Digital Forensics and Mobile Evidence: Key
Concepts and Techniques Exam Questions
and Answers with Verified Solutions | Latest
Updated 2026
What is digital forensics? Digital forensics is the process of
identifying,
preserving and analysing digital evidence
in a
legally admissible way in court
What is computer security? Computer security is proactive its prevents
breaches and protects systems before
they happen
What is the difference between Forensics is reactive it happens after a
forensics and security? breach has
occurred it triggers an investigation.
Security is
proactive is prevents a breach before they
happen
What is encoding? Encoding transforms data into a different
format
using a public scheme no key needed.
What is encryption? Encryption transforms data using a secret
key.
,What is a sector? A sector is the smallest hardware unit on a
disk,
fixed at 512 bytes
What is a cylinder? A cylinder is the same track position
across all
platters on a hard disk.
What is a head? A head is the read/write mechanism that
reads
both sides of a disk platter.
What is LBA? Logical Block Addressing is a modern
method that
gives each sector a unique sequential
number,
replacing CHS and supporting disks over
8GB.
What is hashing? Hashing is a one-way function that takes
data and
produces a fixed length value. The same
input
always gives the same output and it is
used to
prove evidence has not been tampered
with.
What happens if the hash The evidence is tainted and cannot be
changes? used in
court. The chain of custody is broken.
, What is a hash collision? A hash collision is when two different files
produce
the same hash value. It is prevented by
using two
algorithms at once such as MD5 and
SHA-1.
What is a write blocker? A write blocker is a device placed between
a
suspect drive and a forensic computer that
allows
reading but blocks all writing, preventing
accidental modification of evidence.
What is a raw image (.dd)? A raw image is an exact bit-for-bit copy of
a disk
with no compression, no metadata and no
checksums.
What is an evidence file (.E01)? An evidence file is a container holding the
disk
image with compression, case information,
examiner name and internal checksums,
making it
preferred for legal evidence.
What is a file system? A file system is how the operating system
organises
and stores files on a drive. It contains the
files
themselves, metadata in the MFT, a free
space map
and a boot sector.
Concepts and Techniques Exam Questions
and Answers with Verified Solutions | Latest
Updated 2026
What is digital forensics? Digital forensics is the process of
identifying,
preserving and analysing digital evidence
in a
legally admissible way in court
What is computer security? Computer security is proactive its prevents
breaches and protects systems before
they happen
What is the difference between Forensics is reactive it happens after a
forensics and security? breach has
occurred it triggers an investigation.
Security is
proactive is prevents a breach before they
happen
What is encoding? Encoding transforms data into a different
format
using a public scheme no key needed.
What is encryption? Encryption transforms data using a secret
key.
,What is a sector? A sector is the smallest hardware unit on a
disk,
fixed at 512 bytes
What is a cylinder? A cylinder is the same track position
across all
platters on a hard disk.
What is a head? A head is the read/write mechanism that
reads
both sides of a disk platter.
What is LBA? Logical Block Addressing is a modern
method that
gives each sector a unique sequential
number,
replacing CHS and supporting disks over
8GB.
What is hashing? Hashing is a one-way function that takes
data and
produces a fixed length value. The same
input
always gives the same output and it is
used to
prove evidence has not been tampered
with.
What happens if the hash The evidence is tainted and cannot be
changes? used in
court. The chain of custody is broken.
, What is a hash collision? A hash collision is when two different files
produce
the same hash value. It is prevented by
using two
algorithms at once such as MD5 and
SHA-1.
What is a write blocker? A write blocker is a device placed between
a
suspect drive and a forensic computer that
allows
reading but blocks all writing, preventing
accidental modification of evidence.
What is a raw image (.dd)? A raw image is an exact bit-for-bit copy of
a disk
with no compression, no metadata and no
checksums.
What is an evidence file (.E01)? An evidence file is a container holding the
disk
image with compression, case information,
examiner name and internal checksums,
making it
preferred for legal evidence.
What is a file system? A file system is how the operating system
organises
and stores files on a drive. It contains the
files
themselves, metadata in the MFT, a free
space map
and a boot sector.
