RP L05: Sources of Evidence 5Q

An investigator is collecting data from a live running system. Which type of evidence is most critical to capture first?

• Registry keys

• RAM contents

• Hard disk partitions

• USB drive contents

During an investigation of unauthorized access, the most useful evidence to trace the attacker’s activity would be:

• Screenshots of the desktop

• Backup tapes

• Firewall and server logs

• User manuals

A suspect’s mobile phone is seized. Which type of evidence would be found here?

• Only volatile data

• Both volatile and non-volatile data

• Only non-volatile data

• Only network-based evidence

Why are network traffic captures considered valuable in digital investigations?

• They are stored permanently

• They provide real-time insight into user activity

• They are impossible to alter

• They don’t require timestamps

In which scenario would metadata serve as an important source of evidence?

• Recovering deleted browser history

• Verifying the creation and modification dates of files

Would you like me to: Which option do you prefer?

• Combine all 10 questions into a single quiz sheet (with instructions & answer key) for classroom use?

• Make it look like a Republic Polytechnic-style handout (PDF with clean formatting)?

• Add a short answer section for deeper learning?