A network capture includes source and destination IP addresses. What can this help identify?
Correct Answer: A. Communication endpoints
MCQ Collection
Digital Forensics MCQs
Digital Forensics MCQs for practice, quizzes, and exam preparation.
A device is imaged using a method that misses hidden sectors. What is the concern?
Correct Answer: A. Incomplete acquisition
An examiner must decide whether evidence is relevant to a case question. Which phase is most involved?
Correct Answer: A. Analysis
A forensic examiner must explain uncertainty in a report. What should be done?
Correct Answer: A. State limitations clearly
A forensic report includes who, what, when, where, how, and limitations. Why?
Correct Answer: A. To make findings understandable and defensible
Which statement best explains forensic triage in digital forensics?
Correct Answer: A. Quickly prioritizing devices or evidence sources for deeper analysis.
A deleted file is recovered from unallocated space. What does this show?
Correct Answer: A. Deleted content may remain until overwritten
A suspect communicates through Tor. What challenge may arise?
Correct Answer: A. Attribution and traffic tracing become more difficult
Why is forensic triage important during a digital forensic investigation?
Correct Answer: A. It helps make the investigation more reliable, controlled, and defensible.
A device is found in water damage but may contain storage chips. What field may assist?
Correct Answer: A. Embedded or hardware-level forensics
A timestamp shows file creation after seizure. What should be checked?
Correct Answer: A. Whether evidence was altered or time zones were misinterpreted
A cloud service provides audit trails. What are they useful for?
Correct Answer: A. Reconstructing user and administrative actions