Chapter 4: Basics of Digital Forensics and Digital Evidence

1. Digital forensics is all of them except:

A. Extraction of computer data. B. Preservation of computer data.
C. Interpretation of computer data. D. Manipulation of computer data.
Ans:D

2. IDIP stands for

A. Integrated Digital Investigation Process.
B. Integrated Data Investigator Process.
C. Integrated Digital Investigator Process.
D. Independent Digital Investigator Process.
Ans: A

3. Who proposed Road Map for Digital Forensic Research (RMDFR)

A. G.Gunsh. B. S.Ciardhuain
C. J.Korn. D. G.Palmar
Ans: D

4. Investigator should satisfy following points:

A. Contribute to society and human being. B. Avoid harm to others.
C. Honest and trustworthy. D. All of the above
Ans: D

5. In the past, the method for expressing an opinion has been to frame a ____ question based on
available factual evidence.
A. Hypothetical B. Nested
C. Challenging D. Contradictory
Ans: A

6. More subtle because you are not aware that you are running these macros (the document opens and
the application automatically runs); spread via email
A. The purpose of copyright B. Danger of macro viruses
C. Derivative works D. computer-specific crime
Ans: B

7. There are three c's in computer forensics. Which is one of the three?
A. Control B. Chance
C. Chains D. Core
Ans: A

8. When Federal Bureau Investigation program was created?

A.1979 B.1984
C.1995 D.1989
Ans: B
9. When the field of PC forensics began?
A.1960's B.1970's
C.1980's D.1990's
Ans: C

10. What is Digital Forensic?

A. Process of using scientific knowledge in analysis and presentation of evidence in court
B. The application of computer science and investigative procedures for a legal purpose
involving the analysis of digital evidence after proper search authority, chain of custody,
validation with mathematics, use of validated tools, repeatability, reporting, and possible
expert presentation
C. process where we develop and test hypotheses that answer questions about digital events
D. Use of science or technology in the investigation and establishment of the facts or evidence in a court
of law
Ans: B

11. Digital Forensics entails _____.

A. Accessing the system's directories viewing mode and navigating through the various systems
files and folders
B. Undeleting and recovering lost files
C. Identifying and solving computer crimes
D. The identification, preservation, recovery, restoration and presentation of digital evidence
from systems and devices
Ans: D

12. Which of the following is FALSE?

A. The digital forensic investigator must maintain absolute objectivity
B. It is the investigator’s job to determine someone’s guilt or innocence.
C. It is the investigator’s responsibility to accurately report the relevant facts of a case.
D. The investigator must maintain strict confidentiality, discussing the results of an
investigation on only a “need to know”
Ans: B

13. What is the most significant legal issue in computer forensics?

A. Preserving Evidence B. Seizing Evidence
C. Admissibility of Evidence D. Discovery of Evidence
Ans: C

14. _______phase includes putting the pieces of a digital puzzle together and developing
investigative hypotheses
A. Preservation phase B. Survey phase
C. Documentation phase D. Reconstruction phase
E. Presentation phase
Ans: D
15. In _______phase investigator transfers the relevant data from a venue out of physical or
administrative control of the investigator to a controlled location
A. Preservation phase B. Survey phase
C. Documentation phase D. Reconstruction phase
E. Presentation phase
Ans:B

16. In _______phase investigator transfers the relevant data from a venue out of physical or
administrative control of the investigator to a controlled location
A. Preservation phase B. Survey phase
C. Documentation phase D. Reconstruction phase
E. Presentation phase
Ans:B
17. Computer forensics do not involve_____activity.
A. Preservation of computer data. B. Exraction of computer data.
C. Manipulation of computer data. D. Interpretation of computer data.
Ans: C
18. A set of instruction compiled into a program that perform a particular task is known as:
A. Hardware. B.CPU
C. Motherboard D. Software
Ans: D
19. Which of following is not a rule of digital forensics?
A. An examination should be performed on the original data
B. A copy is made onto forensically sterile media. New media should always be used if
available.
C. The copy of the evidence must be an exact, bit-by-bit copy
D. The examination must be conducted in such a way as to prevent any modification of the
evidence.
Ans: A
20. To collect and analyze the digital evidence that was obtained from the physical investigation
phase, is the goal of which phase?
A. Physical crime investigation B. Digital crime investigation.
C. Review phase. D. Deployment phase.
Ans: B
21. To provide mechanism to an incident to be detected and confirmed is purpose of which
phase?
A. Physical crime investigation B. Digital crime investigation.
C. Review phase. D. Deployment phase.
Ans: D
22. Which phase entails a review of the whole investigation and identifies area of improvement?
A. Physical crime investigation B. Digital crime investigation.
C. Review phase. D. Deployment phase
Ans: C
23. ____________is known as father of computer forensic.
A. G. Palmar B. J. Korn
C. Michael Anderson D. S.Ciardhuain.
Ans: C
24. ___________is well established science where various contribution have been made
A.Forensic B. Crime
C. Cyber Crime D. Evidence
Ans: A
25. Who proposed End to End Digital Investigation Process (EEDIP)?
A. G. Palmar B. Stephenson
C. Michael Anderson D. S.Ciardhuain
Ans: B
26. Which model of Investigation proposed by Carrier and Safford?
A. Extended Model of Cybercrime Investigation (EMCI)
B. Integrated Digital Investigation Process(IDIP)
C. Road Map for Digital Forensic Research (RMDFR)
D. Abstract Digital Forensic Model (ADFM)
Ans: B
27. Which of the following is not a property of computer evidence?
A.Authentic and Accurate. B. Complete and Convincing.
C. Duplicated and Preserved. D. Conform and Human Readable.
Ans. D
28. _______can makes or breaks investigation.
A. Crime B. Security
C: Digital Forensic D: Evidence
Ans: D
29. __________ is software that blocks unauthorized users from connecting to your computer.
A. Firewall B. Quick lauch
C. OneLogin D. Centrify
Ans: A

30. Which of following are general Ethical norms for Investigator?

A. To contribute to society and human being B. To avoid harm to others.
C. To be honest and trustworthy. D. All of above
E. None of above
Ans: D

31. Which of following are Unethical norms for Investigator?

A.Uphold any relevant evidence. B. Declare any confidential matters or knowledge.
C. Distort or falsify education, training, credentials. D. All of above
E. None of above
Ans: D

32. Which of following is not general ethical norm for Investigator? A.

A.To contribute to society and human being. B. Uphold any relevant Evidence.
C. To be honest and trustworthy. D. To honor confidentially.
Ans: B

33. Which of following is a not unethical norm for Digital Forensics Investigation? A.
A.Uphold any relevant evidence. B. Declare any confidential matters or knowledge.
C. Distort or falsify education, training, credentials. D. To respect the privacy of others.
Ans: D
34. What is called as the process of creation a duplicate of digital media for purpose of
examining it?
A. Acquisition. B. Steganography.
C. Live analysis D. Hashing.
Ans: A
35. Which term refers for modifying a computer in a way which was not originally intended to
view Information?
A. Metadata B. Live analysis
C. Hacking D. Bit Copy
Ans: C
36. The ability to recover and read deleted or damaged files from a criminal’s computer is an
example of a law enforcement specialty called?
A. Robotics B. Simulation
C. Computer Forensics D. Animation
Ans: C
37. What are the important parts of the mobile device which used in Digital forensic?
A. SIM B. RAM
C. ROM. D.EMMC chip
Ans: D
38. Using what, data hiding in encrypted images be carried out in digital forensics? A.
A. Acquisition. B. Steganography.
C. Live analysis D. Hashing.
And: B
39. Which of this is not a computer crime?
A. e-mail harassment B. Falsification of data.
C. Sabotage. D. Identification of data
Ans. D
40. Which file is used to store the user entered password?
A. .exe B. .txt
C. .iso D. .sam
Ans: D
41. __________is the process of recording as much data as possible to create reports and analysis
on user input.
A. Data mining B. Data carving
C. Meta data D. Data Spoofing.
Ans: A
42. ________searches through raw data on a hard drive without using a file system.
A. Data mining B. Data carving
C. Meta data D. Data Spoofing.
Ans: B
43. What is first step to Handle Retrieving Data from an Encrypted Hard Drive?
A. Formatting disk B. Storing data
C. Finding configuration files. D. Deleting files.
Ans: C
1. A valid definition of digital evidence is:
A. Data stored or transmitted using a computer
B. Information of probative value
C. Digital data of probative value
D. Any digital evidence on a computer
Ans: C

2. What are the three general categories of computer systems that can contain digital evidence?
A. Desktop, laptop, server
B. Personal computer, Internet, mobile telephone
C. Hardware, software, networks
D. Open computer systems, communication systems, and embedded systems
Ans: D

3. In terms of digital evidence, a hard drive is an example of:

A. Open computer systems
B. Communication systems
C. Embedded computer systems
D. None of the above
Ans: A

4. In terms of digital evidence, a mobile telephone is an example of:

A. Open computer systems
B. Communication systems
C. Embedded computer systems
D. None of the above
Ans: C

5. In terms of digital evidence, a Smart Card is an example of:

A. Open computer systems
B. Communication systems
C. Embedded computer systems
D. None of the above
Ans: C

6. In terms of digital evidence, the Internet is an example of:

A. Open computer systems
B. Communication systems
C. Embedded computer systems
D. None of the above
Ans: B

7. Computers can be involved in which of the following types of crime?

A. Homicide and sexual assault
B. Computer intrusions and intellectual property theft
C. Civil disputes
D. All the above
Ans: D
8. A logon record tells us that, at a specific time:
A. An unknown person logged into the system using the account
B. The owner of a specific account logged into the system
C. The account was used to log into the system
D. None of the above
Ans: C

9. Cyber trails are advantageous because:

A. They are not connected to the physical world.
B. Nobody can be harmed by crime on the Internet.
C. They are easy to follow.
D. Offenders who are unaware of them leave behind more clues than they otherwise
would have.
Ans: D

10. Private networks can be a richer source of evidence than the Internet because:
A. They retain data for longer periods of time.
B. Owners of private networks are more cooperative with law enforcement.
C. Private networks contain a higher concentration of digital evidence.
D. All the above.
Ans: C

11. Due to caseload and budget constraints, often computer security professionals attempt to limit
the damage and close each investigation as quickly as possible. Which of the following is NOT
a significant drawback to this approach?

A. Each unreported incident robs attorneys and law enforcement personnel of an opportunity
to learn about the basics of computer-related crime.

B. Responsibility for incident resolution frequently does not reside with the security
professional, but with management.

C. This approach results in under-reporting of criminal activity, deflating statistics that are
used to allocate corporate and government spending on combating computer-related crime.

D. Computer security professionals develop loose evidence processing habits that can make
it more difficult for law enforcement personnel and attorneys to prosecute an offender.

E.None of the above

Ans: B

12. The criminological principle which states that, when anyone, or anything, enters a crime scene
he/she takes something of the scene with him/her, and leaves something of himself/herself
behind, is:
A. Locard’s Exchange Principle
B. Differential Association Theory
C. Beccaria’s Social Contract
D. None of the above
Ans: A

13. The author of a series of threatening e-mails consistently uses “im” instead of “I’m.” This is
an example of:
A. An individual characteristic
B. An incidental characteristic
C. A class characteristic
D. An indeterminate characteristic
Ans: A

14. Personal computers and networks are often a valuable source of evidence. Those involved with
_______ should be comfortable with this technology.
A. Criminal investigation
B. Prosecution
C. Defense work
D. All of the above
Ans: D

15. An argument for including computer forensic training computer security specialists is: A. It
provides an additional credential.
B. It provides them with the tools to conduct their own investigations.
C. It teaches them when it is time to call in law enforcement.
D. None of the above.
Ans: C

16. The digital evidence are used to establish a credible link between____________
A. Attacker and victim and the crime scene
B. Attacker and the crime scene
C. Victim and the crime scene
D. Attacker and Information
Ans: A

17. Digital evidences must follow the requirements of the ___________

A. Ideal Evidence rule
B. Best Evidence rule
C. Exchange rule
D. All the mentioned
Ans: B

18. From the two given statements 1 and 2, select the correct option from a-d.
a. Original media can be used to carry out digital investigation process.
b. By default, every part of the victim’s computer is considered as unreliable.
A. a and b both are true
B. a is true and b is false
C. a and b both are false
D. a is false and b is true
Ans: B
19. The evidences or proof can be obtained from the electronic source is called the ___________
A. digital evidence B. demonstrative evidence
C. Explainable evidence D. substantial evidence
Ans: A

20. Which of the following is not a type of volatile evidence?

A. Routing tables
B. Main memory
C. Log files
D. Cached data
Ans: C

21. The evidence must be usable in the court which is called as_______
A. Admissible
B. Authentic
C. Complete
D. Reliable
Ans: A

22. Photographs, videos, sound recordings, X-rays, maps drawing, graphs, charts is a a type of
_____________
A. Illustrative evidence
B. Electronic evidence
C. Documented evidence
D. Explainable evidence
Ans: A

23. Email, hard drives are examples of ____________

A. Illustrative evidence
B. Electronic evidence
C. Documented evidence
D. Explainable evidence
Ans: B

24. Blood, fingerprints, DNA these are examples of____________

A. Illustrative evidence
B. Electronic evidence
C. Documented evidence
D. Substantial evidence
Ans: D

25. When an incident takes place, a criminal will leave a hint evidence at the scene and remove a
hint from the scene which is called as ____________
A. Locard’s Exchange principle
B. Anderson’s Exchange principle
C. Charles’s Anthony principle
D. Kevin Ashton principle
Ans: A
26. Which is not procedure to establish a chain of custody?
A. Save the original materials.
B. Take photos of physical evidence.
C. Don’t take screenshots of digital evidence content.
D. Document date, time, and any other information of receipt.
Ans: C

27. Which is not related with digital evidence?

A. Work with the original evidence to develop procedures.
B. Use clean collecting media.
C. Document any extra scope.
D. Consider safety of personnel at the scene.
Ans: A

28. Which is example of non-volatile memory.

A. Flash memory
B. Registers and Cache
C. Process table
D. Arp cache
Ans: A

29._________ is known as testimonial.

A. Oath affidavit
B. DNA samples
C. Fingerprint
D. Dried blood
Ans: A

30.The process of ensuring that providing or obtaining the data that you have collected is similar
to the data provided or presented in a court is known as___________
A. Evidence validation
B. Relative evidence
C. Best evidence
D. Illustrative evidence
Ans: A
31.When cases got to trial your forensics examiner play one of ____ role.
A. 2
B. 4
C. 3
D. 5
Ans. A

32.Types of digital evidence

A. Eye witness
B. Picture and video
C. Paper work
D. None of the above
Ans B

33.Rule of evidence is also known as __________

A. Law of witness B. Law of litigation
C. Law of evidence D. All of the above
Ans. C

True or False Questions

1. Digital evidence is only useful in a court of law.

A. True B. False
Ans: B

2. Attorneys and police are encountering progressively more digital evidence in their work.
A. True B. False
Ans: A

3. Video surveillance can be a form of digital evidence.

A. True B. False
Ans: A

4. All forensic examinations should be performed on the original digital evidence.

A. True B. False
Ans: B

5. Digital evidence can be duplicated exactly without any changes to the original data.
A. True B. False
Ans: B

6. Computers were involved in the investigations into both World Trade Center attacks.
A. True B. False
Ans: A

7. Digital evidence is always circumstantial.

A. True B. False
Ans: B
8. Digital evidence alone can be used to build a solid case.
A. True B. False
Ans: B

9. Computers can be used by terrorists to detonate bombs.

A. True B. False
Ans: A

10. The aim of a forensic examination is to prove with certainty what occurred.
A. True B. False
Ans: B
11. Even digital investigations that do not result in legal action can benefit from principles of
forensic science.
A. True B. False
Ans: A

12. Forensic science is the application of science to investigation and prosecution of crime or to
the just resolution of conflict.
A. True B. False
Ans: A