Digital Forensic Investigation with Autopsy

What is the primary reason for setting up a separate drive for case data in a forensic investigation?

• To increase the speed of data processing

• To prevent mixing suspect data with forensic workstation files

• To ensure data is backed up automatically

• To allow multiple users to access the data simultaneously

When creating a new case in Autopsy, what is a recommended practice for naming the case folder?

• Use the investigator's full name

• Include the suspect's name

• Include the case number and a descriptive tag

• Use the date of the investigation

What is the advantage of using a disk image over a local disk in Autopsy?

• Disk images are faster to process

• Local disks provide more detailed data

• Local disks are easier to set up

• Disk images are less likely to be corrupted during analysis

Which module in Autopsy helps in identifying recent user activities such as web browsing and document access?

• Recent Activity

• File Type Identification

• Hash Lookup

• Keyword Search

What is the purpose of the 'Central Repository' feature in Autopsy?

• To manage user access to the case data

• To store all suspect data for future reference

• To track files and activities across multiple cases

• To automatically generate reports

Why might you enable optical character recognition (OCR) in Autopsy?

• To enhance the quality of image files

• To convert images into PDF format

• To extract text from images for keyword searching

• To speed up the processing of image files

What is the benefit of tagging files during an investigation in Autopsy?

• It allows for real-time collaboration with other investigators

• It increases the processing speed

• It helps in organizing and building a narrative around the findings

• It automatically generates a report

In Autopsy, what is the difference between an exact match and a substring match in keyword searches?

• Substring match searches include variations of the keyword

• Substring match searches only work with text files

• Exact match searches are case-sensitive

• Exact match searches are faster

What is a key step after tagging items in Autopsy to prepare for reporting?

• Sharing the tagged items with other investigators

• Exporting the tagged items to a separate folder

• Generating a report that includes the tagged items

• Deleting untagged items to save space

What is the primary goal of conducting keyword searches in a forensic investigation using Autopsy?

• To identify all files on the suspect's device

• To delete irrelevant files

• To find specific files related to the investigation

• To categorize files by type