DFIM (Extraction and Preservation)

Which of the following is the first step in the digital forensic investigation methodology?

• Evidence Collection

• Analysis

• Reporting

• Preservation

Which of the following tools can be used for imaging the hard disk of a computer system?

• Photoshop

• EnCase

• VLC

• Microsoft Word

In the digital forensic investigation methodology, what is the primary objective of the preservation phase?

• To acquire the evidence

• To maintain the integrity of the evidence

• To analyze the evidence

• To report the findings

In the digital forensic investigation methodology, what is the role of the chain of custody?

• To prevent tampering of the evidence

• To identify the suspect

• To analyze the evidence

• To report the findings

Which of the following is an example of non-volatile data?

• Cache memory

• Temporary internet files

• Hard disk

• RAM memory

Which of the following is a common tool used for digital forensic investigations?

• Microsoft Excel

• FTK Imager

• Google Chrome

• Discord