All MCQs

GPS metadata may suggest location but must be validated.

Visualization supports interpretation but does not replace analysis.

Headers provide routing and origin clues.

Specialized embedded or chip-level methods may be needed.

Chain of custody documents evidence handling.

Registry and event logs often contain user and system activity traces.

Analysis should normally be done on forensic copies.

Clock differences must be accounted for during timeline reconstruction.

Packets may reveal authentication attempts and network activity.

Repeatable results improve confidence in tool output.

Wiping is used to hinder recovery and is an anti-forensic technique.

Local app databases are common application artifacts.