Pakistan MCQs

The purpose of memory forensics is connected with RAM evidence analysis, not with altering or avoiding evidence procedures.

Forensic work requires documentation and preservation of evidence integrity, especially when handling computer expert vs forensic expert.

Forensic reports should match the audience while remaining accurate.

Forensic work requires documentation and preservation of evidence integrity, especially when handling memory forensics.

Education and awareness refers to training personnel to recognize evidence, legal duties, and proper response.

Cloud investigations often involve jurisdiction and compliance concerns.

Sandbox use refers to isolated environment used to safely observe suspicious files or activity.

The purpose of education and awareness is connected with preparedness building, not with altering or avoiding evidence procedures.

Cache artifacts can support conclusions about web activity.

The purpose of sandbox use is connected with controlled analysis environment, not with altering or avoiding evidence procedures.

Forensic work requires documentation and preservation of evidence integrity, especially when handling education and awareness.

Local app databases are common application artifacts.