All MCQs

Cloud investigations often involve jurisdiction and compliance concerns.

Sandbox use refers to isolated environment used to safely observe suspicious files or activity.

The purpose of education and awareness is connected with preparedness building, not with altering or avoiding evidence procedures.

Cache artifacts can support conclusions about web activity.

The purpose of sandbox use is connected with controlled analysis environment, not with altering or avoiding evidence procedures.

Forensic work requires documentation and preservation of evidence integrity, especially when handling education and awareness.

Local app databases are common application artifacts.

Forensic work requires documentation and preservation of evidence integrity, especially when handling sandbox use.

Digital forensic readiness plan refers to a plan defining logging, roles, evidence handling, and response preparation.

Wiping is used to hinder recovery and is an anti-forensic technique.

Forensic work requires documentation and preservation of evidence integrity, especially when handling collection phase.

Ethics in forensics refers to professional behavior involving honesty, legality, confidentiality, and objectivity.