Computer Forensics Basics — MCQs
What is the forensic method of identification that utilizes lip prints?
In the court of law, the act of a witness giving false evidence after taking an oath is punishable under:
All of the following are true about H-files EXCEPT:
What type of evidence do medical certificates provide?
Virchow method of autopsy includes:-
Res ipsa loquitur is?
Custodial rape is punished under which section of the Indian Penal Code?
A physician is accused of death threats via anonymous email. Investigation reveals the email was sent through multiple proxy servers and TOR network from a public WiFi location. The suspect's home computer shows no direct evidence. Evaluate which combination of digital artifacts would MOST conclusively link the suspect to the anonymous communication?
A hospital's electronic medical records system was allegedly tampered with to alter a patient's medication history before a medico-legal case. The accused claims system errors caused the changes. Multiple users have access. How would you BEST establish intentional tampering versus system malfunction?
An autopsy surgeon receives a laptop allegedly containing child pornography. Initial examination shows no illegal images in accessible folders, but forensic tools detect suspicious encrypted container files. Anti-forensic timestamp manipulation is suspected. Which analytical approach would provide the MOST legally defensible evidence?
Computer Forensics Basics Indian Medical PG Practice Questions and MCQs
Question 1: What is the forensic method of identification that utilizes lip prints?
- A. Trichology
- B. Dactylography
- C. Poroscopy
- D. Cheiloscopy (Correct Answer)
Explanation: ***Cheiloscopy*** - **Cheiloscopy** is the scientific study of lip prints for human identification, based on the unique patterns of furrows on the human lips. - These patterns are considered individual and permanent, making them useful in forensic investigations. *Dactylography* - **Dactylography** is the study of fingerprints, which involves analyzing the unique patterns of ridges and furrows on the fingertips for identification. - It is one of the most widely used and reliable methods for personal identification in forensic science, but does not involve lip prints, *Poroscopy* - **Poroscopy** is a forensic technique that involves the examination of the pores on the ridges of fingerprints. - It is used to individualize fingerprints when there is insufficient ridge detail, but it focuses on pores, not lip prints. *Trichology* - **Trichology** is the scientific study of hair and scalp. - In forensics, it involves analyzing hair samples to determine characteristics such as origin, race, and presence of toxins, but not lip prints.
Question 2: In the court of law, the act of a witness giving false evidence after taking an oath is punishable under:
- A. 191 IPC
- B. 192 IPC
- C. 193 IPC (Correct Answer)
- D. 197 IPC
Explanation: ***193 IPC*** - **Section 193 of the Indian Penal Code (IPC)** specifically deals with the punishment for giving **false evidence** in a judicial proceeding. - This section outlines that any person who intentionally gives false evidence in any stage of a judicial proceeding, or fabricates false evidence for the purpose of being used in any stage of a judicial proceeding, shall be punished. *192 IPC* - **Section 192 IPC** defines what constitutes **"fabricating false evidence."** - While fabricating false evidence is a prerequisite for some offenses related to false evidence, Section 192 itself defines the act, but does not prescribe the punishment for giving false evidence after taking an oath in court. *191 IPC* - **Section 191 IPC** defines what constitutes **"giving false evidence."** - It explains that consciously making a statement which is false, and which a person either knows or believes to be false, or does not believe to be true, while legally bound by oath or by any express provision of law to state the truth, is considered giving false evidence, but does not prescribe the punishment. *197 IPC* - **Section 197 IPC** deals with **issuing or signing a false certificate**, not the act of a witness giving false evidence under oath in court. - This section punishes someone who issues or signs any certificate required by law, knowing or believing it to be false, in any material point.
Question 3: All of the following are true about H-files EXCEPT:
- A. They are fragile and tend to break easily.
- B. They have good cutting efficiency.
- C. They are used in torquing action. (Correct Answer)
- D. They have more positive rake angle.
Explanation: ***They are used in torquing action*** - **H-files** (Hedstrom files) are designed for a **pulling or rasping action** due to their cutting flutes, which are perpendicular to the long axis of the file. - They are **not designed for rotational (torquing) movements** and such use can lead to engagement of cutting flutes into the dentin walls and subsequent instrument separation during rotation. *They have good cutting efficiency* - **H-files** have excellent cutting efficiency on the **pull stroke** due to their unique flute design, which resembles a series of cones stacked upon each other. - This design allows them to effectively remove dentin when drawn coronally along the canal wall. *They are fragile and tend to break easily* - The design of H-files, with their deep cutting flutes and triangular or circular cross-section, makes them **more prone to fracture** compared to K-files, especially when torqued or used incorrectly. - The stress concentration at the base of the flutes increases their susceptibility to breakage, particularly in curved canals. *They have more positive rake angle* - **H-files** typically have a **positive rake angle**, which contributes to their high cutting efficiency. - This aggressive cutting angle ensures efficient dentin removal, especially on the withdrawal stroke.
Question 4: What type of evidence do medical certificates provide?
- A. Testimonial evidence
- B. Indirect evidence
- C. Conditional release documentation
- D. Documentary evidence of a patient's condition (Correct Answer)
Explanation: ***Documentary evidence of a patient's condition*** - Medical certificates are formal written documents prepared by a healthcare professional that provide **objective information** regarding a patient's medical status, diagnosis, treatment, and fitness for work or other activities. - Under the **Indian Evidence Act, 1872 (Section 3)**, medical certificates are classified as **documentary evidence** - they serve as verifiable written records offering **factual proof** of a patient's health situation at a specific time. - They are considered **direct evidence** that can be produced in court to establish medical facts. *Testimonial evidence* - This involves **oral statements** made under oath, typically in a court of law, by a witness who has direct knowledge of the facts. - While a doctor might provide testimonial evidence when called as a witness, the certificate itself is not a spoken testimony but a **written document**. *Indirect evidence* - Also known as **circumstantial evidence**, this refers to facts that, when proven, suggest the existence of another fact without directly proving it. - Medical certificates directly state the patient's condition, making them **direct documentary evidence**, not indirect or circumstantial evidence. *Conditional release documentation* - This type of document pertains to the **release of a patient from a hospital** or facility under certain conditions, such as follow-up appointments or medication adherence. - While a medical certificate might be part of a discharge process, its primary legal classification is as **documentary evidence**, not a specific type of release documentation.
Question 5: Virchow method of autopsy includes:-
- A. Organs are removed one by one (Correct Answer)
- B. In situ dissection combined with en bloc removal
- C. Organs are removed en bloc
- D. Organs are removed En masse
Explanation: ***Organs are removed one by one*** - The **Virchow method** of autopsy involves the systematic removal and examination of each organ individually. - This technique emphasizes the **in-depth inspection** of each organ for pathological changes, one at a time. *In situ dissection combined with en bloc removal* - This describes a combination of techniques, not solely the Virchow method. **In situ dissection** involves examining organs within the body cavity. - Removing organs **en bloc** refers to taking out groups of organs together which is characteristic of other methods like Ghon or Letulle. *Organs are removed En block* - The **en bloc method** (e.g., Ghon's method) involves removing entire organ systems or groups of organs together to preserve anatomical relationships. - This is distinct from the Virchow method, where individual organs are taken out separately. *Organs are removed En masse* - The **en masse method** (e.g., Letulle's method) involves removing all organs in a single block, maintaining all anatomical connections. - This is a more extensive removal technique compared to the Virchow method of individual organ removal.
Question 6: Res ipsa loquitur is?
- A. Oral evidence
- B. Fact speaks for itself (Correct Answer)
- C. Medical maloccurrence
- D. Common knowledge
Explanation: ***Fact speaks for itself*** - **Res ipsa loquitur** is a legal doctrine meaning "the thing speaks for itself," implying that the very nature of an accident or injury suggests negligence. - This doctrine is applied when an injury typically would not occur without **negligence**, and the defendant had exclusive control over the instrumentality causing the injury. *Oral evidence* - **Oral evidence** refers to testimony given verbally in court by a witness. - While evidence is presented in court, "res ipsa loquitur" is a principle of inference, not a specific type of evidence. *Medical maloccurrence* - A **medical maloccurrence** is an undesirable or unexpected outcome in medical treatment that may or may not be due to negligence. - It describes an event, whereas "res ipsa loquitur" is a legal principle used to infer negligence. *Common knowledge* - **Common knowledge** refers to facts or information that are generally known by the public. - While the application of "res ipsa loquitur" might sometimes rely on common sense, it is a specific legal doctrine, not just a general acknowledgment of common facts.
Question 7: Custodial rape is punished under which section of the Indian Penal Code?
- A. 354C IPC
- B. 376D IPC
- C. 376C IPC (Correct Answer)
- D. 377 IPC
Explanation: ***376C IPC*** - **Section 376C** of the Indian Penal Code specifically deals with **custodial rape**, which is sexual assault committed by a person in a position of authority or in custody of the victim. - This section was introduced to address instances where individuals, such as public servants, police officers, jail superintendents, or hospital staff, exploit their position to commit sexual offenses. - The term "custody" includes situations where the victim is in the care, control, or under the authority of the perpetrator. *377 IPC* - **Section 377 IPC** deals with **unnatural offenses**, which refers to carnal intercourse against the order of nature with any man, woman, or animal. - This section addresses specific types of sexual acts, not the context of authority or custody. *354C IPC* - **Section 354C IPC** pertains to **voyeurism**, which involves observing or capturing the image of a woman engaging in a private act where she would expect not to be observed. - This section focuses on the act of violating privacy through observation, distinct from sexual assault in custody. *376D IPC* - **Section 376D IPC** covers **gang rape**, which involves sexual assault committed by one or more persons in a group acting in furtherance of their common intention. - While it deals with sexual assault, its focus is on the number of perpetrators rather than the specific context of institutional authority or custody.
Question 8: A physician is accused of death threats via anonymous email. Investigation reveals the email was sent through multiple proxy servers and TOR network from a public WiFi location. The suspect's home computer shows no direct evidence. Evaluate which combination of digital artifacts would MOST conclusively link the suspect to the anonymous communication?
- A. TOR browser installation artifacts, typing pattern analysis (keystroke dynamics), linguistic stylometry of email content, correlation with suspect's known writings, WiFi connection logs on suspect's devices matching crime timeframe, and browser artifacts showing proxy/anonymizer research preceding the incident (Correct Answer)
- B. IP address logs from public WiFi and timestamp correlation alone
- C. Eyewitness testimony of suspect's presence at WiFi location
- D. Confession obtained during interrogation
Explanation: ***TOR browser installation artifacts, typing pattern analysis (keystroke dynamics), linguistic stylometry of email content, correlation with suspect's known writings, WiFi connection logs on suspect's devices matching crime timeframe, and browser artifacts showing proxy/anonymizer research preceding the incident*** - This multimodal approach establishes a link by combining **behavioral biometrics** (keystroke dynamics and stylometry) with **forensic artifacts** (TOR installation and research) to overcome the technological anonymity provided by several proxy layers. - Evidence of **premeditation** (researching anonymizers) and **temporal-spatial correlation** (WiFi logs matching the crime scene) provides the high level of certainty required for legal attribution in digital forensics. *IP address logs from public WiFi and timestamp correlation alone* - While this places a device at the location, it fails to account for **TOR network masking**, which hides the original source IP from external logs. - **IP addresses** alone are insufficient for definitive attribution, as they do not identify the specific user behind the terminal or account for MAC address spoofing. *Eyewitness testimony of suspect's presence at WiFi location* - Presence at a public location is **circumstantial** and does not prove that the suspect was the individual interacting with the specific digital service at that time. - Testimony is subject to **human error and bias**, lacking the objective scientific rigor found in **digital footprint analysis** and linguistic fingerprints. *Confession obtained during interrogation* - Confessions may be **retracted or ruled inadmissible** if any procedural errors or coercion are alleged during the interrogation process. - Without **corroborating digital evidence**, a confession alone lacks the technical proof necessary to explain how the suspect bypassed complex security and **anonymization protocols**.
Question 9: A hospital's electronic medical records system was allegedly tampered with to alter a patient's medication history before a medico-legal case. The accused claims system errors caused the changes. Multiple users have access. How would you BEST establish intentional tampering versus system malfunction?
- A. Rely on testimony of IT administrator alone
- B. Compare only the final version with the original record
- C. Check only the current database entries for inconsistencies
- D. Correlate database transaction logs with user authentication logs, audit trails, system logs, and backup differentials to establish specific user actions, timing patterns inconsistent with normal workflow, and evidence of privilege escalation or unauthorized access (Correct Answer)
Explanation: ***Correlate database transaction logs with user authentication logs, audit trails, system logs, and backup differentials to establish specific user actions, timing patterns inconsistent with normal workflow, and evidence of privilege escalation or unauthorized access*** - Intentional tampering is best proven by correlating **multi-source forensic data**, which identifies specific **user-linked actions** that deviate from automated system processes. - Unlike system glitches, which appear as random or non-specific patterns, deliberate modification is evidenced by **targeted SQL queries**, **privilege escalation**, or changes occurring during unauthorized login sessions. *Rely on testimony of IT administrator alone* - Forensic evidence must be **objective and verifiable**; subjective testimony is insufficient for high-level medico-legal cases without technical proof. - An administrator may have **conflicts of interest** or lack the specific technical data needed to distinguish between a hardware fault and a malicious act. *Compare only the final version with the original record* - Comparing versions reveals *that* a change occurred, but it fails to show **how, when, or by whom** the modification was made. - This method cannot differentiate between a **legitimate clinical update**, an automated system synchronization error, or manual tampering. *Check only the current database entries for inconsistencies* - Looking at current entries provides only a **static view** of the data and does not capture the **chronological sequence** of events required for forensic reconstruction. - Inconsistencies could be blamed on **bug-ridden software** or data corruption unless a full **audit trail** links those inconsistencies to specific user accounts.
Question 10: An autopsy surgeon receives a laptop allegedly containing child pornography. Initial examination shows no illegal images in accessible folders, but forensic tools detect suspicious encrypted container files. Anti-forensic timestamp manipulation is suspected. Which analytical approach would provide the MOST legally defensible evidence?
- A. Interview suspect first before digital analysis
- B. Screenshot visible content and prepare report
- C. Decrypt containers and rely solely on file content analysis
- D. Hash comparison against known illegal image databases, analysis of file system journals, examination of thumbnail cache and temporary internet files, coupled with entropy analysis of encrypted containers (Correct Answer)
Explanation: ***Hash comparison against known illegal image databases, analysis of file system journals, examination of thumbnail cache and temporary internet files, coupled with entropy analysis of encrypted containers*** - This approach is most defensible because **hash values** provide unique digital signatures that match against known databases (like **NCMEC**) without needing to view every image. - **File system journals** and **thumbnail caches** provide objective proof of possession and usage history that bypasses manual **timestamp manipulation**. *Interview suspect first before digital analysis* - Interviewing before securing a **forensic image** of the data risks the suspect remotely wiping or destroying evidence via **kill switches**. - Digital evidence must be preserved and analyzed objectively before testimony to maintain a solid **chain of custody**. *Screenshot visible content and prepare report* - Screenshots do not capture **metadata** or hidden data, and they are easily challenged in court as they do not prove the **integrity** of the original file. - This method ignores the **encrypted containers**, failing to address the primary locations where illegal material is likely hidden. *Decrypt containers and rely solely on file content analysis* - Relying only on content analysis might fail if encryption keys cannot be recovered or if the suspect claims the files were **planted**. - This narrow approach lacks the corroborating evidence provided by **entropy analysis** and **internet temporary files** which show the intent and history of the user's actions.
Want unlimited practice?
Get full access to all questions, explanations, and performance tracking.
Start For Free