CS – D431 ITAS 2140 Digital Forensics
Comprehensive Objective Assessment (Qns &
Ans)
2025
Question 1 (Multiple Choice)
Question:
In digital forensics, preserving the integrity of evidence is
paramount. Which method is used to create a bit-for-bit copy of a
storage device to ensure that no data is altered during analysis?
A) Logical extraction
B) Forensic imaging
C) File carving
D) Network sniffing
Correct ANS:
©2025
,B) Forensic imaging
Rationale:
Forensic imaging creates an exact low-level copy of a storage
medium, capturing all allocated, unallocated, and residual data.
This process preserves the original evidence and ensures that
subsequent analyses are performed on an immutable replica.
---
Question 2 (Fill in the Blank)
Question:
To ensure that digital evidence is admissible in court,
investigators must maintain a strict ______ that documents every
movement and handling of the evidence from collection to
presentation.
Correct ANS:
chain of custody
Rationale:
The chain of custody is a documented log proving that the
evidence has been collected, preserved, and handled in a
©2025
, controlled and secure manner. It is critical for establishing the
authenticity and integrity of digital evidence in legal proceedings.
---
Question 3 (True/False)
Question:
Utilizing physical write-blockers during digital evidence
acquisition is unnecessary if forensic imaging software is used to
create a bit-for-bit image.
Correct ANS:
False
Rationale:
Write-blockers are essential hardware components used during
evidence acquisition. They prevent any write operations to the
storage media, ensuring that the data remains unaltered even when
forensic imaging software is used.
---
©2025
Comprehensive Objective Assessment (Qns &
Ans)
2025
Question 1 (Multiple Choice)
Question:
In digital forensics, preserving the integrity of evidence is
paramount. Which method is used to create a bit-for-bit copy of a
storage device to ensure that no data is altered during analysis?
A) Logical extraction
B) Forensic imaging
C) File carving
D) Network sniffing
Correct ANS:
©2025
,B) Forensic imaging
Rationale:
Forensic imaging creates an exact low-level copy of a storage
medium, capturing all allocated, unallocated, and residual data.
This process preserves the original evidence and ensures that
subsequent analyses are performed on an immutable replica.
---
Question 2 (Fill in the Blank)
Question:
To ensure that digital evidence is admissible in court,
investigators must maintain a strict ______ that documents every
movement and handling of the evidence from collection to
presentation.
Correct ANS:
chain of custody
Rationale:
The chain of custody is a documented log proving that the
evidence has been collected, preserved, and handled in a
©2025
, controlled and secure manner. It is critical for establishing the
authenticity and integrity of digital evidence in legal proceedings.
---
Question 3 (True/False)
Question:
Utilizing physical write-blockers during digital evidence
acquisition is unnecessary if forensic imaging software is used to
create a bit-for-bit image.
Correct ANS:
False
Rationale:
Write-blockers are essential hardware components used during
evidence acquisition. They prevent any write operations to the
storage media, ensuring that the data remains unaltered even when
forensic imaging software is used.
---
©2025
