ALISON Digital Forensics & Cybercrime Investigation

Question 1

What is the primary purpose of maintaining a 'chain of custody' in digital forensics?

Accepted Answer

To ensure digital evidence remains admissible and unaltered throughout an investigation

Answer

To speed up the evidence collection process

Answer

To share evidence with law enforcement agencies quickly

Answer

To encrypt all collected evidence files

Question 2

Which principle in digital forensics states that any contact between two items leaves a trace?

Accepted Answer

Locard's Exchange Principle

Answer

Occam's Razor

Answer

Shannon's Information Theory

Answer

Bell-LaPadula Model

Question 3

What is the correct order of volatility in digital evidence collection?

Accepted Answer

CPU registers → RAM → Network → Disk

Answer

Disk → RAM → Network → CPU registers

Answer

Network → Disk → RAM → CPU registers

Answer

RAM → Disk → CPU registers → Network

Question 4

What is a 'forensic image' in digital forensics?

Accepted Answer

A bit-for-bit copy of a storage device including unallocated space

Answer

A screenshot taken during an investigation

Answer

A photograph of the crime scene equipment

Answer

An encrypted backup of the suspect's files

Question 5

What tool is commonly used on Linux/Unix systems to create a forensic bit-stream image of a drive?

Accepted Answer

dd

Answer

Wireshark

Answer

Metasploit

Answer

Nmap

Question 6

Which hashing algorithm is most commonly used to verify the integrity of forensic disk images?

Accepted Answer

MD5 or SHA-1/SHA-256

Answer

DES

Answer

RSA-2048

Answer

AES-256