Which statement best explains log retention in digital forensics?
Correct Answer: A. Keeping logs for a defined period so they remain available for investigation.
MCQ Collection
Digital Forensics MCQs
Digital Forensics MCQs for practice, quizzes, and exam preparation.
Why is log retention important during a digital forensic investigation?
Correct Answer: A. It helps make the investigation more reliable, controlled, and defensible.
Which statement best explains artifact correlation in digital forensics?
Correct Answer: A. Linking evidence from multiple sources to support a stronger conclusion.
An examiner needs to show relationships among suspects, accounts, and devices. Which method helps?
Correct Answer: A. Graph visualization
A company wants staff to know what to do after an incident. What should be improved?
Correct Answer: A. Education, training, and awareness
A suspicious program is executed in an isolated lab to observe behavior. What type of analysis is this?
Correct Answer: A. Dynamic analysis
A seized laptop contains full-disk encryption and is powered off. What is a likely challenge?
Correct Answer: A. Data may be inaccessible without credentials or keys
A forensic examiner captures RAM from a live system. What may be found?
Correct Answer: A. Running processes and active network connections
A forensic examiner discovers logs were intentionally deleted. What should be considered?
Correct Answer: A. Anti-forensic activity and alternate evidence sources
A forensic team writes standard steps for imaging disks. What is this?
Correct Answer: A. Standard operating procedure
An examiner compares file hashes to a known database. What can this help identify?
Correct Answer: A. Known files or altered files
A storage device is labeled with case number, date, and collector name. What does this support?
Correct Answer: A. Evidence management