Forensics Quiz

Which of the following are characteristics of digital evidence necessary for court acceptance? (Select all that apply)

• Reliable

• Complete

• Timely

• Authentic

Which of the following is an example of non-volatile memory? (Select all that apply)

• SD Card

• Hard Disk

• RAM

• Cache Memory

These store specific data about the applications run on a system.

• Shellbags

• Armcache

• Prefetch

• LNK Files

A technique for hiding information within files or data is:

• PKI

• hashing

• cryptography

• steganography

Which of the following are common Forensic image file formats? (Select all that apply)

• AFF

• RAW

• E01

• NTFS

Which Volatility modules can be used to display running processes? (Select 3)

• psscan

• pslist

• psmap

• pstree

A record of evidence documentation that begins with discovering evidence at the crime scene and ends with the completion of the investigation.

• Memory Analysis

• Chain of Custody

• Data Acquisition

• Forensic Procedures

A technique for recovering deleted information from RAW data.

• timeline analysis

• data carving

• data extraction

• autopsy

These record when a user account accesses directories via Windows Explorer.

• Shellbags

• Armcache

• Prefetch

• Event Logs

Which Linux command-line tool is used for searching a given binary image for embedded files and executable code.

• IDA

• binwalk

• hydra

• scalpel