1.
Introduction to Digital Forensics
1. What is the primary objective of digital forensics?
a) Prevent cyber crimes
b) Investigate digital evidence
c) Enhance network speed
d) Develop software
Answer: b) Investigate digital evidence
2. Which of the following is NOT a branch of digital forensics?
a) Network forensics
b) Software forensics
c) Mobile forensics
d) Cloud forensics
Answer: b) Software forensics
3. What is the first step in the digital forensic investigation process?
a) Analysis
b) Collection
c) Reporting
d) Preservation
Answer: d) Preservation
4. Chain of custody ensures:
a) The integrity of digital evidence
b) The deletion of evidence after analysis
c) Evidence is altered for clarity
d) None of the above
Answer: a) The integrity of digital evidence
5. Digital forensics is mainly used in:
a) Criminal investigations
b) Data recovery
c) Both a & b
d) None of the above
Answer: c) Both a & b
2. Types of Digital Forensics
6. Which of the following best describes network forensics?
a) Examining deleted files on a hard drive
b) Analyzing network traffic for malicious activity
c) Recovering data from mobile phones
d) None of the above
Answer: b) Analyzing network traffic for malicious activity
7. Which forensic technique is used for analyzing cloud-based evidence?
a) Disk forensics
b) Cloud forensics
c) Network forensics
d) Software forensics
Answer: b) Cloud forensics
8. Mobile forensics primarily focuses on:
a) Analyzing email logs
b) Examining SIM card data
c) Monitoring network traffic
d) Recovering deleted programs
Answer: b) Examining SIM card data
9. File system forensics is concerned with:
a) Analyzing system logs
b) Recovering lost or deleted files
c) Encrypting stored data
d) Enhancing system performance
Answer: b) Recovering lost or deleted files
10. Which forensic branch deals with analyzing malicious software?
a) Network forensics
b) Malware forensics
c) Hardware forensics
d) Application forensics
Answer: b) Malware forensics
3. Digital Evidence & Data Acquisition
11. What is the most volatile type of digital evidence?
a) Hard drive data
b) RAM contents
c) USB drive contents
d) CD-ROM data
Answer: b) RAM contents
12. Which file format is commonly used for forensic disk images?
a) JPEG
b) PNG
c) E01
d) TXT
Answer: c) E01
13. Which method is used to prevent changes to digital evidence?
a) Hashing
b) Defragmentation
c) Encryption
d) Compression
Answer: a) Hashing
14. The purpose of a write-blocker in digital forensics is to:
a) Enhance hard drive performance
b) Prevent modification of data
c) Speed up data recovery
d) Erase all evidence
Answer: b) Prevent modification of data
15. A forensic image of a disk is:
a) A compressed backup of selected files
b) An exact bit-by-bit copy of the entire drive
c) A simple log file
d) A virtual machine snapshot
Answer: b) An exact bit-by-bit copy of the entire drive
4. Digital Forensic Tools
16. Which of the following is an open-source forensic tool?
a) EnCase
b) Autopsy
c) FTK
d) Cellebrite
Answer: b) Autopsy
17. What is the primary use of FTK (Forensic Toolkit)?
a) Analyzing network traffic
b) Recovering deleted files
c) Writing encrypted messages
d) Monitoring CPU performance
Answer: b) Recovering deleted files
18. Wireshark is used for:
a) Mobile forensic analysis
b) Network packet analysis
c) Disk imaging
d) Cloud investigation
Answer: b) Network packet analysis
19. Which forensic tool is primarily used for mobile phone investigations?
a) FTK
b) Cellebrite UFED
c) Wireshark
d) Nmap
Answer: b) Cellebrite UFED
20. Which hashing algorithm is commonly used in forensics?
a) MD5
b) AES
c) RSA
d) DES
Answer: a) MD5
5. Legal and Ethical Aspects
21. Which law regulates cybercrime in India?
a) IPC 420
b) IT Act 2000
c) Copyright Act 1957
d) Companies Act 2013
Answer: b) IT Act 2000
22. Which of the following is NOT a key aspect of digital forensic ethics?
a) Confidentiality
b) Integrity
c) Deception
d) Objectivity
Answer: c) Deception
23. Evidence that is obtained illegally:
a) Can be used in court
b) Cannot be used in court
c) Becomes more credible
d) Enhances the investigation
Answer: b) Cannot be used in court
24. The primary goal of an expert witness in digital forensics is to:
a) Provide an opinion based on technical analysis
b) Argue in favor of the prosecution
c) Modify evidence for clarity
d) Hide evidence to protect clients
Answer: a) Provide an opinion based on technical analysis
25. GDPR is a law primarily related to:
a) Digital forensics
b) Data protection
c) Computer programming
d) Mobile device security
Answer: b) Data protection
26. What is steganography? (Answer: Hiding data within other files)
27. What is the full form of IOC in forensics? (Answer: Indicator of Compromise)
28. How does a forensic examiner analyze email headers? (Answer: Extract metadata
like sender IP)
29. What is memory forensics used for? (Answer: Analyzing live RAM data)
30. How do volatile and non-volatile data differ? (Answer: Volatile is lost on shutdown)
31. Define metadata in digital forensics. (Answer: Data about data, e.g., timestamps)
