Which statement best explains evidence acquisition plan in digital forensics?
Correct Answer: A. Deciding what evidence to collect, in what order, and by which method.
MCQ Collection
Digital Forensics MCQs
Digital Forensics MCQs for practice, quizzes, and exam preparation.
An email appears forged. Which element should be examined first?
Correct Answer: A. Email headers and routing information
A forensic examiner uses two tools to confirm a result. Why?
Correct Answer: A. To increase confidence through corroboration
A forensic examiner finds a file with changed extension. What should be checked?
Correct Answer: A. File signature or magic number
Why is evidence acquisition plan important during a digital forensic investigation?
Correct Answer: A. It helps make the investigation more reliable, controlled, and defensible.
A dataset has thousands of log entries. What can visualization help with?
Correct Answer: A. Identifying patterns and outliers
A case involves smart cameras and sensors. Which area is relevant?
Correct Answer: A. IoT and embedded forensics
A timeline includes OS logs, browser history, and file timestamps. What is the benefit?
Correct Answer: A. Cross-source event correlation
Which statement best explains case documentation in digital forensics?
Correct Answer: A. Recording actions, observations, tools, times, and findings during an investigation.
A forensic examiner finds GPS metadata in a photo. What may it indicate?
Correct Answer: A. Possible location where the photo was taken
A suspect claims they never visited a site, but browser history and cache show activity. What should the examiner do?
Correct Answer: A. Correlate artifacts and report findings objectively
A mobile phone is placed in a Faraday bag. Why?
Correct Answer: A. To prevent remote communication or wiping