Practice Library
All MCQs
Browse exam-wise, subject-wise, and country-wise MCQs with explanations.
Choose an option to check your answer.
Correct Answer: A. Document the process and preserve evidence integrity.
Explanation:
Forensic work requires documentation and preservation of evidence integrity, especially when handling unallocated space.
Choose an option to check your answer.
Correct Answer: A. To support potential evidence area during an investigation.
Explanation:
The purpose of unallocated space is connected with potential evidence area, not with altering or avoiding evidence procedures.
Choose an option to check your answer.
Correct Answer: A. Disk space not assigned to active files but possibly containing deleted data.
Explanation:
Unallocated space refers to disk space not assigned to active files but possibly containing deleted data.
Choose an option to check your answer.
Correct Answer: A. Document the process and preserve evidence integrity.
Explanation:
Forensic work requires documentation and preservation of evidence integrity, especially when handling slack space.
Choose an option to check your answer.
Correct Answer: A. To support hidden residual data area during an investigation.
Explanation:
The purpose of slack space is connected with hidden residual data area, not with altering or avoiding evidence procedures.
Choose an option to check your answer.
Correct Answer: A. Unused space between the end of a file and the end of its allocated cluster.
Explanation:
Slack space refers to unused space between the end of a file and the end of its allocated cluster.
Choose an option to check your answer.
Correct Answer: A. Document the process and preserve evidence integrity.
Explanation:
Forensic work requires documentation and preservation of evidence integrity, especially when handling deleted file recovery.
Choose an option to check your answer.
Correct Answer: A. To support recoverable data extraction during an investigation.
Explanation:
The purpose of deleted file recovery is connected with recoverable data extraction, not with altering or avoiding evidence procedures.
Choose an option to check your answer.
Correct Answer: A. Attempting to restore files removed from the file system but still present on storage.
Explanation:
Deleted file recovery refers to attempting to restore files removed from the file system but still present on storage.
Choose an option to check your answer.
Correct Answer: A. Document the process and preserve evidence integrity.
Explanation:
Forensic work requires documentation and preservation of evidence integrity, especially when handling file carving.
Choose an option to check your answer.
Correct Answer: A. To support signature-based recovery during an investigation.
Explanation:
The purpose of file carving is connected with signature-based recovery, not with altering or avoiding evidence procedures.
Choose an option to check your answer.
Correct Answer: A. Recovering files from raw data using file signatures rather than file system records.
Explanation:
File carving refers to recovering files from raw data using file signatures rather than file system records.
