Digital Forensics Practice Quiz

DF6 W03: Q01. What is the main purpose of hashing a hard drive during a digital forensic investigation?

To increase the read speed of the hard drive To ensure the data is stored securely on the drive To verify the integrity of the data collected To encrypt the data on the drive

DF6 W03: Q02. Which of the following is NOT considered a type of digital evidence?

Emails Hard drive images DNA samples Browser history

DF6 W02: Q03. What is the primary role of metadata in digital forensics?

To store backup files To provide details about file creation, access, and modification To protect files from unauthorized access To create an index of files on a device

DF6 W03: Q04. In digital forensics, which of the following would be the best choice for imaging a hard drive to prevent data loss?

Disk cloning software Simple file copy commands A physical camera snapshot of the drive Manual recording of file names

DF6 W03: Q05. Which protocol is most commonly used to preserve chain of custody in digital evidence handling?

Chain Verification Protocol (CVP) Digital Evidence Handling Protocol (DEHP) Audit Trail Documentation Document and Report Log System (DRLS)

DF6 W02: Q24. During forensic analysis, what is the significance of volatile memory?

It permanently stores data even after the device is powered off It contains temporary data that may disappear when powered off It provides more storage space than hard drives It stores data faster than traditional hard drives

DF6 W03: Q07. Which technique is used to prevent digital devices from connecting to wireless networks during forensic examination?

Disabling the device’s Bluetooth Using a write blocker Storing the device in a Faraday bag Deleting all network configurations

DF6 W03: Q08. What is the main purpose of a forensic image of a hard drive?

To improve hard drive performance To provide a mirror copy of data without modifying the original To reduce the size of files for easier storage To permanently delete irrelevant data

DF6 W03: Q09. Which file system type would most likely require specialized software to examine on a Windows operating system?

NTFS FAT32 HFS+ exFAT

DF6 W03: Q10. Which organization is responsible for setting standards for computer forensics in the United States?

ACPO NIST OSHA FDA

DF6 W03: Q11. In forensic analysis, what is 'steganography' commonly used for?

Storing data on cloud servers Encrypting digital files Hiding data within other files, such as images Creating a backup of critical information

DF6 W03: Q12. What kind of data is typically NOT recovered through file carving?

Deleted files Overwritten files Fragmented files Hidden files

DF6 W03: Q13. Which file attribute would indicate a file has been accessed but NOT modified?

Creation date Access date Modification date Signature

DF6 W03: Q14. Which of the following can be used to identify the geographic origin of an IP address?

HTTP headers IP geolocation databases System BIOS Domain name servers

DF6 W03: Q15. Which one of the following is considered a primary tool in digital forensics investigations?

Adobe Photoshop Microsoft Excel FTK (Forensic Toolkit) VLC Media Player

DF6 W03: Q16. What is a potential risk of using the original device for examination in a digital forensic case?

It speeds up the examination process It ensures the data remains secure It may modify or delete critical evidence It ensures better accuracy in analysis

DF6 W03: Q17. In digital forensics, what is the main function of 'data carving'?

Creating a backup of files for later use Recovering files without relying on the file system’s structure Compressing files for efficient storage Encrypting files to enhance security

DF6 W03: Q18. In mobile device forensics, what type of memory is commonly extracted to retrieve deleted data?

ROM RAM Flash memory BIOS

Digital Forensics Week 05 Practice Quiz (18 Questions)

Score 11 or greater to pass.