A forensic examiner uses data charts to show event frequency over time. What is this?
Correct Answer: A. Data visualization
MCQ Collection
Digital Forensics MCQs
Digital Forensics MCQs for practice, quizzes, and exam preparation.
An image file contains hidden text in pixel data. What technique may be involved?
Correct Answer: A. Steganography
A user account logs in from unusual locations. Which evidence may help?
Correct Answer: A. Authentication logs and IP geolocation context
A forensic team defines retention rules for logs before incidents. Why?
Correct Answer: A. To ensure useful evidence is available later
A social media account is deleted after an incident. What may still help?
Correct Answer: A. Preserved platform records, screenshots, and related metadata
A forensic examiner changes file access times by opening originals. What principle is violated?
Correct Answer: A. Evidence preservation
A suspicious executable is analyzed without running it. What type of analysis is this?
Correct Answer: A. Static analysis
In digital forensics, what does ‘Virtualization in forensics’ mainly refer to?
Correct Answer: A. Using virtual machines to isolate analysis and reproduce environments.
Which option best describes the purpose of digital forensic readiness plan in a forensic investigation?
Correct Answer: A. To support pre-incident planning during an investigation.
A forensic lab repeats a tool test and gets the same result each time. What quality is supported?
Correct Answer: A. Repeatability
Which option best describes the purpose of virtualization in forensics in a forensic investigation?
Correct Answer: A. To support isolated investigation support during an investigation.
A forensic examiner is dealing with digital forensic readiness plan. Which action is most appropriate?
Correct Answer: A. Document the process and preserve evidence integrity.