EN6106 – Digital Forensics

Important Instructions

This paper has 25 questions covering all sub-topics of Lesson 5: Digital Forensics.
Each question has 5 choices with ONE OR MORE correct answers.
All questions carry equal marks (4 marks each, total 100 marks).
There is a penalty for incorrect responses to discourage guessing.
To PASS, you must score at least 40 marks out of 100.
Click Submit Paper only when you have answered all questions.

Marking Scheme (per question — max 4 marks)

Score = [ (Correct choices selected ÷ Total correct choices) − (Wrong choices selected ÷ Total wrong choices) ] × 4
Minimum score per question = 0 | Maximum = 4.00

5.1 — Forensic Science

Q 01Which of the following statements correctly describe forensic science?4 marks

(a)Forensic science is a scientific discipline that applies scientific methods and principles to the investigation of crimes and legal issues.

(b)Forensic science involves the collection, analysis, and interpretation of physical evidence such as blood, fingerprints, DNA, and fibres.

(c)Forensic science is exclusively concerned with DNA analysis and does not include any other type of physical or digital evidence.

(d)Forensic science uses a variety of specialized techniques, instruments, and technologies to analyze evidence and reconstruct crime scenes.

(e)Forensic science is a single unified discipline without any specialized sub-areas or branches.

Question score:—

Q 02Which of the following are recognized specialized areas of forensic science as described in the lecture material?4 marks

(a)Forensic Biology — the study of biological evidence such as DNA, blood, and other bodily fluids.

(b)Forensic Chemistry — the analysis of chemicals and materials found at crime scenes.

(c)Forensic Ontology — the formal representation and classification of crime-scene knowledge using logical frameworks.

(d)Forensic Toxicology — the study of the effects of drugs and poisons on the body.

(e)Forensic Psychology — the study of human behavior and how it relates to criminal investigations.

Question score:—

5.2 — Introduction to Digital Forensics

Q 03Which of the following statements correctly describe digital forensics?4 marks

(a)Digital forensics involves the recovery, preservation, analysis, and presentation of electronic data stored, transmitted, or processed on digital devices.

(b)Digital forensics analyzes, examines, identifies and recovers digital evidence residing on electronic devices such as computers and mobile phones.

(c)Digital forensics is limited to analyzing only physical hard drives and cannot be applied to mobile phones or cloud storage.

(d)Digital forensics emerged as a field in response to computer-related crime and the need to investigate digital evidence.

(e)Computer forensics is a sub-field of digital forensics, which is itself a sub-field of forensic science.

Question score:—

Q 04Which of the following are recognized sub-categories of digital forensics?4 marks

(a)Computer Forensics — including Post Mortem Forensics and Live Forensics.

(b)Mobile Forensics — including Android Forensics, iOS Forensics, and Windows Phone / Symbian forensics.

(c)Biological Forensics — focused on recovering and analyzing organic material found on digital devices.

(d)Network Forensics — including Live Network Forensics and Application Forensics.

(e)Other Devices Forensics — covering DVRs, routers, game consoles, and skimming devices.

Question score:—

Q 05Which of the following are recognized types of digital evidence?4 marks

(a)Email and messaging data.

(b)Metadata — information about a file such as the date and time it was created or modified.

(c)Hair and fibre samples collected from a computer keyboard.

(d)Internet data, social media data, and cloud data.

(e)Audio and video data stored on digital devices or transmitted over networks.

Question score:—

Q 06Which of the following statements about the history of computer crimes and digital forensics legislation are correct?4 marks

(a)The first computer crime in Florida in 1978 involved unauthorized modification and deletion of data on a computer system.

(b)Canada was the first country to pass legislation specifically dealing with computer crimes, in 1983.

(c)Prior to 1980, dedicated federal laws for computer crimes already existed in the United States.

(d)The United States passed the Federal Computer Fraud and Abuse Act in 1984.

(e)The United Kingdom passed the British Computer Misuse Act in 1990.

Question score:—

Q 07Which of the following are technological advances that have allowed digital forensics to evolve over time?4 marks

(a)Imaging Technology — allows investigators to create forensic images of storage devices for analysis using specialized software.

(b)Data Recovery Tools — recover lost or deleted data from digital devices, even if intentionally deleted or hidden.

(c)Blockchain Forensics — used to trace cryptocurrency transactions and analyze them in a forensically sound manner.

(d)Typewriter Technology — enables investigators to produce faster printed reports from crime scene notes.

(e)Virtualization Technology — enables creation of virtual machines and environments for forensic analysis, reducing the need for physical hardware.

Question score:—

Q 08Which of the following statements about Artificial Intelligence and Machine Learning in digital forensics are correct?4 marks

(a)AI and ML can aid in the development of automated tools that help in the analysis of digital evidence.

(b)AI-powered tools can quickly identify patterns and anomalies in large datasets, making it easier for investigators to focus on areas of interest.

(c)AI completely replaces the need for trained digital forensics investigators and makes human expertise obsolete.

(d)Live Forensics technology allows investigators to analyze digital devices in real-time to quickly identify and respond to security threats.

(e)Cloud Forensics technology enables investigators to recover and analyze cloud-based data.

Question score:—

Q 09According to the lecture, digital forensics is mainly used in which of the following application areas?4 marks

(a)Criminal Law — collecting evidence to support or oppose a proposed explanation or argument in court.

(b)Private Investigation — mainly used by the corporate world when companies are suspicious that employees may be performing illegal activities.

(c)Weather forecasting — using historical digital records to predict future climate events.

(d)Private investigations using forensic procedures similar to those used in criminal investigations but with different legal requirements and limitations.

(e)Retail inventory management — using forensic tools to track stock movements in warehouses.

Question score:—

Q 10Which of the following correctly describe the role of digital forensics in law enforcement?4 marks

(a)Cybercrime Investigations — to identify and track down cybercriminals by analyzing digital evidence such as IP addresses, log files, and metadata.

(b)Child Exploitation Cases — to uncover evidence of illegal activities involving children for prosecution and victim protection.

(c)Fraud Investigations — to analyze digital records and financial transactions and identify patterns indicating fraudulent activity.

(d)Traffic Management — using digital evidence to monitor and regulate road traffic violations in real time.

(e)Terrorism Investigations — to track down and identify individuals and groups involved in terrorist activities.

Question score:—

Q 11Which of the following statements about digital forensics and investigative efficiency are correct?4 marks

(a)Digital forensics helps law enforcement work more efficiently by reducing the time and resources required to investigate crimes.

(b)With digital evidence, investigators can quickly identify suspects, track their movements, and gather evidence to support a prosecution.

(c)Digital forensic evidence can be presented in court as evidence to support a prosecution, and digital forensic experts may be called to testify.

(d)Digital forensics always increases investigation time due to the complexity of recovering and analyzing electronic data.

(e)Digital evidence collected in investigations can also be used to provide alibis for innocent suspects.

Question score:—

5.3 — Digital Forensic Procedures

Q 12The process of digital forensic investigation typically involves four phases carried out in sequence. Which of the following correctly identifies those four phases in the correct order?4 marks

(a)Identification → Collection → Examination → Analysis

(b)Collection → Identification → Analysis → Examination

(c)Analysis → Examination → Collection → Identification

(d)Digital forensic investigation is the process of collecting, preserving, analyzing, and presenting digital evidence in a manner that is admissible in court.

(e)Identification → Analysis → Collection → Examination

Question score:—

Q 13Which of the following activities are performed during the Identification Phase of a digital forensic investigation?4 marks

(a)Gathering information from stakeholders such as law enforcement, corporate security, and legal teams to determine the scope and objectives.

(b)Identifying potential sources of digital evidence, including devices, storage media, email accounts, social media platforms, and cloud services.

(c)Using specialized software tools to interpret evidence and produce the final report of findings for legal proceedings.

(d)Identifying relevant metadata such as the date, time, and location of a file, and the user who created it.

(e)Drafting the final prosecution report and submitting it to the court of law.

Question score:—

Q 14Which of the following correctly describe activities that occur during the Collection Phase of a digital forensic investigation?4 marks

(a)Gathering all potential sources of digital evidence identified during the Identification phase, including physical devices and cloud-stored data.

(b)Using techniques such as imaging a hard drive, creating a forensic copy of a mobile device, or using network sniffing tools to capture network traffic.

(c)Creating a detailed chain of custody for each piece of evidence collected.

(d)Reviewing and interpreting digital evidence to draw legal conclusions and develop the report of findings for the court.

(e)Obtaining a search warrant or other legal authorization before collecting digital evidence.

Question score:—

Q 15Which of the following statements correctly describe the Chain of Custody in digital forensics?4 marks

(a)The chain of custody is a way to document the handling and movement of evidence in a digital forensics investigation.

(b)It helps prevent tampering, contamination, or loss of evidence and ensures that evidence is reliable and admissible in court.

(c)The chain of custody starts after the evidence has been examined and ends when the final report is written.

(d)The chain of custody starts when the evidence is first collected and ends when it is presented in court.

(e)It records who had control of the evidence, when they had it, and what they did with it.

Question score:—

Q 16Which of the following are items that should be included in a chain of custody form?4 marks

(a)The date and time the evidence was collected or transferred.

(b)The location and description of the evidence.

(c)The encryption key used to protect the evidence during storage.

(d)The name of the person handling the evidence, who must document their actions and sign the form.

(e)The suspect's full confession and guilty plea recorded on the form.

Question score:—

Q 17Which of the following statements about breaks in the chain of custody are correct?4 marks

(a)Any breaks in the chain of custody can weaken the credibility of the evidence.

(b)A break in the chain of custody may result in evidence being excluded from the trial.

(c)Breaks in the chain of custody automatically invalidate the entire investigation and require it to restart from the beginning.

(d)It is important to maintain a complete and unbroken chain of custody throughout the investigation.

(e)Each person who handles the evidence must document their actions and sign the chain of custody form.

Question score:—

Q 18Which of the following correctly describe activities and purposes of the Examination Phase?4 marks

(a)The investigator carefully examines digital evidence using a variety of techniques including specialized software tools and manual analysis.

(b)The purpose is to determine the relevance and significance of digital evidence to the investigation.

(c)The investigator attempts to identify patterns or connections between different pieces of digital evidence.

(d)In this phase, the investigator gathers all potential sources of digital evidence and creates forensic images for preservation.

(e)Only relevant and significant evidence, identified during the examination, is analyzed in the subsequent phases.

Question score:—

Q 19The Examination Phase produces three kinds of evidence. Which of the following correctly match the type of evidence with its description?4 marks

(a)Inculpatory evidence — supports a given hypothesis or version of events in the investigation.

(b)Exculpatory evidence — contradicts a given hypothesis and may support the innocence of a suspect.

(c)Constructive evidence — evidence that has been legally constructed by investigators to fill gaps in the forensic timeline.

(d)Evidence of tampering — shows that the system was altered to avoid identification, including examining files and directories to recover deleted files.

(e)Testimonial evidence — verbal statements given by the suspect under oath during the examination phase of the investigation.

Question score:—

Q 20Which of the following correctly describe activities and tools used in the Analysis Phase of a digital forensic investigation?4 marks

(a)The investigator reviews and interprets digital evidence to draw conclusions and develop a report of findings.

(b)The investigator looks for patterns, connections, and meaningful relationships to develop an understanding of the case.

(c)The investigator uses specialized software such as data recovery tools, network analysis tools, and decryption tools.

(d)The goal is to provide a clear and detailed report of digital evidence and findings that can be used in legal proceedings.

(e)In this phase, investigators first secure and preserve the physical devices and create forensic images to prevent any alteration of data.

Question score:—

5.4 — Example Use Case Scenario

Q 21In the cybercrime investigation use case at the retail company, which of the following actions were performed during the Collection Phase?4 marks

(a)The forensics team secured the affected servers and made forensic images to preserve the data in its original state.

(b)They collected server logs and network traffic to determine how the hackers gained access to the system.

(c)They analyzed the recovered customer data to identify the specific names, addresses, and credit card numbers compromised.

(d)They conducted interviews with company employees to gather information about any suspicious activity they may have noticed.

(e)They sentenced the hackers found to be responsible for the data breach.

Question score:—

Q 22In the cybercrime use case, which of the following tasks were performed during the Examination and Analysis Phases?4 marks

(a)Examining preserved images to recover stolen customer data using specialized software and tools.

(b)Using forensic tools to recover deleted files and any data that may have been hidden or encrypted.

(c)Identifying patterns and trends in network traffic to determine the source of the attack and whether hackers attempted to alter or delete data.

(d)Securing the affected servers and making forensic images to preserve the data in its original state.

(e)Assessing the potential harm to affected individuals and determining the scope and impact of the data breach.

Question score:—

5.5 — Skills Required for Digital Forensics Investigation

Q 23Which of the following are identified as key skills required for a digital forensics investigator?4 marks

(a)Outstanding thinking capabilities — able to apply different tools and methodologies, find patterns, and make correlations.

(b)Technical skills — knowledge of networks and how digital systems interact.

(c)Artistic creativity — ability to produce visually engaging infographics and illustrations for court presentations.

(d)Communication skills — to coordinate with various teams and extract any missing data or information.

(e)Skillful in report making — the forensic examiner must mention all findings in a final report with attention to detail.

Question score:—

Q 24Which of the following statements about digital evidence are correct?4 marks

(a)Digital evidence refers to information stored or transmitted in binary form that can be relied upon in court as evidence.

(b)Digital evidence must be collected in a forensically sound manner to ensure it is admissible in court and has not been tampered with.

(c)Metadata can be used to piece together a timeline of events because it contains information such as when a file was created or modified.

(d)Digital evidence is less reliable than physical evidence and is never admissible in a court of law.

(e)Contents of computer memory and internet browser histories are examples of digital evidence that can be gathered in an investigation.

Question score:—

Q 25Which of the following statements are TRUE with respect to the overall scope and purpose of digital forensics as covered in this lesson?4 marks

(a)Digital forensics is a branch of forensic science focused on identifying, acquiring, processing, analyzing, and reporting electronically stored data.

(b)The four phases of digital forensic investigation (Identification, Collection, Examination, Analysis) are typically followed in sequence and are all critical to the process.

(c)Digital forensics is only applicable to criminal law cases and cannot be applied in corporate or private investigation contexts.

(d)Passion for cyber security, report writing skills, and communication skills are identified as important attributes for a digital forensics investigator.

(e)Virtualization technology is listed as one of the modern technological advances that has allowed digital forensics to evolve, enabling the creation of virtual environments for forensic analysis.

Question score:—

EN6106 — Emerging Topics in Information Technology

Important Instructions

Your Result