Digital Forensics — MCQs
On this page
A physician is accused of death threats via anonymous email. Investigation reveals the email was sent through multiple proxy servers and TOR network from a public WiFi location. The suspect's home computer shows no direct evidence. Evaluate which combination of digital artifacts would MOST conclusively link the suspect to the anonymous communication?
A hospital's electronic medical records system was allegedly tampered with to alter a patient's medication history before a medico-legal case. The accused claims system errors caused the changes. Multiple users have access. How would you BEST establish intentional tampering versus system malfunction?
An autopsy surgeon receives a laptop allegedly containing child pornography. Initial examination shows no illegal images in accessible folders, but forensic tools detect suspicious encrypted container files. Anti-forensic timestamp manipulation is suspected. Which analytical approach would provide the MOST legally defensible evidence?
A medical professional is accused of leaking confidential patient data via USB drive. Forensic examination reveals no files on the USB, but Registry analysis shows recent USB activity. File carving recovers deleted patient records. Which combination of artifacts would BEST establish the accused's intent and timeline?
During investigation of a cyberstalking case, a victim's smartphone was found formatted. Which technique would be MOST effective for recovering deleted WhatsApp conversations?
A 35-year-old male is accused of circulating morphed obscene images of a female colleague via email. The suspect's laptop was seized 10 days after the alleged incident. Which forensic approach would be MOST appropriate to establish the timeline of image creation?
How does steganography differ from encryption in the context of digital evidence concealment?
What is the principle behind slack space analysis in digital forensics?
Which hash algorithm is most commonly used for ensuring integrity of digital evidence in forensic investigations?
What is the primary purpose of write-blocking devices in digital forensics?
Digital Forensics Indian Medical PG Practice Questions and MCQs
Question 1: A physician is accused of death threats via anonymous email. Investigation reveals the email was sent through multiple proxy servers and TOR network from a public WiFi location. The suspect's home computer shows no direct evidence. Evaluate which combination of digital artifacts would MOST conclusively link the suspect to the anonymous communication?
- A. TOR browser installation artifacts, typing pattern analysis (keystroke dynamics), linguistic stylometry of email content, correlation with suspect's known writings, WiFi connection logs on suspect's devices matching crime timeframe, and browser artifacts showing proxy/anonymizer research preceding the incident (Correct Answer)
- B. IP address logs from public WiFi and timestamp correlation alone
- C. Eyewitness testimony of suspect's presence at WiFi location
- D. Confession obtained during interrogation
Explanation: ***TOR browser installation artifacts, typing pattern analysis (keystroke dynamics), linguistic stylometry of email content, correlation with suspect's known writings, WiFi connection logs on suspect's devices matching crime timeframe, and browser artifacts showing proxy/anonymizer research preceding the incident*** - This multimodal approach establishes a link by combining **behavioral biometrics** (keystroke dynamics and stylometry) with **forensic artifacts** (TOR installation and research) to overcome the technological anonymity provided by several proxy layers. - Evidence of **premeditation** (researching anonymizers) and **temporal-spatial correlation** (WiFi logs matching the crime scene) provides the high level of certainty required for legal attribution in digital forensics. *IP address logs from public WiFi and timestamp correlation alone* - While this places a device at the location, it fails to account for **TOR network masking**, which hides the original source IP from external logs. - **IP addresses** alone are insufficient for definitive attribution, as they do not identify the specific user behind the terminal or account for MAC address spoofing. *Eyewitness testimony of suspect's presence at WiFi location* - Presence at a public location is **circumstantial** and does not prove that the suspect was the individual interacting with the specific digital service at that time. - Testimony is subject to **human error and bias**, lacking the objective scientific rigor found in **digital footprint analysis** and linguistic fingerprints. *Confession obtained during interrogation* - Confessions may be **retracted or ruled inadmissible** if any procedural errors or coercion are alleged during the interrogation process. - Without **corroborating digital evidence**, a confession alone lacks the technical proof necessary to explain how the suspect bypassed complex security and **anonymization protocols**.
Question 2: A hospital's electronic medical records system was allegedly tampered with to alter a patient's medication history before a medico-legal case. The accused claims system errors caused the changes. Multiple users have access. How would you BEST establish intentional tampering versus system malfunction?
- A. Rely on testimony of IT administrator alone
- B. Compare only the final version with the original record
- C. Check only the current database entries for inconsistencies
- D. Correlate database transaction logs with user authentication logs, audit trails, system logs, and backup differentials to establish specific user actions, timing patterns inconsistent with normal workflow, and evidence of privilege escalation or unauthorized access (Correct Answer)
Explanation: ***Correlate database transaction logs with user authentication logs, audit trails, system logs, and backup differentials to establish specific user actions, timing patterns inconsistent with normal workflow, and evidence of privilege escalation or unauthorized access*** - Intentional tampering is best proven by correlating **multi-source forensic data**, which identifies specific **user-linked actions** that deviate from automated system processes. - Unlike system glitches, which appear as random or non-specific patterns, deliberate modification is evidenced by **targeted SQL queries**, **privilege escalation**, or changes occurring during unauthorized login sessions. *Rely on testimony of IT administrator alone* - Forensic evidence must be **objective and verifiable**; subjective testimony is insufficient for high-level medico-legal cases without technical proof. - An administrator may have **conflicts of interest** or lack the specific technical data needed to distinguish between a hardware fault and a malicious act. *Compare only the final version with the original record* - Comparing versions reveals *that* a change occurred, but it fails to show **how, when, or by whom** the modification was made. - This method cannot differentiate between a **legitimate clinical update**, an automated system synchronization error, or manual tampering. *Check only the current database entries for inconsistencies* - Looking at current entries provides only a **static view** of the data and does not capture the **chronological sequence** of events required for forensic reconstruction. - Inconsistencies could be blamed on **bug-ridden software** or data corruption unless a full **audit trail** links those inconsistencies to specific user accounts.
Question 3: An autopsy surgeon receives a laptop allegedly containing child pornography. Initial examination shows no illegal images in accessible folders, but forensic tools detect suspicious encrypted container files. Anti-forensic timestamp manipulation is suspected. Which analytical approach would provide the MOST legally defensible evidence?
- A. Interview suspect first before digital analysis
- B. Screenshot visible content and prepare report
- C. Decrypt containers and rely solely on file content analysis
- D. Hash comparison against known illegal image databases, analysis of file system journals, examination of thumbnail cache and temporary internet files, coupled with entropy analysis of encrypted containers (Correct Answer)
Explanation: ***Hash comparison against known illegal image databases, analysis of file system journals, examination of thumbnail cache and temporary internet files, coupled with entropy analysis of encrypted containers*** - This approach is most defensible because **hash values** provide unique digital signatures that match against known databases (like **NCMEC**) without needing to view every image. - **File system journals** and **thumbnail caches** provide objective proof of possession and usage history that bypasses manual **timestamp manipulation**. *Interview suspect first before digital analysis* - Interviewing before securing a **forensic image** of the data risks the suspect remotely wiping or destroying evidence via **kill switches**. - Digital evidence must be preserved and analyzed objectively before testimony to maintain a solid **chain of custody**. *Screenshot visible content and prepare report* - Screenshots do not capture **metadata** or hidden data, and they are easily challenged in court as they do not prove the **integrity** of the original file. - This method ignores the **encrypted containers**, failing to address the primary locations where illegal material is likely hidden. *Decrypt containers and rely solely on file content analysis* - Relying only on content analysis might fail if encryption keys cannot be recovered or if the suspect claims the files were **planted**. - This narrow approach lacks the corroborating evidence provided by **entropy analysis** and **internet temporary files** which show the intent and history of the user's actions.
Question 4: A medical professional is accused of leaking confidential patient data via USB drive. Forensic examination reveals no files on the USB, but Registry analysis shows recent USB activity. File carving recovers deleted patient records. Which combination of artifacts would BEST establish the accused's intent and timeline?
- A. Link files (LNK), Prefetch files, USB connection timestamps, and recovered file metadata showing access patterns (Correct Answer)
- B. USB serial number from Registry and file creation dates only
- C. Link files (LNK), Prefetch files, USB connection timestamps, and recovered file metadata showing access patterns (Correct Answer)
- D. Recycle Bin contents and recent documents list only
- E. Browser history and email logs only
Explanation: ***Link files (LNK), Prefetch files, USB connection timestamps, and recovered file metadata showing access patterns*** - **LNK files** and **Prefetch files** provide evidence of specific file execution and volume serial numbers, linking the patient data directly to the external drive. - **USB connection timestamps** and **metadata** establish a chronological timeline of when the device was connected and when files were accessed or deleted, proving **deliberate intent**. *USB serial number from Registry and file creation dates only* - While the **USB serial number** proves the device was connected, it does not provide information about which specific files were handled. - **File creation dates** alone cannot distinguish between a legitimate automated system process and a manual, intentional data export by a user. *Recycle Bin contents and recent documents list only* - Files deleted from a **USB drive** typically do not go to the system **Recycle Bin**, making this artifact unreliable for external data leak investigations. - **Recent documents** lists show file names but lack the **forensic depth** required to prove that the data was actually transferred to an external medium. *Browser history and email logs only* - These artifacts focus on **network-based exfiltration** and do not provide evidence regarding local physical transfers via **USB interface**. - They fail to capture the **file carving** results or the specific interaction between the host OS and the hardware device in question.
Question 5: During investigation of a cyberstalking case, a victim's smartphone was found formatted. Which technique would be MOST effective for recovering deleted WhatsApp conversations?
- A. Analysis of SIM card data only
- B. Physical extraction followed by carving of SQLite database fragments from unallocated space (Correct Answer)
- C. Logical extraction of current application data
- D. Cloud backup analysis without device examination
Explanation: ***Physical extraction followed by carving of SQLite database fragments from unallocated space*** - **Physical extraction** creates a bit-by-bit image of the entire storage, including the **unallocated space** where deleted data remains after a format. - Since WhatsApp uses **SQLite databases** for storage, forensic **file carving** can recover deleted message fragments and headers that are no longer accessible via the file system. *Analysis of SIM card data only* - **SIM cards** have extremely limited storage capacity and primarily store **ICCID, IMSI**, and some contacts or SMS. - WhatsApp data is stored on the **internal flash memory** of the smartphone, not the SIM card, making this method ineffective. *Logical extraction of current application data* - **Logical extraction** only interacts with the operating system to retrieve files that are currently **visible and active**. - Because the device was **formatted**, a logical extraction would fail to find deleted data residing in the underlying storage layers. *Cloud backup analysis without device examination* - While **cloud backups** (like Google Drive or iCloud) may contain historical data, they may not reflect the **most recent conversations** deleted before the last sync. - Relying solely on the cloud ignores **local forensic artifacts** on the device that could provide critical metadata or evidence of the stalking activity.
Question 6: A 35-year-old male is accused of circulating morphed obscene images of a female colleague via email. The suspect's laptop was seized 10 days after the alleged incident. Which forensic approach would be MOST appropriate to establish the timeline of image creation?
- A. Analysis of RAM dump alone
- B. EXIF metadata analysis combined with file system timestamp examination (Correct Answer)
- C. Recovery of deleted SMS from mobile phone
- D. Analysis of browser cache only
Explanation: ***EXIF metadata analysis combined with file system timestamp examination*** - **EXIF data** contains embedded metadata such as the **creation date**, **software used** (for morphing), and **GPS coordinates**, providing direct evidence of image origin. - **File system timestamps** (MAC: Modified, Accessed, Created) offer a correlative timeline to track when the file was processed or moved on the **laptop's hard drive**. *Analysis of RAM dump alone* - **RAM** is **volatile memory**; data is typically lost once the computer is powered off or after a significant period like **10 days**. - While a RAM dump can show active processes, it is insufficient for establishing a long-term **historical timeline** of file creation compared to non-volatile storage. *Recovery of deleted SMS from mobile phone* - The primary evidence is located on a **seized laptop**, making mobile phone SMS recovery less relevant to the **creation timeline** of the images. - SMS messages might show communication intent but do not provide the technical **metadata** required to prove the image was morphed on a specific device. *Analysis of browser cache only* - **Browser cache** would only show if the image was viewed or downloaded via a web browser, failing to account for local **morphed image creation**. - This method is too narrow as it misses **offline image editing** activities and critical **EXIF headers** found in the original files.
Question 7: How does steganography differ from encryption in the context of digital evidence concealment?
- A. Steganography makes data unreadable while encryption hides its existence
- B. Steganography is only used for text while encryption is for images
- C. Steganography hides the existence of data while encryption makes it unreadable (Correct Answer)
- D. Both serve identical purposes in data protection
Explanation: ***Steganography hides the existence of data while encryption makes it unreadable*** - **Steganography** involves embedding secret messages within a **carrier file** (like a JPEG or MP3) so that the presence of the hidden data is not suspected. - **Encryption**, by contrast, uses **cryptography** to scramble data into **ciphertext**, which remains visible but is impossible to read without a decryption key. *Steganography makes data unreadable while encryption hides its existence* - This is a direct reversal of terms; **encryption** makes data unreadable, whereas **steganography** focuses on **clandestine communication**. - An investigator can see encrypted files, but they may not even realize a file contains steganographic data until **steganalysis** is performed. *Steganography is only used for text while encryption is for images* - Both techniques are highly versatile; **steganography** commonly uses **images, audio, or video** as cover objects to hide any type of digital file. - **Encryption** is a mathematical transformation that can be applied to any **binary data**, regardless of whether it is a text document or a high-resolution image. *Both serve identical purposes in data protection* - While both aim to protect **confidentiality**, they differ in their fundamental approach regarding the **obfuscation of evidence**. - In **digital forensics**, discovering encrypted data indicates where the secrets are, but steganography is designed to prevent the investigator from finding the data in the first place.
Question 8: What is the principle behind slack space analysis in digital forensics?
- A. Examination of unused portion of allocated disk clusters that may contain remnants of previous data (Correct Answer)
- B. Analysis of unused RAM sectors
- C. Recovery of encrypted passwords
- D. Study of deleted partition tables
Explanation: ***Examination of unused portion of allocated disk clusters that may contain remnants of previous data*** - **Slack space** occurs because files rarely fill an entire **disk cluster**; the gap between the end of the file and the end of the cluster is often left with **legacy data** from prior files. - Forensic analysts examine this area to recover **fragmented data** or **hidden information** that is not indexed by the file system but remains physically on the disk. *Analysis of unused RAM sectors* - This refers to **volatile memory forensics**, which involves capturing data from **RAM** before the system is powered down. - Slack space specifically refers to **persistent storage** (non-volatile) like hard drives rather than the dynamic sectors of physical **RAM**. *Recovery of encrypted passwords* - While slack space might contain **password fragments**, its primary principle is the analysis of **storage allocation** rather than cryptography. - Password recovery often utilizes **brute-force attacks**, **dictionary attacks**, or **rainbow tables**, which are distinct from file system geometry analysis. *Study of deleted partition tables* - The study of **deleted partition tables** focuses on the **Master Boot Record (MBR)** or **GUID Partition Table (GPT)** to restore the disk's logical structure. - Slack space analysis focuses on data hidden within **existing file allocations**, not the overall **partition layout** of the physical drive.
Question 9: Which hash algorithm is most commonly used for ensuring integrity of digital evidence in forensic investigations?
- A. SHA-256 (Correct Answer)
- B. SHA-1 only
- C. MD5 only
- D. CRC-32
Explanation: ***SHA-256*** - **SHA-256** is currently the gold standard in forensic investigations because it provides high **collision resistance**, ensuring that two different files do not produce the same hash value. - It is a 256-bit cryptographic hash that maintains the **integrity of digital evidence**, making it legally robust and widely accepted in courtrooms. *SHA-1 only* - **SHA-1** is considered outdated and insecure for forensic work due to discovered **vulnerabilities** that allow for potential hash collisions. - While still occasionally seen, it is no longer recommended as a primary standalone method for verifying the **authenticity** of critical digital evidence. *MD5 only* - **MD5** is a 128-bit hash that is highly susceptible to **collision attacks**, meaning it cannot reliably prove that a file has not been tampered with. - Modern forensic standards discourage the use of **MD5 only**, as it does not meet the necessary **cryptographic security** requirements for high-stakes investigations. *CRC-32* - **CRC-32** (Cyclic Redundancy Check) is primarily used to detect **accidental errors** in data transmission rather than intended tampering or forensic verification. - It is not a **cryptographic hash algorithm** and is too weak to provide any meaningful security or **integrity assurance** in a legal context.
Question 10: What is the primary purpose of write-blocking devices in digital forensics?
- A. To compress files for storage
- B. To prevent modification of original evidence during examination (Correct Answer)
- C. To accelerate data transfer speeds
- D. To encrypt data during examination
Explanation: ***To prevent modification of original evidence during examination*** - **Write-blocking devices** serve as a critical bridge that permits **read-only access** to digital media while physically or logically intercepting any **write commands**. - This process ensures the **integrity** of the digital evidence, preserving the **chain of custody** and ensuring the data remains admissible in a court of law. *To compress files for storage* - Compression focuses on reducing the **storage footprint** of data and is not related to the protection of original media against alterations. - **Write-blockers** do not modify the file size or structure; their sole focus is preventing **data writes**. *To accelerate data transfer speeds* - **Hardware write-blockers** can sometimes slow down communication due to the overhead of inspecting commands for **write operations**. - The primary goal of forensic tools is **forensic soundness** and accuracy, rather than maximizing **data throughput** efficiency. *To encrypt data during examination* - Encryption is used to protect the **confidentiality** of data, whereas write-blocking is used to prevent the **alteration** of data. - While forensic images may be encrypted later for security, the **write-blocker** itself does not perform **cryptographic operations**.
Question 11: What is brain fingerprinting?
- A. Used as a lie detector.
- B. Used by EEG on lead. (Correct Answer)
- C. Used for quantitative measurement of sulci and gyri.
- D. Used by DNA.
Explanation: **Explanation:** **Brain Fingerprinting** (also known as Brain Electrical Activation Profile or BEAP) is a forensic technique used to determine if specific information is stored in a subject's brain. 1. **Why Option B is Correct:** The technique relies on **Electroencephalography (EEG)**. When a person recognizes a familiar stimulus (like a crime scene photo), the brain emits a specific electrical response known as the **P300 wave** (an event-related potential). This is recorded using EEG sensors (leads) placed on the scalp. It detects "guilty knowledge" rather than the physiological stress of lying. 2. **Why Other Options are Incorrect:** * **Option A:** While often confused with a lie detector (Polygraph), brain fingerprinting does not detect lies or stress; it detects the **presence or absence of information** (recognition). * **Option C:** Quantitative measurement of sulci and gyri refers to neuroanatomical morphometry (often via MRI), which is used in neurology/radiology, not forensic brain fingerprinting. * **Option D:** DNA profiling is a biological identification tool. Brain fingerprinting is a neuro-electrophysiological tool. **High-Yield Pearls for NEET-PG:** * **Inventor:** Developed by **Dr. Lawrence Farwell**. * **The P300 Wave:** The hallmark of this test; it occurs 300 milliseconds after a significant stimulus is presented. * **Admissibility:** In India, the Supreme Court (Selvi vs. State of Karnataka, 2010) ruled that Narco-analysis, Polygraph, and Brain Mapping cannot be forcibly administered as it violates **Article 20(3)** of the Constitution (Right against self-incrimination). * **Stimuli Categories:** The test uses "Probes" (details only the culprit knows), "Targets" (details known to everyone), and "Irrelevant" stimuli.
Practice by Chapter
Computer Forensics Basics
Practice Questions
Mobile Device Forensics
Practice Questions
Internet and Network Forensics
Practice Questions
Social Media Evidence
Practice Questions
Digital Imaging Analysis
Practice Questions
Audio and Video Analysis
Practice Questions
Cybercrime Investigation
Practice Questions
Electronic Health Records Investigation
Practice Questions
Telemedicine Legal Issues
Practice Questions
Digital Evidence in Court
Practice Questions
Encryption and Data Recovery
Practice Questions
Digital Forensic Tools
Practice Questions
Want unlimited practice?
Get full access to all questions, explanations, and performance tracking.
Start For Free