Cyber Forensics Practice Quiz

Questions

Question 1

Which forensic practice ensures the chronological documentation of the seizure, custody, control, and transfer of digital evidence?

A) Order of Volatility

B) Chain of Custody

C) Data Carving

D) Write Blocking

Question 2

When prioritizing the collection of digital evidence during an active incident, which data source should be collected first according to the order of volatility?

A) CPU registers and cache

B) Hard drive storage

C) System RAM

D) Archival backups

Question 3

What is the primary function of a hardware write blocker during digital evidence acquisition?

A) To compress data to save disk space

B) To encrypt the disk image to protect evidence

C) To prevent any modification or writing to the original media

D) To automatically carve deleted files during connection

Question 4

Why is a bit-stream image preferred over a standard operating system file copy during forensic investigations?

A) It copies files much faster than normal file transfer methods

B) It captures unallocated space, slack space, and deleted files

C) It automatically decrypts encrypted files on the target drive

D) It only copies active system and executable files

Question 5

What purpose do cryptographic hash values like SHA-256 serve when verifying a forensic disk image?

A) They hide sensitive user information inside the disk image

B) They prove that the image data has not been altered since creation

C) They speed up the file indexing process during analysis

D) They convert binary data into human-readable text

Question 6

What is the primary objective of performing data carving on a storage medium?

A) To clear unused sectors before writing new data

B) To reconstruct files from raw blocks without relying on file system tables

C) To log network packet headers during an active breach

D) To generate cryptographic checksums for forensic reports

Question 7

Which term describes the practice of hiding a secret file or message inside another innocent-looking carrier file?

A) Steganography

B) Obfuscation

C) Cryptography

D) Hashing

Question 8

What does slack space refer to in file system forensics?

A) Unallocated sectors waiting to be assigned to a new drive partition

B) The unused space between the end of a file and the end of its allocated cluster

C) System RAM reserved exclusively for operating system processes

D) Virtual memory stored inside a swap file on the disk

Question 9

What kind of evidence is primarily uncovered during volatile memory (RAM) forensics?

A) Historical system log files from previous months

B) Active network connections, injected code, and unencrypted passwords

C) Deleted file metadata saved on unallocated disk sectors

D) Physical serial numbers of connected hardware devices

Question 10

In file system metadata analysis, what do MAC times represent?

A) Media Access Control hardware address timestamps

B) Master Access Code verification logs

C) Modified, Accessed, and Created timestamps

D) Memory Allocation and Cache lifecycle intervals

Answer Key & Explanations

1. B) Chain of Custody

Explanation: Chain of custody logs who collected, handled, transferred, or analyzed evidence and when. Without a complete chain of custody, evidence can be deemed inadmissible in court due to potential tampering.

2. A) CPU registers and cache

Explanation: According to RFC 3227 guidelines for evidence collection, volatile data must be captured before it disappears. CPU registers and cache are the most volatile components, followed by RAM, network connections, local disk, and backups.

3. C) To prevent any modification or writing to the original media

Explanation: Connecting an evidence drive directly to an OS can alter metadata (like access timestamps). A write blocker intercepts write commands from the operating system to preserve the original evidence state.

4. B) It captures unallocated space, slack space, and deleted files

Explanation: A bit-stream image makes a sector-by-sector physical copy of the entire storage media, including areas containing residual or deleted data that standard file copies ignore.

5. B) They prove that the image data has not been altered since creation

Explanation: Matching the hash value (e.g., SHA-256) of the original drive with the copy confirms mathematical identity and integrity of the forensic image.

6. B) To reconstruct files from raw blocks without relying on file system tables

Explanation: Data carving scans raw bytes on unallocated space looking for known file signatures (headers and footers) to recover deleted files when directory structures are missing or damaged.

7. A) Steganography

Explanation: Steganography conceals the existence of hidden data within a carrier file (such as least significant bits in an image), unlike cryptography which renders data unreadable without concealing its presence.

8. B) The unused space between the end of a file and the end of its allocated cluster

Explanation: File systems allocate disk storage in fixed-size blocks (clusters). If a file does not fill an entire cluster, the remaining space (slack space) can contain residual data from previously deleted files or intentionally hidden data.

9. B) Active network connections, injected code, and unencrypted passwords

Explanation: RAM holds live runtime context. Volatile memory analysis can extract data that is lost upon reboot, including active processes, open sockets, malware payloads, and keys held in memory.

10. C) Modified, Accessed, and Created timestamps

Explanation: MAC times store critical file system metadata tracking when a file was Modified, last Accessed, or Created. Investigators use MAC times to build forensic event timelines.