Introduction to Computer Forensics DFE Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A forensic analyst is investigating a case of cyberstalking. The suspect's computer contains a chat log that appears to show threatening messages. The analyst must determine if the chat log is authentic or if it was fabricated. Which characteristic of digital evidence is the analyst relying on to make this determination?

   • ADigital evidence is immutable and cannot be changed
   • BDigital evidence can be easily fabricated
   • CDigital evidence is often stored in a proprietary format
   • DDigital evidence is always stored in a central location
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which of the following is a primary goal of computer forensics?

   • ATo publicly disclose findings before the investigation is complete
   • BTo delete irrelevant files to streamline analysis
   • CTo encrypt all data on a suspect's device
   • DTo preserve digital evidence in its original state
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A company is facing a lawsuit and must produce emails and documents from an employee's computer. The legal team wants to ensure the evidence is admissible in court. Which action is most important for the forensic team to take?

   • ACreate a forensic image of the hard drive and document the chain of custody
   • BUse the employee's own login to access the computer and copy relevant files
   • CAsk the employee to print out the relevant emails and documents
   • DHave the IT department search the computer and provide a summary of findings
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   During a forensic examination of a computer, an investigator finds a file that appears to contain a list of passwords. The file's metadata shows it was created three months ago, but the investigator suspects it was recently modified. Which characteristic of digital evidence is the investigator relying on to test this suspicion?

   • ADigital evidence contains metadata that records system activity
   • BDigital evidence is fragile and can be easily damaged
   • CDigital evidence is a copy of the original data
   • DDigital evidence is often hidden or obfuscated
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which step in the computer forensics process involves presenting findings in a clear and understandable manner?

   • AReporting
   • BAnalysis
   • CAcquisition
   • DPreservation
   Reveal Solution Discussion Select an answer first