Digital Forensics MCQs

Dead acquisition refers to collecting evidence from a powered-off system or storage device.

The purpose of metadata is connected with data about data, not with altering or avoiding evidence procedures.

Forensic work requires documentation and preservation of evidence integrity, especially when handling unallocated space.

Packet sniffing in forensics refers to monitoring packets to understand communications during an investigation.

The purpose of dead acquisition is connected with offline evidence collection, not with altering or avoiding evidence procedures.

Forensic work requires documentation and preservation of evidence integrity, especially when handling metadata.

File system analysis refers to examining structures such as directories, allocation tables, and timestamps.

The purpose of packet sniffing in forensics is connected with traffic monitoring, not with altering or avoiding evidence procedures.

Forensic work requires documentation and preservation of evidence integrity, especially when handling dead acquisition.

Timeline analysis refers to reconstructing events based on timestamps and system artifacts.

The purpose of file system analysis is connected with storage structure examination, not with altering or avoiding evidence procedures.

Forensic work requires documentation and preservation of evidence integrity, especially when handling packet sniffing in forensics.