Digital Forensics MCQs

Live acquisition refers to collecting volatile data from a running system before shutdown.

The purpose of digital evidence is connected with electronic proof, not with altering or avoiding evidence procedures.

Forensic work requires documentation and preservation of evidence integrity, especially when handling slack space.

Packet capture refers to recording network packets for later analysis.

The purpose of live acquisition is connected with volatile evidence collection, not with altering or avoiding evidence procedures.

Forensic work requires documentation and preservation of evidence integrity, especially when handling digital evidence.

Unallocated space refers to disk space not assigned to active files but possibly containing deleted data.

The purpose of packet capture is connected with network evidence collection, not with altering or avoiding evidence procedures.

Forensic work requires documentation and preservation of evidence integrity, especially when handling live acquisition.

Metadata refers to data describing other data, such as timestamps, author, and file properties.

The purpose of unallocated space is connected with potential evidence area, not with altering or avoiding evidence procedures.

Forensic work requires documentation and preservation of evidence integrity, especially when handling packet capture.