er | Some exchange of evidence occurs between the criminal and the environment |
| According to the text, computer forensics is a subset of which field? Group of answer choices Cybersecurity Information Technology Digital Forensics Ethical Hacking | Digital Forensics |
| What is an internal cyberattack? Group of answer choices Phishing emails sent to employees An attack carried out by an insider with authorized access A denial-of-service attack from an external source Exploitation of a system vulnerability by | An attack carried out by an insider with authorized access |
| What does the best evidence rule state? Group of answer choices All evidence must be encrypted The original evidence must be submitted when possible Evidence must be kept in physical form Only copies of digital files can be submitted in court | The original evidence must be submitted when possible |
| Which of the following is an example of non-volatile data? Group of answer choices Files stored on a hard drive Data stored in RAM Open network connections Temporary files in clipboard | Files stored on a hard drive |
| What is the first step in the computer forensics process? Group of answer choices Data analysis Legal compliance review Evidence acquisition Case documentation | Evidence Acquisition |
| Which of the following is an objective of computer forensics? Group of answer choices Preserving evidence for prosecution Replacing damaged IT systems Performing penetration tests on IT systems Detecting vulnerabilities in software developmen | Preserving evidence for prosecution |
| What is steganography? Group of answer choices Hiding information within other files or images Encrypting files for transmission Deleting files permanently from a device Encrypting data for secure storage | Hiding information within other files or images |
| Search and seizure require forensic investigators to: Group of answer choices Create backups of company data Train users in data management practices Analyze only cloud-based systems Execute search warrants and collect evidence | Execute search warrants and collect evidence |
| Evidence acquisition involves: Group of answer choices Developing malware analysis reports Analyzing suspicious email attachments Encrypting data for secure storage Capturing and cloning digital evidence from devices | Capturing and cloning digital evidence from devices |
| Which of the following is NOT a requirement for a forensic investigation report? Group of answer choices Inclusion of all organizational data Supporting evidence for conclusions Accuracy and clarity Adherence to local laws | Inclusion of all organizational data |
| Proper evidence preservation ensures: Group of answer choices Only deleted data is recovered Evidence is excluded from legal cases All data is permanently encrypted Evidence is admissible in court | Evidence is admissible in court |
| What is the importance of understanding hardware and software requirements in a forensic lab? Group of answer choices It eliminates the need for post-analysis reporting It guarantees no legal disputes arise It ensures compatibility and efficienc | It ensures compatibility and efficiency during investigations |
| The post-investigation phase is responsible for: Group of answer choices Summarizing findings into a detailed report Building tools for malware testing Training forensic investigators Verifying evidence integrity | Summarizing findings into a detailed report |
| What is the difference between volatile and non-volatile data? Group of answer choices Volatile data is stored in hard drives, while non-volatile is stored in RAM Volatile data is temporary, while non-volatile data is permanent There is no diffe | Volatile data is temporary, while non-volatile data is permanent |
| What is a key responsibility of a forensic investigator regarding evidence? Group of answer choices Maintaining the chain of custody Encrypting evidence for safekeeping Developing secure systems Altering evidence for better clarity | Maintaining chain of custody |
| Which of the following is a type of cybercrime? Group of answer choices Cyber defamation Identity theft Denial-of-service attack All of the above | All of the above |
| What is the purpose of hashing during the investigation phase? Group of answer choices To decrypt secure data files To verify the integrity of digital evidence To compare evidence between cases To recover deleted system logs | To verify the integrity of digital evidence |
| Which step ensures that evidence remains unaltered during acquisition? Group of answer choices Chain of custody Documentation Evidence preservation Malware analysis | Evidence Preservation |
| When testifying as an expert witness, a forensic investigator should: Provide alternate interpretations of the evidence Summarize the legal aspects of the case Offer subjective opinions Present findings accurately and impartially | Present findings accurately and impartially |
| What is the main focus of the post-investigation phase? Group of answer choices Analyzing remaining threats Evidence decryption Reporting findings to law enforcement Identifying cybersecurity risks | Reporting findings to law enforcement |
| Digital evidence must meet which criterion to be admissible in court? Group of answer choices Be encrypted for security Be publicly available Be understandable, authentic, and complete Be compressed for easier handling | Be understandable, authentic, and complete |
| What is the primary objective of forensic readiness? Group of answer choices To ensure employee training To reduce investigation time and costs To minimize network traffic To prevent cybercrime | To reduce investigation time and costs |
| Which of the following is NOT a type of digital evidence? Group of answer choices Physical devices Encrypted files RAM data Slack space | Physical devices |
| What is the main use of the chain of custody in computer forensics? Group of answer choices Preventing data alteration during analysis Encrypting evidence for safekeeping Ensuring evidence is admissible in court Providing data backup | Ensuring evidence is admissible in court |
| What is the purpose of ACPO Principle 4? Group of answer choices To designate responsibility to the case officer To ensure evidence is clearly understood To maintain the chain of custody To verify the authenticity of evidence | To designate responsibility to the case officer |
| Search and seizure require investigators to: Group of answer choices Analyze incident logs immediately Prioritize data encryption Create investigative software Securely handle all electronic devices | Securely handle all electronic devices |
| Which document must be created during the investigation phase to ensure accuracy? Group of answer choices Operating manual Legal affidavit Crime scene sketch Incident timeline | Incident timeline |
| Why is documenting the crime scene critical? It helps investigators verify their findings It ensures forensic labs meet international standards It creates a detailed record for analysis and presentation It provides evidence for defense attorneys | It creates a detailed record for analysis and presentation |
| What is the most important quality of a forensic investigation report It must include all background research It should be technical and comprehensive It must outline potential cybersecurity improvements It must be concise clear and legally admissible | It must be concise, clear, and legally admissible |
| Data analysis during the investigation phase focuses on: Group of answer choices Preparing malware for testing Interpreting evidence to determine its relevance Documenting user activities Rewriting damaged logs | Interpreting evidence to determine its relevance |
| What is the main benefit of forensic readiness? Group of answer choices Prevents data breaches entirely Reduces investigation disruption Optimizes system performance Eliminates all cyber threats | Reduces investigation disruption |
| What is a common disk interface used in modern hard drives? Group of answer choices SATA IDE NVMe Both SATA and NVMe | Both SATA and NVMe |
| How does a journaling file system improve reliability? Group of answer choices By organizing files into folders By tracking changes to files and storing them in a log By encrypting deleted files By creating backups in real time | By tracking changes to files and storing them in a log |
| What does "slack space" refer to on a storage device? Space between partitions on a disk Unused sectors that cannot be formatted Unused space in a storage cluster after data is written Temporary cache files created by applications | Unused space in a storage cluster after data is written |
| Which operating system uses NTFS as its primary file system? Group of answer choices macOS UNIX Linux Windows | Windows |
| In a hard disk drive, what is the purpose of the read/write head? Group of answer choices To read and write data to/from the disk surface To process data stored in RAM To transfer data between different partitions To manage network traffic | To read and write data to/from the disk surface |
| What feature distinguishes ext3 from ext2? Group of answer choices Faster booting times File journaling support Higher compression rates Compatibility with older hardware | File Journaling support |
| What is the significance of "logical block addressing (LBA)"? It determines the encryption key of a hard drive It describes physical hardware connections It compresses files for storage efficiency It simplifies the storage addressing system | It simplifies the storage addressing system |
| Which partition style supports disks larger than 2TB? Group of answer choices NTFS GPT FAT32 MBR | GPT |
| Which file system is commonly used by Linux operating systems? Group of answer choices ext4 HFS+ NTFS FAT32 | ext4 |
| What is the primary function of a file system? Group of answer choices To secure files using encryption To analyze network activity To organize and manage data on storage devices To create backups of critical system files | To organize and manage data on storage devices |
| What is the role of a write blocker during data acquisition? Blocking unauthorized network access Preventing modifications to the original evidence Allowing data to be modified securely Encrypting data on the original device | Preventing modifications to the original evidence |
| What is the purpose of an acquisition report? To store acquired data in a compressed format To outline the steps and tools used during data collection To create backups of volatile data To encrypt collected evidence for secure transfer | To outline the steps and tools used during data collection |
| Which of the following is an example of static acquisition? Group of answer choices Collecting data from open processes Capturing RAM data from a live system Imaging a powered-off laptop hard drive Recording real-time network traffic | Imaging a powered-off laptop hard drive |
| Which acquisition tool can capture data at the sector level? Group of answer choices dd Sleuth Kit EnCase FTK Imager | dd |
| Which data acquisition method is most suitable for large storage devices? Group of answer choices Selective acquisition Logical acquisition Incremental acquisition Physical acquisition | Physical acquisition |
| Which hashing algorithm is commonly used to verify data integrity? Group of answer choices AES RSA MD5 SHA-3 | MD5 |
| Which of the following is an example of live data acquisition? Imaging a hard drive of a powered-off system Creating backups of archived data Capturing data from a network in real time Copying deleted files from a USB drive | Capturing data from a network in real time |
| What does the AFF (Advanced Forensics Format) provide? A way to compress acquired evidence for storage A tool for analyzing network logs A real-time encryption method for sensitive files A standardized format for digital evidence storage | A standardized format for digital evidence storage |
| How does the dd tool assist in data acquisition? Group of answer choices By hashing collected evidence By capturing live network traffic By creating a bit-by-bit copy of storage media By analyzing metadata of captured files | By creating a bit-by-bit copy of storage media |
| What is the primary concern when capturing data from encrypted devices? Group of answer choices Acquiring data without damaging encryption keys Creating an incremental backup Encrypting volatile data Ensuring compatibility with file systems | Acquiring data without damaging encryption keys |
| What does steganography involve? Group of answer choices Hiding information within other files, such as images or videos Compressing large files for transmission Encrypting files for secure storage Deleting unnecessary system logs | Hiding information within other files, such as images or videos |
| What is the primary challenge with detecting steganography? It compresses files beyond recovery It leaves no visible traces of hidden data It requires specialized hardware for analysis It uses strong encryption methods Not | It leaves no visible traces of hidden data |
| What is the main goal of anti-forensics? Group of answer choices To enhance data security To prevent forensic investigators from accessing or analyzing evidence To recover lost data from storage devices To encrypt sensitive files | To prevent forensic investigators from accessing or analyzing evidence |
| What is the purpose of the tool "Timestomp"? To manipulate file metadata such as creation and modification dates To recover deleted timestamps from log files To compress timestamps for storage To analyze the timeline of system activity | To manipulate file metadata such as creation and modification dates |
| How does encryption act as an anti-forensics tool? It deletes unused data to prevent recovery It creates multiple versions of the same file It protects data by making it unreadable without the encryption key It compresses files for efficient storage | It protects data by making it unreadable without the encryption key |
| Which of the following techniques can recover evidence after artifact wiping? Group of answer choices Metadata extraction Steganalysis Slack space analysis Log correlation | Slack Space Analysis |
| What is an effective countermeasure for artifact wiping? Group of answer choices Incremental backups Log wiping Metadata analysis File compression | Metadata analysis |
| How does file system tunneling interfere with forensic investigations? It compresses files for storage efficiency It allows files to inherit timestamps from deleted files It hides files in unused disk sectors It creates backups of hidden files | It allows files to inherit timestamps from deleted files |
| What is the purpose of log wiping in anti-forensics? To erase traces of user activity from log files To encrypt system log files for security To create backups of system logs To improve system performance by removing old logs | To erase traces of user activity from log files |
| Which countermeasure is used to detect manipulated timestamps? Group of answer choices Hash comparison Metadata verification Log correlation Steganalysis | Metadata verification |
| What is the main purpose of sectors on a hard drive? To store the operating system kernel To encrypt critical system information To divide data into compressed files To define physical divisions on the disk for data storage | To define physical divisions on the disk for data storage |
| Which of the following tools can analyze file systems? Group of answer choices The Sleuth Kit Wireshark Maltego Volatility | The Sleuth Kit |
| What is an inode in Linux file systems? Group of answer choices A temporary data storage unit A process used to encrypt file names A structure that stores metadata about files A type of directory | A structure that stores metadata about files |
| What does the term tracks refer to in the context of hard disk drives? Software logs created during file transfers Concentric circles on the disk surface used for storing data Pathways that data takes through a network The pathways inside RAM modules | Concentric circles on the disk surface used for storing data |
| What is the primary role of the Master Boot Record (MBR)? To store temporary files for active processes To encrypt files for data protection To load applications into memory To manage boot-up information and partition details | To manage boot-up information and partition details |
| What does "journaling" in a file system ensure? Group of answer choices File compression for efficient storage Faster execution of user applications Permanent deletion of unused files Recovery of data in case of system crashes | Recovery of data in case of system crashes |
| Which file system is specific to macOS? Group of answer choices FAT32 HFS+ NTFS ext4 | HFS+ |
| Which step comes first in the data acquisition process? Group of answer choices Analyzing evidence Securing the scene Creating a forensic image Hashing the collected data | Securing the scene |
| What does "selective acquisition" focus on? Group of answer choices Capturing all data on a disk Collecting only relevant files or folders Hashing volatile system logs Analyzing encrypted file systems | Collecting only relevant files or folders |
| Which of the following is NOT a type of data acquisition? Group of answer choices Logical acquisition Incremental acquisition Live acquisition Metadata-only acquisition | Metadata only acquisition |
| Which file format is NOT commonly used for data acquisition? Group of answer choices E01 RAW NTFS AFF | NTFS |
| Which of the following data types is considered volatile? Group of answer choices Data stored on a USB drive System logs Archived emails Open network connections | Open network connections |
| What does data obfuscation aim to achieve? Creating backups of sensitive files Increasing system performance through data compression Making data harder to understand by altering its structure or format Preventing access to user data by encryption | Making data harder to understand by altering its structure or format |
| What is the main objective of anti-forensics countermeasures? To encrypt sensitive data for long-term storage To simplify forensic investigations To assist in system performance optimization To detect, recover, and analyze tampered or hidden evidence | To detect, recover, and analyze tampered or hidden evidence |
| What does the term "hash collision" refer to? Group of answer choices A failure to generate a valid hash value A mismatch between original and duplicate files A corrupted metadata entry Two different pieces of data producing the same hash value | Two different pieces of data producing the same hash value |
| Which tool is commonly used to detect timestamp manipulation? Group of answer choices Wireshark Timestomp FTK Imager ExifTool | ExifTool |
| Which anti-forensics technique is aimed at hiding the true content of files? Group of answer choices Metadata alteration Log wiping File carving Encryption | Encryption |
| What is the main advantage of SSDs over HDDs? Group of answer choices Higher data storage capacity Longer lifespan Faster data access speeds Lower cost | Faster data access speeds |
| What is the purpose of the GUID Partition Table (GPT)? Group of answer choices To delete unnecessary file partitions To store the operating system's kernel To encrypt files for data security To organize and manage large-capacity disks | To organize and manage large-capacity disks |
| Which of the following is an essential feature of solid-state drives (SSDs)? Group of answer choices Rotating magnetic disks for data storage Use of tape-based storage mechanisms Low latency and faster read/write speeds Dependence on moving parts | Low latency and faster read/write speeds |
| What is the key difference between HFS+ and APFS in macOS? Group of answer choices APFS is incompatible with modern macOS versions HFS+ supports file journaling while APFS does not HFS+ provides faster data access APFS is optimized for SSDs | APFS is optimized for SSDs |
| What does metadata in acquired data provide? Group of answer choices Real-time logs of system activity Encryption keys for secure data transfer Details about the file’s creation, modification, and access times Information about system uptime | Details about the file’s creation, modification, and access times |
| What is the purpose of hashing in the data acquisition process? Group of answer choices To create backups of original evidence To compress the collected evidence To verify the integrity of acquired data To encrypt data for secure storage | To verify the integrity of acquired data |
| What type of data acquisition is performed on a system that is turned off? Group of answer choices Static acquisition Network acquisition Volatile acquisition Live acquisition | Static acquisition |
| Why is hashing performed before and after acquisition? Group of answer choices To detect tampering during the transfer process To compress acquired evidence To encrypt data for security To analyze metadata | To detect tampering during the transfer process |
| Which of the following is an example of artifact wiping? Group of answer choices Creating backups of sensitive files Encrypting log files Data compression Overwriting files with random data to prevent recovery | Overwriting files with random data to prevent recovery |
| Which of the following is an effective countermeasure against data obfuscation? Group of answer choices File compression Metadata encryption File carving Structure analysis and pattern recognition | Structure analysis and pattern recognition |
| What does slack space contain? Group of answer choices Unused space in a storage cluster that may hold remnants of previous data Deleted files ready for recovery System logs from deleted applications Encrypted user credentials | Unused space in a storage cluster that may hold remnants of previous data |
| What type of data structure is used in NTFS to store file metadata? Group of answer choices Logical Block Inode Superblock Master File Table (MFT) | Master File Table (MFT) |
| Which Linux file system introduced journaling? Group of answer choices ext3 ext4 FAT32 NTFS | ext3 |
| When should a forensic investigator perform a physical acquisition? When only metadata is needed When the entire disk, including deleted data, must be copied When selective data collection is required When the system is encrypted | When the entire disk, including deleted data, must be copied |
| What does the term "logical acquisition" refer to? Group of answer choices Capturing data from volatile storage Copying only specific files or folders Creating a complete bit-stream image Encrypting file systems during acquisition | Copying only specific files or folders |
| How does anti-forensics impact forensic readiness? It enhances file system security It complicates the process of collecting, preserving, and analyzing evidence It simplifies evidence collection It improves evidence integrity | It complicates the process of collecting, preserving, and analyzing evidence |
| How can forensic investigators counter log wiping? Group of answer choices By compressing recovered logs By using specialized log recovery tools By recovering deleted logs from slack space By encrypting system logs for security | By recovering deleted logs from slack space |
Created by:
user-2043478