ALISON Digital Forensics & Cybercrime Investigation 2

Question 1

What does 'live forensics' refer to in digital investigations?

Accepted Answer

Forensics performed on systems that are currently powered on and running

Answer

Analysing video footage from live security cameras

Answer

Real-time analysis of network intrusion attempts

Answer

Forensics performed in a live TV broadcast

Question 2

Which Windows artifact stores recently accessed files and is valuable to forensic investigators?

Accepted Answer

Link files (LNK files)

Answer

Pagefile.sys

Answer

Registry hive NTUSER.DAT

Answer

Windows Event Logs

Question 3

What is the purpose of the Windows Registry in a forensic investigation?

Accepted Answer

It records system configuration, user activity, and installed software that can reveal attacker behavior

Answer

It stores temporary internet files and browser cache

Answer

It contains all email messages sent and received on the system

Answer

It stores encrypted copies of all user passwords

Question 4

What type of file system artifact allows forensic investigators to recover deleted files on NTFS volumes?

Accepted Answer

Master File Table ($MFT)

Answer

Master Boot Record

Answer

Volume Shadow Copies

Answer

Recycle Bin metadata

Question 5

What is 'steganography' and why is it relevant to digital forensics?

Accepted Answer

Hiding data within ordinary-looking files like images to conceal communications or exfiltrate data

Answer

A technique for encrypting network traffic to avoid detection

Answer

A method for bypassing file system access controls

Answer

A type of malware that hides in system firmware

Question 6

Which log file in Linux systems is most useful for tracking user authentication events during a forensic investigation?

Accepted Answer

/var/log/auth.log

Answer

/var/log/syslog

Answer

/var/log/kern.log

Answer

/var/log/dmesg