All MCQs

Charts help communicate patterns in forensic data.

Social media evidence should be corroborated across sources.

Metadata and remnants can support file existence.

Live response should be planned and documented.

Isolation can prevent remote access or wiping.

Multiple sources help reconstruct events more reliably.

File signatures can reveal true file type.

Audit trails can show cloud activity.

Anonymity systems can complicate attribution.

A complete report supports review and decision-making.

A forensic acquisition should capture relevant storage areas completely.

Hash comparison can identify known files or integrity differences.