Digital Forensics · Interactive Exercises

🔍

Fundamentals & Process

3 questions

Digital forensics uncovers evidence from electronic devices — recovering deleted files, examining traffic logs, analysing memory — and follows a defined 6-stage process to keep that evidence admissible.

Digital forensics is best defined as:

1 mark

Writing secure application code

The field of investigation and analysis focused on uncovering digital evidence from electronic devices and systems

Penetration testing a live network

Designing firewalls

What are the six stages of the digital forensics process, in order?

2 marks

Collection → Analysis → Identification → Presentation → Examination → Preservation

Identification → Preservation → Collection → Examination → Analysis → Presentation

Preservation → Identification → Analysis → Collection → Examination → Presentation

Analysis → Presentation → Identification → Collection → Preservation → Examination

"Preservation" in the forensics process is primarily about:

1 mark

Securing and protecting evidence so it stays unaltered and remains admissible

Presenting findings to a jury

Recovering deleted files

Installing forensic software

Fundamentals & Process score

0/4

🗂️

Types of Evidence & Tools

5 questions

Evidence comes in several forms — and each needs different tools. Memory is especially valuable because it captures the live state of a system, which disappears the moment power is lost.

Which of these are listed as the four types of digital evidence in the lecture? (select all)

2 marks

File system artifacts

Network traffic logs

Social media follower counts

Memory dumps

Mobile device data

A memory dump (RAM capture) is especially valuable in forensics because it can reveal:

1 mark

Only deleted files from years ago

Running processes, open files, network connections, and encryption keys live at capture time

Only the file system's folder structure

Nothing useful — it is just noise

Which tool is specifically named for memory analysis in the forensic tools list?

1 mark

EnCase

Volatility

Autopsy

Wireshark

Which tool is specifically named for network traffic analysis?

1 mark

FTK

EnCase

Wireshark

Autopsy

File metadata such as timestamps, permissions, and deletion/recovery records fall under which evidence category?

1 mark

Network traffic logs

Mobile device data

Memory dumps

File system artifacts

Types of Evidence & Tools score

0/6

🧬

CTF Forensic Techniques & Encodings

6 questions

Forensic-flavoured CTF challenges lean heavily on steganography (hiding data inside another file), encoding schemes, and files that are hidden but not encrypted.

Base64 encoding represents binary data using how many characters from the ASCII set?

1 mark

256

Q10

Hexadecimal ("hex") encoding is a base-____ number system.

1 mark

Q11

Which encoding scheme is named alongside Base64 and URL encoding as commonly appearing in CTF flag-decoding challenges?

1 mark

ROT13

bcrypt

SHA-256

RSA-2048

Q12

Which Linux command lists hidden files (those starting with a dot) in a directory?

1 mark

ls -a

find /etc

cat -h

grep -r

Q13

On Windows, which command-line option reveals hidden files in a directory listing?

1 mark

dir /ah

dir /s

dir /w

dir /p

Q14

Which forensic technique involves hiding data inside an image, audio, or other file so it is not visible without special tools?

1 mark

Steganography

Encoding

Hashing

Tokenization

CTF Forensic Techniques & Encodings score

0/6

⚠️

Challenges & Emerging Trends

5 questions

Encryption and anti-forensic techniques make investigations harder; meanwhile cloud, IoT, and privacy regulation keep reshaping where and how evidence can even be gathered.

Q15

In the scenario about a suspect's encrypted smartphone, what is the core challenge posed by strong encryption?

1 mark

It makes the phone slower

It is illegal for law enforcement to attempt decryption

It corrupts file timestamps

Without the decryption key, forensic analysts cannot access the data at all

Q16

"Anti-forensic techniques" (file wiping, data overwriting, etc.) are used by perpetrators to:

1 mark

Speed up file transfers

Encrypt communications for privacy compliance

Erase or obfuscate digital evidence and cover their tracks

Improve system performance

Q17

Which regulations are named as introducing challenges around data access/privacy during forensic investigations?

1 mark

HIPAA and SOX

GDPR and CCPA

PCI-DSS and ISO 27001

FISMA and NIST 800-53

Q18

"Cloud forensics" is concerned with:

1 mark

Forensics performed only on weather-prediction systems

Recovering paper documents

Analysing IoT device firmware

Collecting, preserving, and analysing evidence stored on remote cloud platforms

Q19

What real-world example does the lecture give for the relevance of "IoT forensics"?

1 mark

Analysing a firewall's logs

Analysing a corporate laptop's hard drive

Recovering deleted emails from a mail server

A voice-activated smart home assistant possibly recording audio evidence relevant to a crime

Challenges & Emerging Trends score

0/5

—

Complete all questions to see your final score