A suspect computer is still powered on and may contain active chat sessions. What should be collected first?
Correct Answer: A. Volatile data such as RAM and active network connections
MCQ Collection
Digital Forensics MCQs
Digital Forensics MCQs for practice, quizzes, and exam preparation.
A forensic examiner is dealing with embedded device forensics. Which action is most appropriate?
Correct Answer: A. Document the process and preserve evidence integrity.
In digital forensics, what does ‘Computer expert vs forensic expert’ mainly refer to?
Correct Answer: A. A forensic expert focuses on evidence handling, legal process, and investigative soundness.
An investigator calculates a hash before and after imaging a drive. What is the main purpose?
Correct Answer: A. To prove the image matches the original
In digital forensics, what does ‘Memory forensics’ mainly refer to?
Correct Answer: A. Examining ram dumps for running processes, network connections, and volatile artifacts.
Which option best describes the purpose of computer expert vs forensic expert in a forensic investigation?
Correct Answer: A. To support role distinction during an investigation.
A USB drive is seized. Which practice best protects the original evidence?
Correct Answer: A. Use a write blocker before imaging
Which option best describes the purpose of memory forensics in a forensic investigation?
Correct Answer: A. To support RAM evidence analysis during an investigation.
A forensic examiner is dealing with computer expert vs forensic expert. Which action is most appropriate?
Correct Answer: A. Document the process and preserve evidence integrity.
A report must explain findings to non-technical managers. What should the examiner do?
Correct Answer: A. Use clear language and explain technical terms
A forensic examiner is dealing with memory forensics. Which action is most appropriate?
Correct Answer: A. Document the process and preserve evidence integrity.
In digital forensics, what does ‘Education and awareness’ mainly refer to?
Correct Answer: A. Training personnel to recognize evidence, legal duties, and proper response.