Digital Forensics (Security+) Evidence Preservation Quiz

Submit

2. True or False: A forensic examiner must be certified to testify as an expert witness in court.

True

False

3. Which of the following violates proper evidence handling procedures?

Using a write blocker during acquisition

Documenting the chain of custody

Connecting the suspect's device to the internet for analysis

Creating hash values for verification

Submit

5. What is the purpose of creating a forensic report?

To document findings and support legal proceedings

To hide evidence from opposing counsel

To modify evidence interpretations

To speed up the investigation process

6. True or False: It is acceptable to analyze digital evidence directly on the original device if time is limited.

True

False

7. Which forensic tool is commonly used for disk imaging and analysis?

Notepad

Autopsy or EnCase

Microsoft Word

Google Chrome

Submit

9. What type of storage is most appropriate for preserving digital evidence long-term?

External USB drives in an office

Secure, climate-controlled evidence storage with access logs

Personal laptops

Cloud storage without encryption

10. Which of the following is a valid reason to create a forensic image of a device?

To avoid examining the original evidence

To allow multiple analysts to review the same data

To ensure the original device is not modified

All of the above

11. What is the primary goal of digital forensics in a cybersecurity investigation?

To recover deleted files for personal use

To preserve, identify, and analyze digital evidence while maintaining integrity

To delete malware from infected systems

To access password-protected accounts

12. When documenting a crime scene, which step should be performed first?

Collect all devices

Take photographs and video of the scene

Interview witnesses

Begin analysis of evidence

13. What is the primary purpose of a forensic working copy?

To modify evidence for analysis

To preserve the original evidence while allowing safe analysis

To delete sensitive data

To share evidence with unauthorized personnel

14. Which hashing algorithm is most commonly used in forensic investigations?

MD5

SHA-256

Both MD5 and SHA-256

ROT-13

Submit

16. What does a write blocker prevent?

Unauthorized network access

Data modification during acquisition

Password entry attempts

File compression

17. Which of the following is NOT a valid forensic imaging method?

Bit-by-bit clone

Logical backup

Physical copy

Random deletion

18. When acquiring a suspect's hard drive, what should be done first?

Power down the system immediately

Make a forensic image without powering down

Document the current state and photograph the system

Install forensic software on the drive

19. What is chain of custody in digital forensics?

A list of all employees in the organization

A documented record of evidence control from collection through presentation

The physical location where evidence is stored

A legal agreement between parties

20. Which principle ensures that evidence has not been altered or tampered with during collection and handling?

Authentication

Integrity

Availability

Confidentiality

Forensics Quiz: Can You Preserve the Evidence?

1. A forensic examiner must maintain ____ when handling digital evidence.

2.

What first name or nickname would you like us to use?

2. True or False: A forensic examiner must be certified to testify as an expert witness in court.

3. Which of the following violates proper evidence handling procedures?

4. Data recovery from a formatted drive is possible because the ____ is not immediately overwritten.

5. What is the purpose of creating a forensic report?

6. True or False: It is acceptable to analyze digital evidence directly on the original device if time is limited.

7. Which forensic tool is commonly used for disk imaging and analysis?

8. In digital forensics, the ____ is the original device or media from which evidence is acquired.

9. What type of storage is most appropriate for preserving digital evidence long-term?

10. Which of the following is a valid reason to create a forensic image of a device?

11. What is the primary goal of digital forensics in a cybersecurity investigation?

12. When documenting a crime scene, which step should be performed first?

13. What is the primary purpose of a forensic working copy?

14. Which hashing algorithm is most commonly used in forensic investigations?

15. Hash values are primarily used in digital forensics to verify ____.

16. What does a write blocker prevent?

17. Which of the following is NOT a valid forensic imaging method?

18. When acquiring a suspect's hard drive, what should be done first?

19. What is chain of custody in digital forensics?

20. Which principle ensures that evidence has not been altered or tampered with during collection and handling?