Pakistan MCQs

Slack space refers to unused space between the end of a file and the end of its allocated cluster.

The purpose of network forensics is connected with traffic evidence analysis, not with altering or avoiding evidence procedures.

Digital evidence refers to information stored or transmitted in digital form that may support an investigation.

The purpose of slack space is connected with hidden residual data area, not with altering or avoiding evidence procedures.

Forensic work requires documentation and preservation of evidence integrity, especially when handling network forensics.

Live acquisition refers to collecting volatile data from a running system before shutdown.

The purpose of digital evidence is connected with electronic proof, not with altering or avoiding evidence procedures.

Forensic work requires documentation and preservation of evidence integrity, especially when handling slack space.

Packet capture refers to recording network packets for later analysis.

The purpose of live acquisition is connected with volatile evidence collection, not with altering or avoiding evidence procedures.

Forensic work requires documentation and preservation of evidence integrity, especially when handling digital evidence.

Unallocated space refers to disk space not assigned to active files but possibly containing deleted data.