INT250 Unit 3: Data Acquisition, Duplication and Windows Forensics - MCQ Practice | B. Tech. CSE

1 $Which of the following best describes a 'bit-stream' image in digital forensics?$

A.

A compressed folder of the user's documents

B.

A logical backup of the Windows Registry

C.

A file containing only the active files from a hard drive

D.

A bit-by-bit copy of the source drive, including unallocated space and slack space

2 $In the context of the Order of Volatility, which data should be collected first?$

A.

CPU cache, registers, and RAM

B.

Temporary file systems

C.

Disk data (Hard Drive)

D.

Archival media (CDs/DVDs)

3 $Which hardware device is essential during static data acquisition to prevent data alteration on the source drive?$

A.

Write Blocker

B.

Network Tap

C.

Packet Sniffer

D.

Hex Editor

4 $Which file format is considered a 'raw' forensic image format?$

A.

.E01

B.

.dd

C.

.vmdk

D.

.ad1

5 $What is the primary purpose of generating a hash value (MD5 or SHA) immediately after data acquisition?$

A.

To verify the integrity of the evidence

B.

To encrypt the image for security

C.

To compress the image size

D.

To index the files for searching

6 $Which acquisition method is necessary when a computer cannot be shut down due to encryption or critical service availability?$

A.

Live Acquisition

B.

Sparse Acquisition

C.

Static Acquisition

D.

Dead Acquisition

7 $Where is the 'SAM' (Security Account Manager) hive located in a Windows system?$

A.

C:\Windows\System

B.

C:\Windows\System32\config

C.

C:\Program Files\Windows

D.

C:\Users\Default

8 $Which Windows artifact is essentially a snapshot of the contents of RAM saved to the hard drive when a computer is put into hibernation?$

A.

hiberfil.sys

B.

swapfile.sys

C.

config.sys

D.

pagefile.sys

9 $Which Registry hive contains settings specific to the currently logged-in user?$

A.

HKEY_CURRENT_USER

B.

HKEY_USERS

C.

HKEY_CLASSES_ROOT

D.

HKEY_LOCAL_MACHINE

10 $Which Windows artifact allows an investigator to see which applications were recently executed and the frequency of execution?$

A.

Prefetch files

B.

Cookies

C.

Hosts file

D.

SAM hive

11 $In Windows 10/11, where are Windows Event Logs typically stored?$

A.

C:\Windows\System32\winevt\Logs

B.

C:\ProgramData\Logs

C.

C:\Windows\Events

D.

C:\Windows\Logs

12 $Which browser artifact stores a small piece of data sent from a website to remember stateful information (like login status)?$

A.

Cookie

B.

Bookmark

C.

Cache

D.

History

13 $What is the function of the Windows 'Pagefile.sys'?$

A.

It stores printer spooling data

B.

It acts as virtual memory, extending physical RAM

C.

It records all keystrokes

D.

It stores the boot configuration

14 $Which proprietary file format, developed by Guidance Software, is standard for forensic images and supports compression and encryption?$

A.

AFF

B.

ISO

C.

DD

D.

E01

15 $When analyzing the Recycle Bin on Windows 10, which file contains the original filename and deletion date?$

A.

INFO2

B.

$I file

C.

Desktop.ini

D.

$R file

16 $Which Windows Event Log ID is commonly associated with a successful user logon?$

A.

6005

B.

4624

C.

4625

D.

1102

17 $What is 'Slack Space'?$

A.

The space on a hard drive reserved for the OS

B.

The RAM allocated to the GPU

C.

The unused space between the end of a file and the end of the cluster

D.

The space used by the Recycle Bin

18 $Which registry key is typically analyzed to determine which USB devices have been connected to the system?$

A.

HKLM\SOFTWARE\Microsoft\Windows\Run

B.

HKLM\SAM\Domains

C.

HKCU\Software\Microsoft\Internet Explorer

D.

HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR

19 $What does the term 'Logical Acquisition' refer to?$

A.

Copying only the RAM

B.

Copying the physical drive bit-by-bit

C.

Copying only the files and folders visible to the operating system

D.

Copying data via a logic analyzer

20 $Which artifact typically stores the user's browsing history in Google Chrome?$

A.

places.sqlite

B.

index.dat

C.

WebCache.dat

D.

History (SQLite database)

21 $What is the purpose of 'Web Cache' or 'Temporary Internet Files'?$

A.

To block malicious pop-ups

B.

To store user passwords encrypted

C.

To record a log of all visited websites

D.

To speed up browsing by storing static web content like images locally

22 $Which Windows Registry key is known as a 'Run key' used for persistence (starting programs automatically)?$

A.

Software\Policies\Microsoft\Windows

B.

System\Setup\Status

C.

Software\Microsoft\Windows\CurrentVersion\Run

D.

System\CurrentControlSet\Control\Lsa

23 $What is the difference between 'Volatile' and 'Non-volatile' memory?$

A.

Non-volatile memory cannot be imaged

B.

Volatile memory is slower

C.

Volatile memory is stored on the hard drive

D.

Volatile memory loses data when power is cut; Non-volatile retains it

24 $Which file system artifact tracks the date and time a user last accessed a specific folder structure or window preference?$

A.

Thumbcache

B.

Amcache

C.

Jump Lists

D.

Shellbags

25 $What is an LNK file?$

A.

A system link file for network drivers

B.

A log file for kernel errors

C.

A locked file in the registry

D.

A Windows shortcut file that links to an application or file

26 $Which command line tool is built into Windows and can be used to query the registry?$

A.

netstat

B.

ipconfig

C.

grep

D.

reg query

27 $Which of the following is considered 'metadata' of a file?$

A.

The text inside a text file

B.

The actual content of a Word document

C.

The pixel data of an image

D.

The creation, modification, and access timestamps

28 $Why is 'Incognito' or 'Private' browsing mode a challenge for forensics?$

A.

It prevents the ISP from seeing traffic

B.

It does not save history, cookies, or cache to the hard drive upon closing

C.

It encrypts the internet connection

D.

It routes traffic through the Dark Web

29 $What is the 'Master File Table' (MFT)?$

A.

A log of all master users

B.

A partition table for the hard drive

C.

A backup of the BIOS

D.

A database in NTFS that stores information about every file and directory

30 $Which registry hive corresponds to the file 'NTUSER.DAT'?$

A.

HKEY_LOCAL_MACHINE

B.

HKEY_CURRENT_USER

C.

HKEY_CURRENT_CONFIG

D.

HKEY_USERS

31 $In a live acquisition, which tool is commonly used to capture RAM?$

A.

FTK Imager

B.

Photoshop

C.

Wireshark

D.

RegEdit

32 $What is a 'Sparse Copy'?$

A.

A copy containing only allocated data and ignoring unallocated space

B.

A copy of only the registry

C.

A copy made using a write blocker

D.

A copy of data spread across multiple disks

33 $Which text-based log file is generated by the IIS (Internet Information Services) web server?$

A.

Kernel Log

B.

W3C Extended Log

C.

Event Viewer Log

D.

Syslog

34 $The 'UserAssist' registry key provides information about:$

A.

Installed USB devices

B.

User passwords

C.

GUI-based programs run by the user

D.

Network connections

35 $What is 'Alternate Data Stream' (ADS) in Windows NTFS?$

A.

A corrupt file segment

B.

A backup stream for internet data

C.

A method for streaming video

D.

A feature allowing data to be hidden behind a file without changing the file size

36 $Which artifact lists files that were present on the system before a reboot or shutdown, often used to identify malware execution upon boot?$

A.

ShimCache (AppCompatCache)

B.

Thumb.db

C.

Recycle Bin

D.

Jump Lists

37 $What does Event ID 4625 represent in the Windows Security Log?$

A.

System shutdown

B.

Successful Logon

C.

An account was locked out

D.

An account failed to log on

38 $In the context of browser forensics, what is 'Form Data'?$

A.

The structure of the HTML page

B.

The digital signature of the browser

C.

Information entered by the user into web fields (names, addresses, search terms)

D.

The encryption key for SSL

39 $Which system file contains the mapping of IP addresses to hostnames, often modified by malware to redirect users?$

A.

networks

B.

services.exe

C.

hosts

D.

protocol

40 $What is the primary difference between Copy and Bit-stream Image?$

A.

Copy is faster; Image is slower

B.

Copy captures only active file content; Image captures the exact state of the drive

C.

Copy is compressed; Image is not

D.

There is no difference

41 $Which tool is commonly used to analyze Windows Registry hives?$

A.

Paint

B.

Wireshark

C.

Registry Viewer

D.

Notepad

42 $What is the function of the 'SYSTEM' hive?$

A.

Stores internet history

B.

Stores system configuration, driver settings, and hardware profiles

C.

Stores file extensions

D.

Stores user settings

43 $Which metadata standard is commonly found in image files (JPEG) containing camera model and GPS coordinates?$

A.

EXIF

B.

FAT

C.

NTFS

D.

ASCII

44 $When preparing a drive for an image, what should be done to the destination drive?$

A.

It should be smaller than the source drive

B.

It should contain the operating system

C.

It should be forensically wiped (sterilized)

D.

It should be defragmented

45 $What is 'Unallocated Space'?$

A.

Space reserved for the system

B.

Space that is damaged

C.

Space used by hidden files

D.

Space on the drive not currently assigned to any active file by the file system

46 $Which artifact is created when a user right-clicks the taskbar icon of an application to see recent files?$

A.

Shortcut

B.

Logfile

C.

Jumplist

D.

Prefetch

47 $In Windows Event Logs, what does the 'System' log record?$

A.

Security audits like logins

B.

Internet history

C.

Events logged by Windows system components (drivers, boot errors)

D.

Events logged by applications

48 $Why is 'Time Zone' information critical during analysis?$

A.

To calculate the internet speed

B.

To decrypt files

C.

To convert UTC timestamps in artifacts to the local time of the suspect

D.

To determine the language of the OS

49 $Which registry value controls the time zone information of the system?$

A.

HardwareProfiles

B.

TimeZoneInformation

C.

ControlSet

D.

CurrentVersion

50 $Which of the following describes a 'Static Acquisition'?$

A.

Acquisition performed while the user is typing

B.

Acquisition via a network connection

C.

Acquisition of RAM only

D.

Acquisition performed on a system that is powered off

Unit 3: Data Acquisition, Duplication and Windows Forensics - Practice Quiz

Did this save you a night before the exam?