Back to Subject

Unit 1: Computer Forensics and Investigation Process - Practice Quiz

INT250 — Digital Evidence Analysis 50 Questions
0 Correct 0 Wrong 50 Left
0/50

1 What is the primary definition of computer forensics?

A. The application of computer investigation and analysis techniques in the interest of determining potential legal evidence
B. The process of hacking into computer systems to test security
C. The monitoring of network traffic for marketing purposes
D. The repair of damaged computer hardware to recover lost data

2 Which legal principle states that evidence must be gathered in a way that allows the court to verify its origin and integrity?

A. Hearsay Rule
B. Miranda Rights
C. Double Jeopardy
D. Chain of Custody

3 In the context of cybercrimes, what distinguishes a 'computer as a target' crime from a 'computer as a tool' crime?

A. Target crimes attack the system's integrity (e.g., DDoS); tool crimes use the computer to commit other offenses (e.g., fraud)
B. There is no difference; they are legal synonyms
C. Target crimes are civil; tool crimes are criminal
D. Target crimes involve theft of hardware; tool crimes involve software piracy

4 Which of the following best describes 'Forensic Readiness'?

A. Buying the most expensive forensic software available
B. Keeping all servers offline to prevent attacks
C. The ability of an organization to maximize its potential to use digital evidence while minimizing the costs of an investigation
D. The process of training all employees to be forensic investigators

5 What is the primary role of a Security Operations Center (SOC) in relation to computer forensics?

A. To repair broken hardware in the office
B. To write legislation regarding cybercrime
C. To monitor, detect, and respond to security incidents, often providing the initial data for forensic analysis
D. To conduct full legal prosecutions

6 According to the Order of Volatility, which data should be collected first?

A. Archival media (Backup tapes)
B. Temporary file systems
C. Hard disk drive data
D. CPU registers and cache

7 What is the primary purpose of a hardware Write Blocker?

A. To encrypt the data being copied
B. To prevent the forensic workstation from modifying data on the suspect drive
C. To compress the evidence files
D. To speed up the data transfer process

8 What does Locard's Exchange Principle state in the context of digital forensics?

A. Anyone entering a digital scene leaves a trace, and takes something with them
B. Encryption is impossible to break without a key
C. Data can never be fully deleted
D. All evidence must be printed on paper

9 Which phase of the investigation involves obtaining a search warrant?

A. Reporting Phase
B. Pre-investigation Phase
C. Analysis Phase
D. Post-investigation Phase

10 What is a 'Bit-stream image'?

A. A screenshot of the desktop
B. A compressed zip folder of the My Documents folder
C. A copy of only the active files on a disk
D. A sector-by-sector copy of the hard drive, including hidden and deleted data

11 Who is typically the 'First Responder' in a computer forensic scenario?

A. The suspect
B. The CEO of the company
C. The lead judge on the case
D. The first person to arrive at the crime scene and assess the situation

12 What is the cardinal rule of computer forensics regarding original evidence?

A. Modify the original evidence to fix security holes
B. Send the original evidence to the suspect for verification
C. Always work on the original evidence to save time
D. Never work on the original evidence; always work on a forensic copy

13 What is the function of a cryptographic hash (like MD5 or SHA-256) in forensics?

A. To organize files alphabetically
B. To formatting the drive for reuse
C. To act as a digital fingerprint to verify data integrity
D. To encrypt the drive so no one can read it

14 Which of the following is a characteristic of 'Civil' investigations compared to 'Criminal' ones?

A. They are always conducted by law enforcement
B. They result in jail time for the offender
C. They typically involve disputes between individuals or companies regarding contracts or intellectual property
D. The standard of proof is 'Beyond a reasonable doubt'

15 What is 'Slack Space'?

A. The space taken up by the operating system
B. The space on a desk where the computer sits
C. The RAM memory used by the web browser
D. The unused space in a disk cluster when a file does not fill the entire cluster

16 In the context of First Response, what should be done if a computer is found powered OFF?

A. Leave it off and secure it
B. Turn it on to see what is on the screen
C. Turn it on and immediately copy the My Documents folder
D. Turn it on to install forensic software

17 What is the primary responsibility of a Forensic Investigator regarding bias?

A. To prove the suspect is innocent
B. To remain objective and report facts regardless of whom they help or hurt
C. To prove the suspect is guilty at all costs
D. To support the client who is paying them

18 What defines 'Digital Evidence'?

A. Any printed document found near a computer
B. Information of probative value that is stored or transmitted in binary form
C. Verbal testimony given by a computer user
D. The physical hardware of a laptop only

19 Which of the following is considered 'Volatile Memory'?

A. RAM (Random Access Memory)
B. Hard Disk Drive
C. USB Flash Drive
D. CD-ROM

20 What is the purpose of 'Bag and Tag'?

A. To sell the computer equipment
B. To throw away useless hardware
C. To organize cables neatly
D. To identifying, seizing, and securing evidence in appropriate containers to preserve integrity

21 What is the difference between Incident Response (IR) and Computer Forensics?

A. IR focuses on containment and recovery; Forensics focuses on analysis and legal evidence
B. There is no difference
C. IR is for hardware; Forensics is for software
D. IR happens in court; Forensics happens in the lab

22 Which tool is used to block radio signals from reaching a mobile device after seizure?

A. Write Blocker
B. Hashing Algorithm
C. Anti-static wrist strap
D. Faraday Bag

23 What is 'Steganography'?

A. A type of computer virus
B. The study of dinosaur bones
C. The practice of hiding data within other files (like images or audio)
D. The process of deleting files permanently

24 During the Pre-investigation phase, what is the importance of risk assessment?

A. To guess who the suspect is
B. To identify potential hazards (biological, electrical, chemical) at the crime scene
C. To determine how much to charge the client
D. To check the weather forecast

25 What is 'Live Acquisition'?

A. Acquiring data from a dead drive
B. Interviewing a suspect live
C. Acquiring data from a computer that is powered on and running
D. Streaming the investigation on social media

26 Which file system artifact allows an investigator to see which programs were recently executed?

A. The Recycle Bin
B. The Printer Spool
C. The Hosts file
D. Prefetch Files

27 What is the 'Best Evidence Rule'?

A. The most expensive evidence is the best
B. Courts prefer the original evidence (or an accurate duplicate) rather than a copy or oral testimony
C. Evidence found by the police is always best
D. Evidence found on a server is better than a laptop

28 What is the final phase of the Computer Forensics Investigation Process?

A. Identification
B. Reporting
C. Analysis
D. Acquisition

29 Why is 'documentation' critical throughout the investigation process?

A. To increase the billable hours
B. To improve typing speed
C. To share with the press
D. To ensure the investigation can be repeated and validated by a third party

30 What does a SIEM (Security Information and Event Management) system do in a SOC?

A. It is an email client
B. It acts as a backup generator
C. It aggregates and analyzes log data from various sources to detect security threats
D. It is used to physically lock doors

31 Which of the following is an example of 'Metadata'?

A. The date created, date modified, and author of a file
B. The pixels in an image
C. The sound waves in an MP3
D. The text content of a Word document

32 When photographing a crime scene, what is the best practice?

A. Take photos of the entire scene, including connections, cable positions, and serial numbers
B. Take one photo of the room and leave
C. Selfies with the evidence
D. Photograph the computer screen only

33 What is 'Anti-forensics'?

A. The study of law
B. Tools or techniques used to frustrate or prevent forensic analysis (e.g., data wiping, encryption)
C. Old school investigation methods
D. A group of people against technology

34 In a criminal investigation, who carries the 'Burden of Proof'?

A. The Suspect
B. The Jury
C. The Defense
D. The Prosecution

35 What is the definition of 'Unallocated Space'?

A. The space occupied by the Operating System
B. Space on the hard drive that has never been used
C. Disk space that is currently not flagged as in use by the file system, but may contain deleted data
D. Broken sectors on a hard drive

36 Which organization typically creates the 'Search Warrant'?

A. The Victim
B. The Forensic Investigator
C. Law Enforcement / The Court
D. The Internet Service Provider

37 What is the primary risk of pulling the plug (abrupt shutdown) on a server?

A. It alerts the hacker
B. It might corrupt the file system and result in loss of volatile data (RAM)
C. It uses too much electricity
D. It saves too much data

38 What role does an 'Expert Witness' play in court?

A. They decide the verdict
B. They defend the accused
C. They prosecute the accused
D. They assist the judge/jury in understanding complex technical evidence through their specialized knowledge

39 Which of the following is a key component of a Forensic Report?

A. Personal opinions about the suspect's character
B. A list of the investigator's favorite software
C. Marketing material for the forensic firm
D. Executive Summary, Methodology, Findings, and Conclusion

40 What is 'Data Wiping'?

A. Formatting a disk
B. Cleaning the computer screen with a cloth
C. Overwriting data multiple times to make it unrecoverable
D. Deleting a file to the Recycle Bin

41 What is the role of the 'Evidence Custodian'?

A. To manage the secure storage and log the entry/exit of evidence in the storage facility
B. To repair the evidence
C. To arrest the suspect
D. To analyze the evidence

42 Why is 'Timeline Analysis' important?

A. It predicts future crimes
B. It reconstructs events in chronological order to understand the sequence of the attack
C. It tells the investigator when to take a lunch break
D. It sorts files by file size

43 What is the difference between 'Static' and 'Dynamic' analysis?

A. Static uses electricity; Dynamic does not
B. Static is fast; Dynamic is slow
C. Static is for Windows; Dynamic is for Linux
D. Static analyzes the system at rest (off); Dynamic analyzes the system while running (behavior)

44 Which of the following describes an 'Internal Threat'?

A. A lightning strike
B. A virus from a website
C. A hacker from another country
D. A disgruntled employee misusing their access privileges

45 What is 'Logical Acquisition'?

A. Copying the entire physical drive bit-by-bit
B. Drawing a picture of the drive
C. Extracting specific files and objects (like photos or chats) accessible by the file system
D. Guessing the password logically

46 In the context of SOC, what is 'Triage'?

A. Fixing the computer completely
B. Deleting all infected files immediately
C. The initial assessment to prioritize incidents based on severity and potential impact
D. Calling the police

47 What should an investigator do if they accidentally alter the evidence?

A. Quit the investigation
B. Document the alteration and explain how and why it happened
C. Blame the software
D. Hide the mistake

48 What does the term 'Admissibility' refer to?

A. The speed of the computer
B. The cost of the investigation
C. Whether the investigator is hired
D. Whether the evidence meets legal standards to be presented in court

49 Which is a common challenge in Cloud Forensics compared to traditional Computer Forensics?

A. Physical access to the storage hardware is often impossible or restricted
B. Cloud computers are too slow
C. Cloud data is always unencrypted
D. There is no difference

50 What is the purpose of 'Keyword Searching' in the Analysis phase?

A. To rename files
B. To locate specific terms (e.g., names, credit card numbers) within the massive amount of data
C. To unlock encrypted files
D. To find the investigator's keys
Next MCQ
Unit 2