What best defines a logical acquisition?

• Duplicating hardware settings

• Acquiring only the visible data and file system

• Capturing the entire contents of a storage device

• Copying only encrypted files

What term describes hidden data that is typically inaccessible to users or operating systems?

• Latent data

• Non-volatile data

• Volatile data

• Metadata

Why is documenting the scene crucial during a forensic investigation?

• To enhance the security of the scene

• To encrypt the collected data keeping it safe for transit

• To create a backup of the digital evidence for court

• To ensure that no evidence is missed or contaminated

What is an example of non-volatile storage?

• Swap space

• Hard disk drive

• RAM

• Cache memory

What is the main function of a forensic write blocker?

• To compress the forensic image to save space

• To prevent writing to the evidence disk

• To format the storage device for acquisition

• To delete unnecessary files

Which file format is frequently used for forensic image files?

• JPEG

• 001

• E01

• MP3

In digital forensics, what does 'triage' involve?

• Backing up forensic images

• Assessing the importance of evidence

• Encrypting digital evidence

• Formatting storage devices

Why is verifying the integrity of forensic images crucial?

• To ensure no data has been altered or corrupted

• To enhance the resolution of the images

• To increase the storage capacity of destination drives

• To improve the speed of the investigation

In digital forensics, what is metadata?

• Data that is easily visible to all users

• Data that is irrelevant to the investigation

• Hidden data embedded within files

• Data that is lost after a system crash

What do file signatures serve in digital forensics?

• To enhance the resolution of image files

• To reveal the hidden metadata within the file

• To identify the true file type regardless of its extension

• To encrypt files for secure communication