Digital Forensics Quiz | CyberSec Academy

1. What is the first step in digital forensics?

Preserve the evidence

Make a copy of the hard drive

Interview witnesses

Analyze network logs

2. Which tool creates forensic disk images?

FTK Imager

Wireshark

Autopsy

Volatility

3. What does a write blocker do?

Prevents modification of evidence media

Encrypts forensic images

Blocks unauthorized network access

Prevents data recovery

4. Which file format is commonly used for forensic images?

EnCase (E01)

JPEG

MP4

DOCX

5. What is the purpose of hashing in forensics?

Verify evidence integrity

Recover deleted files

Encrypt sensitive data

Speed up analysis

6. Which tool analyzes memory dumps?

Volatility

Autopsy

FTK

EnCase

7. What does the chain of custody document?

Evidence handling from collection to court

Network connections

Password hashes

File permissions

8. Where are Windows Registry hives stored?

C:\Windows\System32\config

C:\Program Files

C:\Users\Default

C:\Temp

9. What is slack space?

Unused space in disk clusters that may contain old data

Free space on the hard drive

Temporary internet files

Unallocated partitions

10. Which command shows network connections on Windows?

netstat -ano

ipconfig /all

tracert

ping