E-Forensic Evidence Collection Quiz

What is the primary purpose of forensic collection of evidence following a security incident?

• To punish the perpetrator

• To understand the incident and prevent future occurrences

• To delete all compromised data

• To sell the data to third parties

Which of the following is a requirement for desktop forensics?

• Deleting all system logs

• Confiscation of devices

• Ignoring user activity

• Disabling malware alerts

What is a challenge associated with live forensics?

• Increasing data in situ

• Recovering corrupted data

• Capturing data in inactive memory

• Creating temporary files

In network forensics, what must be ensured before scanning local infrastructure?

• Permission is granted

• All devices are turned off

• Data is encrypted

• Logs are deleted

Which tool is used in desktop forensics to take an image of the system?

• Word processor

• Forensic analysis tool

• Spreadsheet software

• Presentation software

What is a requirement for maintaining an accurate record during forensic analysis?

• Recording findings a week after the incident

• Retaining snapshots of the system

• Ignoring any alterations made

• Deleting visual evidence

What should be evaluated to determine if findings provide evidence of a crime?

• The colour of the device

• The reliability of the evidence

• The weight of the device

• The temperature of the room

Which of the following is NOT a requirement for systematic forensic analysis?

• Recording all findings

• Creating visual evidence

• Ensuring evidence is a false positive

• Recording any alterations made

What is a key consideration when reviewing system logs in desktop forensics?

• Ignoring user activity

• Ensuring logs are comprehensive

• Deleting all logs

• Changing log entries

What is the purpose of analysing malware activity and alerts in network forensics?

• To increase network traffic

• To understand potential threats

• To delete all alerts

• To ignore network issues