Forensics Investigator - Quiz Exam

There are 2 types of data acquisition: static and __________.

The __________ format is an older, open source disk-to-image file format.

What are the advantages of the raw format?

• Does not require as much storage space as the original disk

• Fast data transfer

• Capability to ignore minor data read errors on the source drive

• Most forensic tools can read the raw format

The main goals of a first responder are ________ and early response.

What is used to validate the tools and verify the evidence integrity?

Which three of the following statements describes forensic readiness?

• How easy it is for the digital forensic investigator to find evidence which proves that someone is guilty

• A machine which has been imaged for the forensic purposes

• How prepared an organisation is to respond to an incident

• How prepared a digital forensic investigator is to present their evidence in a court of law

Which three of the following are benefits of forensic readiness?

• Forensic readiness makes it easier for organisations to gather evidence.

• Forensic readiness ensures that as much evidence as possible is available.

• Forensic readiness reduces the costs of a digital forensic investigation.

• Forensic readiness makes it harder for a malicious hacker to access a network

In the investigation phase, there are _____ sub-stages that take place.

• 6

• 7

• 4

• 5

True or false: live acquisition can file metadata, like date and time values.

• True

• False

The volatile memory of the computer is known as

• Central Processing Unit (CPU)

• Binary Input Output System (BIOS)

• Read Only Memory (ROM)

• Random Access Memory (RAM)