Digital Forensics: Key Principles, Evidence
Handling, and File System Analysis Exam |
Questions with 100% Correct Answers | Verified |
Latest Update 2026
Save
Practice questions for this set
Learn 1 /7 Study using Learn
IDA Pro, Hopper, Radare2, Ghidra
Choose an answer
1 ACPO Principles — all 4 2 Human Rights Act 1998
3 Direct vs circumstantial 4 Static analysis tools
Don't know?
Terms in this set (167)
, ACPO Principles — all 4 (1) No action should change data relied upon in
court; (2) Person accessing original must be
competent + able to explain; (3) Audit trail of all
processes; (4) Investigator in charge is responsible
Locard's Exchange Principle "Every contact leaves a trace." Digital: any
interaction leaves residue (logs, timestamps,
registry, memory)
Chain of custody Documented chronological record of seizure,
custody, transfer, analysis, disposition. Must be
unbroken for admissibility.
Real / testimonial / hearsay Real = physical/digital objects; Testimonial = witness
statement; Hearsay = out-of-court statement for
truth (usually inadmissible)
Direct vs circumstantial Direct = proves a fact without inference;
Circumstantial = requires inference. Forensic =
usually circumstantial.
Inculpatory vs exculpatory Inculpatory = supports guilt; Exculpatory =
supports innocence. Investigator must consider
both.
Integrity, repeatability, Integrity = evidence unchanged; Repeatability =
reproducibility same examiner, same result; Reproducibility =
different examiner, same result
Properties of digital evidence — Copies are perfect; hash-verifiable; rich metadata;
strengths searchable; permanent unless destroyed
Handling, and File System Analysis Exam |
Questions with 100% Correct Answers | Verified |
Latest Update 2026
Save
Practice questions for this set
Learn 1 /7 Study using Learn
IDA Pro, Hopper, Radare2, Ghidra
Choose an answer
1 ACPO Principles — all 4 2 Human Rights Act 1998
3 Direct vs circumstantial 4 Static analysis tools
Don't know?
Terms in this set (167)
, ACPO Principles — all 4 (1) No action should change data relied upon in
court; (2) Person accessing original must be
competent + able to explain; (3) Audit trail of all
processes; (4) Investigator in charge is responsible
Locard's Exchange Principle "Every contact leaves a trace." Digital: any
interaction leaves residue (logs, timestamps,
registry, memory)
Chain of custody Documented chronological record of seizure,
custody, transfer, analysis, disposition. Must be
unbroken for admissibility.
Real / testimonial / hearsay Real = physical/digital objects; Testimonial = witness
statement; Hearsay = out-of-court statement for
truth (usually inadmissible)
Direct vs circumstantial Direct = proves a fact without inference;
Circumstantial = requires inference. Forensic =
usually circumstantial.
Inculpatory vs exculpatory Inculpatory = supports guilt; Exculpatory =
supports innocence. Investigator must consider
both.
Integrity, repeatability, Integrity = evidence unchanged; Repeatability =
reproducibility same examiner, same result; Reproducibility =
different examiner, same result
Properties of digital evidence — Copies are perfect; hash-verifiable; rich metadata;
strengths searchable; permanent unless destroyed
