A Trivia Quiz On Windows Forensics Analysis!

10 Questions | Total Attempts: 739

SettingsSettingsSettings
Please wait...
A Trivia Quiz On Windows Forensics Analysis!

.


Questions and Answers
  • 1. 
    Which of the statements below, belong to the A.C.P.O Principles? 
    • A. 

      The person in charge of the investigation (case officer) holds no responsibility whatsoever, for ensuring that the law and these principles are adhered to.

    • B. 

      An audit trail or other record of all processes applied to computer-based electronic evidence should be created and preserved. An indepedent third party should be able to examine those processes and achieve the same result.

    • C. 

      No action taken by law enforcement agencies or their agents should change data held on a computer or storage media, which may subsequently be relied upon in court.

    • D. 

      In exceptional circumstances, where a person finds it necessary to access original data held on a computer or storage media, that person is able to do so, regardless of their qualifications or digital forensic knowledge.

  • 2. 
    The Examination & Analysis stage is completed before the Collection & Preservation stage, of the Forensic Process.
    • A. 

      True

    • B. 

      False

  • 3. 
    Which of the below, is the name of one of the two logical root keys, that reside in the system hard drive of the Windows Registry?
    • A. 

      HKEY_LOCAL_MAC

    • B. 

      HKEY_LOCAL_SYSTEM

    • C. 

      HKEY_LOCAL_MACHINE

    • D. 

      HKEY_LOCAL_METRO

  • 4. 
    Which of the following are Registry data types? 
    • A. 

      REG_DWORD

    • B. 

      REG_WINDOWS

    • C. 

      REG_HEX

    • D. 

      REG_SZ

    • E. 

      REG_BINARY

    • F. 

      REG_NONE

  • 5. 
    What is the file extension name for the Setup logs in Windows 7 (Windows logs)?
    • A. 

      .log

    • B. 

      .etl

    • C. 

      .stp

    • D. 

      .set

  • 6. 
    What is the name of one of the most forensically significant Internet Explorer artifacts?
    • A. 

      Index.bat

    • B. 

      Index.data

    • C. 

      Index.dta

    • D. 

      Index.dat

  • 7. 
    Thumbnails are graphical images that represent a file or directory.
    • A. 

      True

    • B. 

      False

  • 8. 
    What is the name of the style given to the Windows 8 GUI (graphical user interface)?
    • A. 

      Mento

    • B. 

      Metro

    • C. 

      Motto

    • D. 

      Micro

  • 9. 
    What are the names of the two paging files used in Windows 8? 
    • A. 

      Swapfile.sys

    • B. 

      Virtualmem.sys

    • C. 

      Pagingfile.sys

    • D. 

      Pagefile.sys

    • E. 

      Pagefile2.sys

  • 10. 
    The $Recycle.Bin folder is located within the Windows. old directory, which is accessible once a machine has been Refreshed, in Windows 8.
    • A. 

      True

    • B. 

      False

Related Topics
Back to Top Back to top