Unit 3: Data Acquisition and Windows Forensics - Practice Quiz

1 What is a forensic image of a storage device?

2 What is the main purpose of maintaining a chain of custody?

3 Which device helps prevent changes to a storage drive during acquisition?

4 What should an examiner do before analyzing a forensic image?

5 Why is a working copy of a forensic image commonly used?

6 Which of the following is volatile information?

7 Why should volatile data usually be collected before non-volatile data?

8 Which information can commonly be identified through Windows memory analysis?

9 What is a memory dump?

10 What is the Windows Registry?

11 Which Registry hive file commonly stores settings for an individual Windows user?

12 What is the primary purpose of a web browser cache?

13 Which browser artifact commonly stores site-specific data such as a session identifier?

14 Which browser artifact is most useful for finding URLs that a user previously visited?

15 Which item is an example of file metadata?

16 What does a file extension such as .txt commonly indicate?

17 What information is commonly included in a text-based log entry?

18 Which basic technique can help find relevant entries in a large text-based log?

19 Which built-in Windows tool is commonly used to view Windows Event Logs?

20 Which Windows Event Log commonly contains user sign-in events?

21 A forensic examiner creates a bit-stream image of a write-protected drive. Which result best demonstrates that the acquired image accurately represents the source at the time of acquisition?

22 Why should an examiner normally connect a seized storage device through a hardware write blocker?

23 Investigators find a powered-on Windows laptop with an encrypted volume currently unlocked. What is the most appropriate initial acquisition strategy?

24 An examiner transfers a forensic image to another analyst. Which action best maintains the chain of custody?

25 An examiner receives an E01 image and an acquisition report containing its hash. What should be done before beginning detailed analysis?

26 A forensic tool accidentally modifies the analyst's working copy of an image. The verified master image remains unchanged. What should the examiner do?

27 A live Windows system may contain fileless malware and encryption keys in memory. Which evidence should receive the highest collection priority?

28 A computer has already been powered off, so its RAM cannot be captured. Which non-volatile Windows file may still contain fragments previously written from memory?

29 During memory analysis, a process appears in a pool-scanning result but not in the active linked process list. What is the best interpretation?

30 A memory-analysis network plugin identifies a suspicious connection associated with PID 3180. What should the examiner do next to identify the responsible program?

31 Malware is suspected of starting whenever a particular user signs in. Which Registry location is most directly relevant to this persistence mechanism?

32 An examiner observes that a Registry key has a recent last-write timestamp. What can be concluded most reliably from this timestamp?

33 A browser's visible history has been cleared, but investigators need evidence of recently viewed web content. Which artifacts should they examine next?

34 Several users have profiles on the same Windows computer. How can an examiner most reliably associate browser activity with a particular user?

35 A file's timestamps in the NTFS $STANDARD_INFORMATION attribute appear unusually old. Which comparison may help detect timestamp manipulation?

36 A document has been deleted, but a Windows shortcut (.lnk) referring to it remains. What useful information may the shortcut provide?

37 Two text-based application logs record the same incident, but one uses local time and the other uses UTC. What should the examiner do before correlating entries?

38 A current application log begins after the suspected incident, suggesting that log rotation occurred. What should the examiner examine next?

39 A Windows Security log contains Event ID 4624 with Logon Type 10. Which activity does this most commonly indicate?

40 Investigators find Security log Event ID 1102 shortly after suspicious administrative activity. What does this event indicate?

41 During acquisition, three source sectors remain unreadable after documented retries, and the imaging tool substitutes zero-filled sectors in the image. Which verification conclusion is most defensible?

42 An ATA drive reports fewer logical blocks than its native maximum because a Host Protected Area (HPA) is present. The warrant authorizes acquisition of the entire physical device. What is the best approach?

43 Investigators encounter a running Windows laptop with a mounted BitLocker volume, no recovery key, and suspected fileless malware. Which sequence best preserves otherwise unavailable evidence?

44 A hardware RAID-5 controller is failing, but the operating system still exposes a coherent logical volume. Individual disks use undocumented controller metadata. Which acquisition strategy best reduces reconstruction risk?

45 An E01 evidence set consists of eight segments. Hash validation fails because segment E05 is missing, although the remaining segments can be opened partially. What should the examiner do first?

46 A workstation used for examination automatically mounts new volumes and runs search indexing. Which preparation most effectively prevents contamination of a verified raw image?

47 A live Windows server uses a RAM-backed virtual disk for temporary application data, and the suspected attacker still has an active session. Which collection decision best follows the order of volatility?

48 Logs from a live suspect host must be correlated with a trusted network sensor, but the host clock may have been altered. What should be collected early to support defensible time normalization?

49 A memory image shows a process in a pool scan, but the process is absent from the active process linked list. Its executive process structure has plausible timestamps and valid thread references. Which interpretation is best supported?

50 Which combination most strongly supports code injection into a user process rather than ordinary loading of a DLL?

51 An examiner finds a suspicious value under a registry key whose LastWrite time is 14:00. The value data appears to contain an execution command. What can be concluded from the key timestamp alone?

52 A copied registry hive appears internally consistent but lacks a persistence value visible shortly before seizure. Adjacent transaction-log files are available. What is the most appropriate examination method?

53 A Chromium History database was copied from a running system without its companion files. SQLite examination shows no record of a visit observed minutes before collection. Which omission most likely explains the discrepancy?

54 A recent Chromium version stores cookie values using an AES key that is itself protected by Windows DPAPI in the browser's Local State file. Which evidence is needed for offline decryption?

55 An NTFS file has a recent $STANDARD_INFORMATION modification time but an older $FILE_NAME modification time. Other evidence suggests timestomping. Which interpretation is most accurate?

56 A suspect file's unnamed NTFS $DATA stream hashes to a known benign utility, but its allocated size is larger than expected and execution artifacts reference utility.exe:run. What should be examined next?

57 An IIS text log changes its #Fields directive after a configuration update. A parser applies the first header to every subsequent record. What is the principal forensic risk?

58 A Windows application log is UTF-16LE with a byte-order mark. A byte-oriented ASCII search reports no occurrences of a known command that is visibly present in a text editor. What is the sound response?

59 Which evidence most directly supports a successful Remote Desktop interactive logon rather than an ordinary network-share authentication?

60 A local Security EVTX file begins at record ID 9000, while an earlier backup ends at record ID 7000. There is no local event 1102. Which conclusion is most defensible?