Digital Forensics Process (Security+) Quiz

1. What is the primary purpose of the 'chain of custody' document?

To summarize forensic findings

To track who handled evidence and when

To encrypt sensitive evidence

To delete unnecessary files

Submit

4. What should be done with evidence after a forensic investigation concludes?

Destroy it immediately

Store it securely according to legal requirements

Share it publicly

Overwrite it with random data

5. Which file system is commonly found on Windows systems and stores file metadata?

Ext4

NTFS

APFS

FAT32

6. What is 'NIST' guidance primarily used for in digital forensics?

Establishing standards and best practices

Encrypting evidence

Deleting compromised data

Monitoring network traffic

7. How should a forensic examiner document their investigation process?

Write a summary after completing analysis

Maintain detailed notes throughout the investigation

Record findings only if findings are conclusive

Document only the final conclusions

8. What is 'steganography' in the context of digital forensics?

Hiding data within other files or media

Encrypting files with strong algorithms

Deleting files securely

Backing up evidence copies

9. Which forensic tool is commonly used for examining deleted files and disk sectors?

Wireshark

EnCase or FTK Imager

Burp Suite

Nmap

10. In forensic analysis, what does 'slack space' contain?

Unallocated disk space between files

Deleted file remnants

Operating system files

Temporary cache data

11. What is the primary goal of digital forensics?

Preserve and analyze digital evidence for legal proceedings

Prevent all cybersecurity incidents

Develop new encryption algorithms

Monitor network traffic in real-time

12. Which of the following is a proper forensic imaging technique?

Creating a physical copy by copying files manually

Creating a bit-by-bit clone of the entire storage device

Backing up only important files

Compressing data before imaging

13. Before imaging a hard drive, which step should be taken first?

Power off the device immediately

Document the device state and photograph it

Remove the hard drive

Run antivirus software

14. What does 'volatility' refer to in digital forensics?

The stability of storage media

Data that is lost when power is removed

The speed of data recovery

Encryption strength variations

15. Which hash algorithm is most commonly used to verify evidence integrity?

MD5

SHA-256

Both MD5 and SHA-256

Base64

16. What is 'data carving' in digital forensics?

Physically removing hard drive components

Recovering files by searching for file signatures

Encrypting recovered data

Deleting evidence trails

17. Which file system artifact helps identify when a file was last accessed?

Master Boot Record

Metadata timestamps

Partition table

Boot sector

18. When should evidence be documented in a forensic investigation?

After all analysis is complete

Immediately upon discovery

Only if it proves guilt

During the final report stage

19. What does the 'write blocker' tool prevent during forensic imaging?

Reading from the source device

Any modifications to the original storage device

Transferring data to external drives

Encrypting sensitive files

20. Which principle ensures evidence integrity throughout the forensic investigation?

Data minimization

Chain of custody

Network segmentation

Access control list

Forensics Quiz: Can You Ace It?