Latest blogs

Why passing the CFE exam is not enough, and how we train you to thrive where it really matters: on the ground

DIGITAL FORENSICS QUIZ

Computer Security
-June 18, 2025

Think you can trace digital footprints, uncover hidden evidence, or spot cybercrime like a pro? Take this quick but revealing quiz and test your forensic instincts, you might be smarter than a hacker… or you might be leaving clues behind without even knowing it. Only one way to find out, dive in, follow the digital trail, and uncover what your instincts are made of.

SCORING GUIDE

Score Range	Level	Interpretation
90–100	Expert	You have strong digital forensics skills and can support or lead investigations.
70–80	Proficient	You understand key concepts well, but need more hands-on practice or tools use.
50–68	Developing	You grasp the basics but may miss subtle details in real investigations.
30–48	Beginner	High risk of oversight in forensic-sensitive environments. Needs full training.
Below 30	High risk	Unfit to handle digital evidence without supervision. Must attend foundational course.

Level: Basic to Intermediate

Total Questions: 25

Digital Forensics

Digital Forensics quiz

#Welcome to the Digital Forensics Quiz. This assessment is designed to test your knowledge of core principles, procedures, and best practices in digital forensic investigations, especially in regulated and organizational environments.

🔒 Personal Details
Kindly fill in your details below to receive a personalized copy of your quiz responses. By sharing your information, you’ll also get a chance to access exclusive insights, expert tips, and updates on upcoming forensic tools, training opportunities, and cybersecurity events. Stay informed. Stay ahead.

1 / 25

Category: DIGITAL FORENSICS Questions

1. What is the primary goal of digital forensics?

A. Punish the attacker

B. Gain revenge for the breach

C. Identify, preserve, analyze, and present digital evidence

D. Format the infected machine

2 / 25

Category: DIGITAL FORENSICS Questions

2. Which of the following best defines “chain of custody”?

A. The list of people who have ever used a computer

B. A record showing who has controlled and accessed evidence from the moment it was collected

C. The serial number on a hard drive

D. A password list for encrypted data

3 / 25

Category: DIGITAL FORENSICS Questions

3. Which type of forensics analyzes logs, internet history, and registry keys?

A. File system forensics

B. Network forensics

C. Memory forensics

D. Operating system forensics

4 / 25

Category: DIGITAL FORENSICS Questions

4. Deleted files cannot be recovered once the recycle bin is emptied.

True

False

5 / 25

Category: DIGITAL FORENSICS Questions

5. Which tool is commonly used for imaging hard drives in forensic investigations?

A. WinRAR

B. FTK Imager

C. MS Paint

D. Excel

6 / 25

Category: DIGITAL FORENSICS Questions

6. What is the first step when starting a digital forensic investigation?

A. Connect the suspect computer to the internet

B. Clone the hard drive using a write blocker

C. Open all files on the device

D. Shut down the computer and delete logs

7 / 25

Category: DIGITAL FORENSICS Questions

7. What does volatile data refer to in forensics?

A. Data stored in external drives

B. Data stored in the Recycle Bin

C. Data that disappears when power is lost (e.g., RAM content)

D. Data that causes damage to devices

8 / 25

Category: DIGITAL FORENSICS Questions

8. Which of the following combinations includes the two legal documents an investigator must secure before conducting a forensic investigation in a regulated institution?

A. Employee contract and search warrant

B. Internal investigation authorization letter and staff ID copy

C. Search warrant or court order, and internal investigation authorization letter

D. Disciplinary report and internal investigation authorization letter

9 / 25

Category: DIGITAL FORENSICS Questions

9. What best describes metadata and its importance in digital forensics?

A. Metadata is hidden data that describes other data, such as creation date, author, or modification history. It’s crucial in forensics because it reveals when a document was created or changed, who accessed it, or which device it came from

B. Metadata refers to user passwords and login credentials; it’s used to verify user identity during investigations.

C. Metadata is the visible text in a document used for indexing; it helps in organizing files alphabetically

D. Metadata is encrypted content that protects files from unauthorized access; it is mainly used to block forensic analysis.

10 / 25

Category: DIGITAL FORENSICS Questions

10. A finance officer sends a PDF document to URA. The file has no visible issues, but the metadata shows a filename: ‘Tax_Evasion_Draft_v2.pdf.’ What are the implications for the organization?

A. None

B. Only URA can see it

C. It could trigger an audit or legal scrutiny

D. It means the officer is innocent

11 / 25

Category: DIGITAL FORENSICS Questions

11. Which of the following can be used to extract deleted files from a hard disk?

A. Wireshark

B. DiskDigger

C. Adobe Reader

D. Google Chrome

12 / 25

Category: DIGITAL FORENSICS Questions

12. What is a write blocker, and why is it used in forensics?

A. A write blocker is a device or software that allows read-only access to a storage device. It is used to prevent accidental or malicious modification of original evidence during forensic imaging

B. A write blocker is a tool that encrypts digital evidence to keep it secure during storage

C. A write blocker is used to erase all data from a suspect's device before analysis to avoid legal issues

D. A write blocker is a feature in antivirus software that blocks harmful downloads from being written to disk.

13 / 25

Category: DIGITAL FORENSICS Questions

13. In Windows, which registry key is commonly examined to check USB device history?

A. HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesUSBSTOR

B. HKEY_USERSSoftwareMicrosoftCurrentVersionInternet Settings

C. HKEY_LOCAL_MACHINESoftwareClassesDirectory

D. HKEY_CURRENT_USERSoftwarePolicies

14 / 25

Category: DIGITAL FORENSICS Questions

14. Which of these is NOT a forensic principle?

A. Preserve original evidence

B. Document all actions

C. Modify files to make them readable

D. Ensure repeatability of methods

15 / 25

Category: DIGITAL FORENSICS Questions

15. How does a digital forensic investigator verify the integrity of digital evidence?

A. By opening the file

B. Using hash functions like MD5 or SHA-256

C. Copy-pasting it to a new drive

D. Compressing it with ZIP

16 / 25

Category: DIGITAL FORENSICS Questions

16. During a corporate investigation in Kampala, 300 employee emails are reviewed. What data privacy law must be considered?

A. GDPR

B. Uganda Data Protection and Privacy Act, 2019

C. HIPAA

D. Anti-Terrorism Act

17 / 25

Category: DIGITAL FORENSICS Questions

17. Which of the following lists one open-source and one commercial tool used in digital forensics?

A. FTK Imager (open-source) and Notepad++ (commercial)

B. Wireshark (commercial) and Excel (open-source

C. Autopsy (open-source) and EnCase (commercial)

D. EnCase (open-source) and Autopsy (commercial

18 / 25

Category: DIGITAL FORENSICS Questions

18. What is a forensic image and how does it differ from a normal backup?

A forensic image is a compressed version of selected files used for quick data recovery during system failure.

B. A forensic image is a backup stored in cloud servers to ensure accessibility from anywhere.

C. A forensic image is a screenshot of system activity logs used for visual presentation in court.

D. A forensic image is a complete bit-by-bit copy of a storage device, including deleted files and slack space. Unlike a backup, it captures every byte of data for legal and investigative purposes

19 / 25

Category: DIGITAL FORENSICS Questions

19. What risks are associated with analyzing live systems during investigations?

A. Live analysis prevents malware from executing and preserves all system logs

B. There’s a risk of volatile data being altered or lost, and the suspect system could be remotely accessed or malware may auto-delete evidence. Actions could also be legally questioned if not carefully documented.

C. The system may create a perfect forensic image automatically when accessed.

D. There is no need to document actions taken on a live system during analysis

20 / 25

Category: DIGITAL FORENSICS Questions

20. In fraud investigations, why is USB activity often critical to examine?

A. To check flash disk brand

B. Because USBs often carry data in or out unnoticed

C. For antivirus scanning

D. To check file icons

21 / 25

Category: DIGITAL FORENSICS Questions

21. Which of the following combinations lists three valid sources of digital evidence in a whistleblower case involving project budget manipulation?

A. Budget spreadsheets and financial reports, email communications between staff and the finance department, and audit trail logs from accounting software

B. Meeting room bookings, cafeteria purchase records, and company newsletters

C. Staff leave application forms, office seating plans, and IT equipment inventory

D. Social media posts, staff birthday calendars, and public holiday schedules

22 / 25

Category: DIGITAL FORENSICS Questions

22. Which of the following best describes a forensically sound process to retrieve evidence from a staff computer suspected of leaking board minutes?

A. Isolate the machine, review cloud sync logs live, and take notes; then create a forensic image without a write blocker

B. Secure and isolate the machine, use a write blocker to create a forensic image, analyze email attachments, USB logs, and cloud sync clients, and document all steps while maintaining chain of custody

C. Use a forensic tool to browse files directly on the system, export relevant documents, and record chain of events in a spreadsheet

D. Create a backup of the hard drive using standard cloning software, analyze browser history, and isolate cloud services

23 / 25

Category: DIGITAL FORENSICS Questions

23. Which of the following best describes how to verify the origin and authenticity of a suspicious Excel file in a procurement fraud investigation?

A. Check metadata for creator and save history, compare hash values to trusted versions, analyze embedded macros or links, and review file access logs

B. Open the file, review formatting and recent edits, and compare cell formulas with other spreadsheets

C. Use antivirus software to scan for threats, rename the file, and run it in compatibility mode to observe changes

D. Email the file to a colleague for review, check font types, and look for outdated styles in formatting

24 / 25

Category: DIGITAL FORENSICS Questions

24. Which of the following outlines appropriate exit steps HR and IT must take to preserve potential evidence when an employee leaves under suspicion?

A. Wipe the user’s devices, deactivate accounts, and archive personal folders for future use

B. Change the user's passwords, uninstall software from their workstation, and return personal emails to HR

C. Allow limited access for two days, then deactivate the account and recycle hardware for new employees

D. Deactivate system access and email, collect company devices and secure them, and backup or image the user’s workstation and email account

25 / 25

Category: DIGITAL FORENSICS Questions

25. Which of the following types of forensic evidence would best help verify a SACCO manager’s denial of accessing Dropbox?

A. Review system updates, printer spooler history, recent desktop activity, and any scheduled software tasks to check for unusual use

B. Check antivirus scan reports, task manager logs, screen resolution changes, and saved login credentials to identify potential misuse

C. Check browser history, cloud app logs, Dropbox access logs, system logs, IP addresses used, and whether the Dropbox client was installed or used

D. Analyze deleted media files, messaging history, document formatting changes, and local file paths for links suggesting Dropbox usage

Your score is

About Company

At the Institute of Forensics & ICT Security (IFIS), we specialize in bridging the gap between knowledge and application.

Most Recent Posts

All Posts
Blog
Career Management
Computer Security
Cyber Defence
Cyber Incidence Response
Cyber Preparedness
Cyber Security
Data Privacy
Endpoint Security
Fraud Investigation and Examination
Fraud Management
IT Security Audit
Marketing
Mobile Security
Training
UX/UI Design
Web Development

USBs and betrayal: The small devices behind big data leaks

About Us

we specialize in bridging the gap between knowledge and application.

Quick links

About Us

Our Courses

IFIS Blogs

Cyber Security Conference

Experiences & Testimonials

Resources

Free Downloads

Surveys

Quizzes

USBs and betrayal: The small devices behind big data leaks

June 18, 2025

Metadata matters: What your files reveal without saying a word

June 18, 2025

USBs and betrayal: The small devices behind big data leaks

Metadata matters: What your files reveal without saying a word