Back to Subject

Unit 1: Computer Forensics and Investigation Process - Practice Quiz

INT250 — Digital Evidence Analysis 50 Questions
0 Correct 0 Wrong 50 Left
0/50

1 What is the primary definition of computer forensics?

A. The process of hacking into computer systems to test security
B. The application of computer investigation and analysis techniques in the interest of determining potential legal evidence
C. The repair of damaged computer hardware to recover lost data
D. The monitoring of network traffic for marketing purposes

2 Which legal principle states that evidence must be gathered in a way that allows the court to verify its origin and integrity?

A. Miranda Rights
B. Chain of Custody
C. Hearsay Rule
D. Double Jeopardy

3 In the context of cybercrimes, what distinguishes a 'computer as a target' crime from a 'computer as a tool' crime?

A. Target crimes attack the system's integrity (e.g., DDoS); tool crimes use the computer to commit other offenses (e.g., fraud)
B. Target crimes involve theft of hardware; tool crimes involve software piracy
C. There is no difference; they are legal synonyms
D. Target crimes are civil; tool crimes are criminal

4 Which of the following best describes 'Forensic Readiness'?

A. Keeping all servers offline to prevent attacks
B. The ability of an organization to maximize its potential to use digital evidence while minimizing the costs of an investigation
C. The process of training all employees to be forensic investigators
D. Buying the most expensive forensic software available

5 What is the primary role of a Security Operations Center (SOC) in relation to computer forensics?

A. To conduct full legal prosecutions
B. To write legislation regarding cybercrime
C. To repair broken hardware in the office
D. To monitor, detect, and respond to security incidents, often providing the initial data for forensic analysis

6 According to the Order of Volatility, which data should be collected first?

A. CPU registers and cache
B. Temporary file systems
C. Hard disk drive data
D. Archival media (Backup tapes)

7 What is the primary purpose of a hardware Write Blocker?

A. To encrypt the data being copied
B. To prevent the forensic workstation from modifying data on the suspect drive
C. To speed up the data transfer process
D. To compress the evidence files

8 What does Locard's Exchange Principle state in the context of digital forensics?

A. Data can never be fully deleted
B. Anyone entering a digital scene leaves a trace, and takes something with them
C. Encryption is impossible to break without a key
D. All evidence must be printed on paper

9 Which phase of the investigation involves obtaining a search warrant?

A. Pre-investigation Phase
B. Analysis Phase
C. Post-investigation Phase
D. Reporting Phase

10 What is a 'Bit-stream image'?

A. A compressed zip folder of the My Documents folder
B. A sector-by-sector copy of the hard drive, including hidden and deleted data
C. A copy of only the active files on a disk
D. A screenshot of the desktop

11 Who is typically the 'First Responder' in a computer forensic scenario?

A. The suspect
B. The first person to arrive at the crime scene and assess the situation
C. The CEO of the company
D. The lead judge on the case

12 What is the cardinal rule of computer forensics regarding original evidence?

A. Always work on the original evidence to save time
B. Send the original evidence to the suspect for verification
C. Never work on the original evidence; always work on a forensic copy
D. Modify the original evidence to fix security holes

13 What is the function of a cryptographic hash (like MD5 or SHA-256) in forensics?

A. To formatting the drive for reuse
B. To act as a digital fingerprint to verify data integrity
C. To encrypt the drive so no one can read it
D. To organize files alphabetically

14 Which of the following is a characteristic of 'Civil' investigations compared to 'Criminal' ones?

A. They result in jail time for the offender
B. The standard of proof is 'Beyond a reasonable doubt'
C. They are always conducted by law enforcement
D. They typically involve disputes between individuals or companies regarding contracts or intellectual property

15 What is 'Slack Space'?

A. The space taken up by the operating system
B. The unused space in a disk cluster when a file does not fill the entire cluster
C. The space on a desk where the computer sits
D. The RAM memory used by the web browser

16 In the context of First Response, what should be done if a computer is found powered OFF?

A. Turn it on and immediately copy the My Documents folder
B. Leave it off and secure it
C. Turn it on to see what is on the screen
D. Turn it on to install forensic software

17 What is the primary responsibility of a Forensic Investigator regarding bias?

A. To prove the suspect is innocent
B. To prove the suspect is guilty at all costs
C. To remain objective and report facts regardless of whom they help or hurt
D. To support the client who is paying them

18 What defines 'Digital Evidence'?

A. Information of probative value that is stored or transmitted in binary form
B. Verbal testimony given by a computer user
C. The physical hardware of a laptop only
D. Any printed document found near a computer

19 Which of the following is considered 'Volatile Memory'?

A. Hard Disk Drive
B. RAM (Random Access Memory)
C. USB Flash Drive
D. CD-ROM

20 What is the purpose of 'Bag and Tag'?

A. To identifying, seizing, and securing evidence in appropriate containers to preserve integrity
B. To throw away useless hardware
C. To sell the computer equipment
D. To organize cables neatly

21 What is the difference between Incident Response (IR) and Computer Forensics?

A. IR focuses on containment and recovery; Forensics focuses on analysis and legal evidence
B. There is no difference
C. IR happens in court; Forensics happens in the lab
D. IR is for hardware; Forensics is for software

22 Which tool is used to block radio signals from reaching a mobile device after seizure?

A. Faraday Bag
B. Write Blocker
C. Anti-static wrist strap
D. Hashing Algorithm

23 What is 'Steganography'?

A. The process of deleting files permanently
B. A type of computer virus
C. The practice of hiding data within other files (like images or audio)
D. The study of dinosaur bones

24 During the Pre-investigation phase, what is the importance of risk assessment?

A. To guess who the suspect is
B. To check the weather forecast
C. To identify potential hazards (biological, electrical, chemical) at the crime scene
D. To determine how much to charge the client

25 What is 'Live Acquisition'?

A. Interviewing a suspect live
B. Acquiring data from a computer that is powered on and running
C. Acquiring data from a dead drive
D. Streaming the investigation on social media

26 Which file system artifact allows an investigator to see which programs were recently executed?

A. The Printer Spool
B. Prefetch Files
C. The Hosts file
D. The Recycle Bin

27 What is the 'Best Evidence Rule'?

A. Evidence found on a server is better than a laptop
B. The most expensive evidence is the best
C. Courts prefer the original evidence (or an accurate duplicate) rather than a copy or oral testimony
D. Evidence found by the police is always best

28 What is the final phase of the Computer Forensics Investigation Process?

A. Analysis
B. Reporting
C. Acquisition
D. Identification

29 Why is 'documentation' critical throughout the investigation process?

A. To improve typing speed
B. To ensure the investigation can be repeated and validated by a third party
C. To increase the billable hours
D. To share with the press

30 What does a SIEM (Security Information and Event Management) system do in a SOC?

A. It aggregates and analyzes log data from various sources to detect security threats
B. It is an email client
C. It is used to physically lock doors
D. It acts as a backup generator

31 Which of the following is an example of 'Metadata'?

A. The pixels in an image
B. The sound waves in an MP3
C. The date created, date modified, and author of a file
D. The text content of a Word document

32 When photographing a crime scene, what is the best practice?

A. Take one photo of the room and leave
B. Selfies with the evidence
C. Take photos of the entire scene, including connections, cable positions, and serial numbers
D. Photograph the computer screen only

33 What is 'Anti-forensics'?

A. Tools or techniques used to frustrate or prevent forensic analysis (e.g., data wiping, encryption)
B. The study of law
C. Old school investigation methods
D. A group of people against technology

34 In a criminal investigation, who carries the 'Burden of Proof'?

A. The Defense
B. The Jury
C. The Prosecution
D. The Suspect

35 What is the definition of 'Unallocated Space'?

A. Space on the hard drive that has never been used
B. The space occupied by the Operating System
C. Disk space that is currently not flagged as in use by the file system, but may contain deleted data
D. Broken sectors on a hard drive

36 Which organization typically creates the 'Search Warrant'?

A. The Forensic Investigator
B. The Victim
C. Law Enforcement / The Court
D. The Internet Service Provider

37 What is the primary risk of pulling the plug (abrupt shutdown) on a server?

A. It alerts the hacker
B. It saves too much data
C. It uses too much electricity
D. It might corrupt the file system and result in loss of volatile data (RAM)

38 What role does an 'Expert Witness' play in court?

A. They defend the accused
B. They decide the verdict
C. They prosecute the accused
D. They assist the judge/jury in understanding complex technical evidence through their specialized knowledge

39 Which of the following is a key component of a Forensic Report?

A. Marketing material for the forensic firm
B. A list of the investigator's favorite software
C. Executive Summary, Methodology, Findings, and Conclusion
D. Personal opinions about the suspect's character

40 What is 'Data Wiping'?

A. Cleaning the computer screen with a cloth
B. Deleting a file to the Recycle Bin
C. Formatting a disk
D. Overwriting data multiple times to make it unrecoverable

41 What is the role of the 'Evidence Custodian'?

A. To manage the secure storage and log the entry/exit of evidence in the storage facility
B. To repair the evidence
C. To arrest the suspect
D. To analyze the evidence

42 Why is 'Timeline Analysis' important?

A. It predicts future crimes
B. It reconstructs events in chronological order to understand the sequence of the attack
C. It sorts files by file size
D. It tells the investigator when to take a lunch break

43 What is the difference between 'Static' and 'Dynamic' analysis?

A. Static is for Windows; Dynamic is for Linux
B. Static is fast; Dynamic is slow
C. Static uses electricity; Dynamic does not
D. Static analyzes the system at rest (off); Dynamic analyzes the system while running (behavior)

44 Which of the following describes an 'Internal Threat'?

A. A lightning strike
B. A virus from a website
C. A disgruntled employee misusing their access privileges
D. A hacker from another country

45 What is 'Logical Acquisition'?

A. Guessing the password logically
B. Extracting specific files and objects (like photos or chats) accessible by the file system
C. Drawing a picture of the drive
D. Copying the entire physical drive bit-by-bit

46 In the context of SOC, what is 'Triage'?

A. Deleting all infected files immediately
B. The initial assessment to prioritize incidents based on severity and potential impact
C. Calling the police
D. Fixing the computer completely

47 What should an investigator do if they accidentally alter the evidence?

A. Blame the software
B. Hide the mistake
C. Document the alteration and explain how and why it happened
D. Quit the investigation

48 What does the term 'Admissibility' refer to?

A. Whether the evidence meets legal standards to be presented in court
B. The speed of the computer
C. Whether the investigator is hired
D. The cost of the investigation

49 Which is a common challenge in Cloud Forensics compared to traditional Computer Forensics?

A. Cloud data is always unencrypted
B. There is no difference
C. Cloud computers are too slow
D. Physical access to the storage hardware is often impossible or restricted

50 What is the purpose of 'Keyword Searching' in the Analysis phase?

A. To locate specific terms (e.g., names, credit card numbers) within the massive amount of data
B. To unlock encrypted files
C. To rename files
D. To find the investigator's keys
Next MCQ
Unit 2