WorksheetsDigital Forensics Worksheet
Total questions: 15
Worksheet time: 8mins
Which of the following is a primary reason digital investigators analyze email headers during an investigation?
To decrypt encrypted mobile device data
To identify physical evidence at a crime scene
To recover deleted files from a hard drive
To trace the origin and path of an email message
The cloud services Dropbox, Google Drive, and OneDrive have no Registry entries.
True
False
Evidence of cloud access found on a smartphone usually means that PaaS cloud service level was in use.
True
False
At the investigation scene, determine whether the device is on or off. If it’s off, turn it on.
True
False
E-mail services on both the Internet and an intranet use a client/server architecture, but they differ in how server accounts are assigned, used, and managed and in how users access their e-mail.
True
False
Which email protocol is commonly used by forensic investigators to retrieve messages from a mail server during an investigation?
HTTP
IMAP
FTP
SSH
When acquiring a mobile device at an investigation scene, you should leave it connected to a laptop or tablet so that you can observe synchronization as it takes place.
True
False
Google was an early provider of Web-based services that eventually developed into the cloud concept.
True
False
In Web-based e-mail, messages are displayed and saved as Web pages in the PC cache memory.
True
False
Using wireless connection to extract information from a mobile device is a Leavesical extraction.
True
False
For digital investigators, tracking intranet e-mail is easier because accounts use nonstandard names the administrator establishes.
True
False
Which of the following is a common challenge when collecting evidence from mobile devices during a digital forensic investigation?
Encryption of device data
Unlimited battery life
Absence of any operating system
Lack of physical access to the Internet
Which of the following is a key challenge when collecting digital evidence from cloud storage services?
Cloud services never keep logs
Lack of any user authentication
Cloud data is always unencrypted
Jurisdictional issues due to data stored in multiple countries
A mobile station has 3 parts: GSM, SIM card, and Mobile Equipment.
True
False
Which of the following is a primary method used to preserve data integrity when collecting evidence from a mobile device?
Deleting unnecessary files
Resetting the device to factory settings
Enabling airplane mode on the device
Installing new applications
