DFL Quiz 1

At which stage of the digital forensics process would a write-blocker be used?

• Acquisition

• Reporting

• Verification

• Analysis

Which three of the following statement s describes forensic readiness?

• How prepared a digital forensic investigator is to present their evidence in a court of law

• How easy it is for the digital forensic investigator to find evidence which proves that someone is guilty

• A machine which has been imaged for the forensic purposes

• How prepared an organisation is to respond to an incident

Which two of the following statements describing the steps in the digital forensic process are true?

• The steps can be completed in any order.

• The are laws explaining how the steps must be completed.

• The steps must be completed in the order of accusation, analysis and reporting.

• There are guidelines explaining how the steps should be completed.

Which two of the following software tools could be used during the analysis phase of the digital forensics process?

• A word processor

• A hex-editor

• A network packet analyser

• A file encryption tool

Which two of the following are the role of the reporting stage of the digital forensic process?

• The report describes the evidence which was obtained from the investigation.

• The report is used to work out how much money to pay the investigator.

• The report describes the investigation so that it can be understood by a non-technical person.

• The report states whether or no the accused is guilty.

_______ is the practice of concealing a file, message, image, or video within another file, message, image, or video.

• Steganography

• Cryptography

• File hidding

• Media Analysis

Developed Rapid Action Imaging Device(RAID) to make forensically sound disk copies

• DIBS USA

• ProDiscover

• EnCase

• ILook

Which of the following is FALSE

• A. The digital forensic investigator must maintain absolute objectivity

• B. It is the investigator’s job to determine someone’s guilt or innocence.

• C. It is the investigator’s responsibility to accurately report the relevant facts of a case.

• D. The investigator must maintain strict confidentiality, discussing the results of an investigation on only a “need to know” basis

A keyword search is part of the analysis process within what forensic function?

A. reporting

B. reconstruction

C. extraction

D. acquisition

• A

• B

• C

• D

This format acquisition can't share an image between different vendors' forensic analysis tools

• AFF

• raw

• proprietary

• AFD