Digital Evidence Extraction & Analysis Quiz

What type of data is created within an application session and discarded at the end?

• User-Created Files

• Persistent Data

• Residual Data

• Volatile Data

Which of the following is an example of metadata?

• File size

• Deleted files

• Hidden files

• Compressed files

What is the process of reassembling computer files from fragments called?

• Logical Extraction

• File Carving

• Data Hiding

• Data Recovery

Which type of extraction includes an exact copy of the device's memory?

• Logical Extraction

• Data Analysis

• Physical Extraction

• Unstructured Extraction

What type of files may require elevated privileges for access?

• User-Protected Files

• User-Created Files

• Backup Files

• Computer-Created Files

What does the term 'file slack' refer to?

• Unused space in a file

• Data that is actively used

• Data left behind after deletion

• Data stored in a backup

What is the purpose of log analysis in digital forensics?

• To create backups

• To encrypt data

• To identify security events

• To recover deleted files

What does 'data hiding' indicate in a digital forensic investigation?

• Data is encrypted for security

• Data is intentionally concealed

• Data is stored in a backup

• Data is permanently deleted

What is the significance of time and date stamps in digital forensics?

• They show user permissions

• They reveal file types

• They indicate file size

• They help establish a timeline of events

What is the main goal of application and file analysis?

• To recover lost data

• To encrypt files

• To create backups

• To interpret extracted data