ALISON Digital Forensics & Cybercrime Investigation 2

Question 1

What does 'live forensics' refer to in digital investigations?

Accepted Answer

Forensics performed on systems that are currently powered on and running

Answer

Live forensics involves collecting volatile data (RAM, running processes, network connections) from a powered-on system before shutting it down.

Question 2

Which Windows artifact stores recently accessed files and is valuable to forensic investigators?

Accepted Answer

Link files (LNK files)

Answer

Windows LNK (shortcut) files automatically created in Recent Items contain metadata about accessed files including timestamps and original file paths.

Question 3

What is the purpose of the Windows Registry in a forensic investigation?

Accepted Answer

It records system configuration, user activity, and installed software that can reveal attacker behavior

Answer

The Windows Registry contains keys tracking program execution, USB connections, recently accessed files, and persistence mechanisms used by malware.

Question 4

What type of file system artifact allows forensic investigators to recover deleted files on NTFS volumes?

Accepted Answer

Master File Table ($MFT)

Answer

The NTFS Master File Table ($MFT) retains metadata about deleted files even after deletion, enabling partial or full file recovery.

Question 5

What is 'steganography' and why is it relevant to digital forensics?

Accepted Answer

Hiding data within ordinary-looking files like images to conceal communications or exfiltrate data

Answer

Steganography conceals data inside carrier files, and forensic investigators must detect and extract hidden content during investigations.

ALISON - Advance Learning Interactive Systems Online Practice Test

ALISON - Advance Learning Interactive Systems Online Practice Test

ALISON Digital Forensics & Cybercrime Investigation 2