Digital Forensics (CySA+) Memory & Disk Analysis Quiz

1. In disk forensics, what are 'slack space' and 'free space' used for?

Improving disk performance

Hiding evidence of deleted files and residual data

Backing up system files

Encrypting sensitive information

2. In digital forensics, what is the significance of file timestamps (MAC times)?

They encrypt sensitive data

They establish a timeline of user activity and file modifications

They compress forensic images

They repair corrupted sectors

3. What is a primary concern when performing live memory acquisition on a suspect system?

It takes too long

Alerting the suspect or triggering anti-forensic tools

It requires administrator access

It damages the hard drive

4. Which file system journaling feature helps preserve evidence of file modifications?

Boot sector

Partition table

Transaction logs

Backup catalogs

5. In memory forensics, what does 'dump' refer to?

Deleting unnecessary files

A complete copy of RAM contents at a specific moment

Removing malware from a system

Backing up the hard drive

6. What is the primary role of the BIOS/UEFI in forensic investigations?

To store deleted files

To provide boot configuration and system settings data

To encrypt user files

To manage network traffic

7. Which of the following is a valid use of MD5 hashing in digital forensics?

Encrypting evidence files

Verifying forensic image integrity

Recovering deleted data

Compressing file systems

8. In Windows forensics, what does the $Recycle.Bin contain?

Temporary system files

User-deleted files that may be recoverable

Cached network credentials

System event logs

9. What is the primary advantage of using a write-blocker in forensic investigations?

It speeds up data transfer

It prevents accidental modification of evidence

It compresses forensic images

It encrypts sensitive data

10. Which of the following is NOT a valid forensic evidence collection method?

Creating a forensic image with write-blocking

Taking a memory dump before shutdown

Modifying files to remove metadata

Documenting timestamp information

11. Which of the following is the most volatile type of data in a running system?

Hard drive sectors

RAM contents

Backup files

Boot sector

12. What is the purpose of examining the Windows Registry in forensic investigations?

To recover deleted user passwords

To find evidence of user activity and system configuration

To repair corrupted system files

To speed up system performance

13. Which tool is commonly used for memory forensics in incident response?

FTK Imager

Volatility

WinHex

EnCase

14. In forensic analysis, what is a 'hash value' primarily used for?

Encrypting evidence files

Verifying data integrity and detecting changes

Compressing forensic images

Indexing search results

15. What does the Master File Table (MFT) contain in NTFS systems?

Deleted file recovery information only

Metadata about all files and directories

Encrypted passwords

Network configuration data

16. Which file system is most commonly analyzed in Windows forensic investigations?

Ext4

NTFS

HFS+

FAT12

17. What is a key limitation of cold boot forensics?

It cannot preserve volatile data

It requires shutting down the system, losing RAM contents

It only works on Linux systems

It cannot access encrypted drives

18. Which memory acquisition method is best for capturing a live system without shutting it down?

Cold boot analysis

Live memory capture

Hibernation dump

BIOS snapshot

19. In digital forensics, what does the term 'chain of custody' ensure?

Evidence integrity and legal admissibility

Faster analysis time

Automatic data recovery

Encryption of sensitive files

20. What is the primary purpose of taking a forensic image of a disk?

To speed up system recovery

To create a bit-for-bit duplicate for analysis without altering evidence

To compress files for storage

To repair corrupted sectors

CySA+ Forensics Quiz: Can You Master Memory & Disk Analysis?