Digital Forensics S18

Which method ensures integrity while creating a forensic disk image?

• Copy-paste method
• Incremental backup
• Bit-stream imaging with hash verification
• Disk compression
• File export

Which step is FIRST in verifying a digital incident?

• Confirm incident
• Validate alerts
• Identify assets
• Analyze logs
• Check backups

Which technique is MOST effective for recovering erased data clusters?

• Overwrite data
• Data carving
• Sector replacement
• Disk compression
• File renaming

What is the legal approach when encountering encrypted forensic evidence?

• Ignore encrypted areas
• Attempt brute force only
• Use key escrow or subpoena
• Reformat drive
• Decrypt using random keys

Which minimizes FALSE NEGATIVES in forensic tools?

• Multiple automated scans
• Exclusive tool reliance
• Manual hex review with automation
• Skip unreadable sectors
• File copy

According to Order of Volatility, which is MOST volatile?

• Registers
• Disk storage
• Network logs
• Cache memory
• Backups

Which is LEAST reliable for reconstructing browsing history?

• Proxy logs
• Cache files
• Cookie storage
• DNS cache
• Encrypted HTTPS logs

Unusual outbound DNS queries suggest which?

• Cookie tracking
• DNS tunneling
• Log deletion
• Cache poisoning
• Spoofed email

Which email header is MOST often spoofed?

• From
• Date
• Received
• Message-ID
• Reply-To

Messenger forensic artifacts are at risk mainly due to?

• App size
• End-to-end encryption with ephemeral storage
• Large log files
• Cloud sync
• Plain-text chat export