Digital Forensics Questions and Answers

Q: When performing file carving during digital forensic analysis, recovering a JPEG file from unallocated disk space primarily relies on which of the following ?

File carving relies on header-footer signatures.Carving recovers files from raw disk data without any file-system record. The tool scans unallocated space for the byte pattern that begins a file type and the pattern that ends it, and extracts everything between. A JPEG begins with FF D8 FF and ends with FF D9, so those signatures mark where each image starts and stops.Registry keys record Windows configuration and user activity, not file contents. An MFT timestamp belongs to a file-system record, which is exactly what carving does without. TRIM commands work against recovery: they let an SSD wipe freed blocks.

Q: Which NTFS artifact can prove that a file existed even if both its MFT entry and filename have been completely overwritten ?

The artifact is $UsnJrnl, the NTFS change journal.The update sequence number journal (the $UsnJrnl file in the $Extend directory) logs every change to every file: creation, renaming, writes and deletion. Each record holds the file name, the MFT reference number, a timestamp and a reason code. Because these records live in a separate file, they survive after the file's own MFT entry has been reused and its name overwritten, so they can prove the file existed.$Secure holds the volume's security descriptors, $Volume the volume name and version, and $AttrDef the definitions of attribute types. None of them records the history of individual files.

Q: In RAM forensics, which memory region is most likely to contain remnants of decrypted full-disk encryption keys ?

Decrypted full-disk encryption keys are most likely in the non-paged pool.Full-disk encryption on Windows, such as BitLocker, is done by a kernel-mode driver that decrypts every sector as it is read. The driver keeps its key material in kernel memory allocated from the non-paged pool, which is never written out to the page file and is always resident in RAM. Memory forensics tools therefore recover such keys by scanning kernel pool allocations in a RAM image.The smss.exe stack belongs to the Session Manager, a user-mode process that starts sessions and has no part in disk encryption. User-mode process heaps hold application data, not the keys of a kernel driver. Since one of the listed regions does fit, 'None of the above' is wrong.

Q: Which evidence acquisition method ensures bit-level replication including slack space and unallocated clusters ?

The method is physical acquisition.A physical acquisition makes a bit-stream image of the whole storage device, sector by sector, regardless of what the file system says is in use. It therefore captures file slack, unallocated clusters, deleted files and hidden areas, which is what an examiner needs for carving and recovering deleted evidence.A logical acquisition copies only the files and folders the file system presents, so slack and unallocated space are lost. A sparse acquisition collects selected files plus some fragments of unallocated data, and a targeted acquisition collects only chosen items. Neither is a complete bit-level copy.

Q: Which of the following indicates a PNG file signature ?

The PNG signature is 89 50 4E 47.Every PNG file begins with the eight bytes 89 50 4E 47 0D 0A 1A 0A. After the non-ASCII byte 89, the next three bytes are the ASCII letters P N G. Forensic tools use such signatures (magic numbers) to identify files whatever their extension.FF D8 FF E0 is the start of a JPEG file in JFIF format. 50 4B 03 04 spells 'PK' and marks a ZIP archive, which also covers DOCX, XLSX, JAR and APK files. So 'None of these' is wrong.

Q: SD forensics is generally more challenging than HDD forensics primarily due to which of the following factors ?

The main factor is TRIM operations and wear-leveling.The question's 'SD' is flash storage (solid-state drives, and in the same way SD cards), which behaves very differently from a magnetic hard disk. On an HDD, a deleted file stays in place until overwritten, so it can be recovered. On flash, the TRIM command tells the drive which blocks are no longer in use, and the drive's own garbage collection erases them, often within moments and even while the device is write-blocked. Wear-leveling constantly remaps logical blocks to different physical cells, so data moves and old copies sit in areas the examiner cannot address.Storage size is not inherently larger on flash, flash drives use MBR or GPT partition tables like hard disks, and encryption is optional, not always present.

Q: Which forensic acquisition is preferred when the system is suspected to contain full-disk encryption ?

The preferred method is live acquisition.With full-disk encryption, the data on the disk is readable only while the system is running with the volume unlocked. If the machine is switched off and imaged in the usual way, the examiner gets only ciphertext and needs the password or recovery key. A live acquisition captures the decrypted data while it is accessible, together with the RAM contents, which may hold the encryption keys themselves.Offline imaging (dead-box acquisition) is exactly the approach that loses access to encrypted data. Sparse and logical acquisitions only reduce what is collected; they do not address encryption, and they still have to be done while the system is live to be readable.

Q: Which of the following storage media typically exhibits the highest volatility in digital evidence ?

The most volatile is the CPU cache.Evidence is collected in order of volatility, most short-lived first. RFC 3227, the standard guideline, puts CPU registers and cache at the top: their contents change in nanoseconds as the processor runs. Next come routing and ARP tables, the process table and main memory (RAM), then temporary file systems, disks, remote logs and archival media.RAM is volatile too, but its contents last as long as the power and survive for seconds or more, so it comes after cache. An SSD is persistent storage, and network logs are stored records, both near the bottom of the order.

Q: In the detection of image-based steganography, the "RS steganalysis" technique is primarily used to identify which of the following ?

RS steganalysis identifies pixel relationship irregularities.RS (Regular-Singular) steganalysis, introduced by Fridrich, Goljan and Du, detects LSB embedding in images. It divides the image into small groups of pixels, applies flipping functions to their least significant bits, and counts how many groups become more regular or more singular (smoother or noisier). In a natural image these counts follow a predictable relationship; LSB embedding disturbs it, and the size of the disturbance even estimates the length of the hidden message.It analyses pixel values, so it does not look for hidden audio, and EXIF metadata is a separate forensic check. Since one option is correct, 'None of these' is wrong.

Q: A widely used method of embedding hidden data inside images by manipulating the Least Significant Bits (LSB) of pixel values belongs to which category of steganography ?

LSB embedding is substitution-based steganography.In LSB steganography, the least significant bit of each pixel value is replaced with a bit of the secret message. Changing only the lowest bit alters each colour value by at most 1, which the eye cannot see. Because the technique works by substituting bits of the cover image directly in the spatial domain, it is classed as substitution (spatial-domain) steganography.Transform-domain methods hide data in DCT or wavelet coefficients, as in JPEG steganography. Spread spectrum methods spread the message across the image like low-level noise. Distortion-based methods encode data as a deliberate change from the original cover, which the receiver needs in order to decode.

When performing file carving during digital forensic analysis, recovering a JPEG file from unallocated disk space primarily relies on which of the following ?

A.Registry keys
B.MFT timestamp
C.TRIM commands
D.Header-footer signatures

Exam Year(s)

Tripura Public Service Commission - 2026,

Answer: D

File carving relies on header-footer signatures.

Carving recovers files from raw disk data without any file-system record. The tool scans unallocated space for the byte pattern that begins a file type and the pattern that ends it, and extracts everything between. A JPEG begins with FF D8 FF and ends with FF D9, so those signatures mark where each image starts and stops.

Registry keys record Windows configuration and user activity, not file contents. An MFT timestamp belongs to a file-system record, which is exactly what carving does without. TRIM commands work against recovery: they let an SSD wipe freed blocks.

Discuss in Forum

Which NTFS artifact can prove that a file existed even if both its MFT entry and filename have been completely overwritten ?

A.$Secure
B.$Volume
C.$AttrDef
D.$UsnJrnl

Exam Year(s)

Tripura Public Service Commission - 2026,

Answer: D

The artifact is $UsnJrnl, the NTFS change journal.

The update sequence number journal (the $UsnJrnl file in the $Extend directory) logs every change to every file: creation, renaming, writes and deletion. Each record holds the file name, the MFT reference number, a timestamp and a reason code. Because these records live in a separate file, they survive after the file's own MFT entry has been reused and its name overwritten, so they can prove the file existed.

$Secure holds the volume's security descriptors, $Volume the volume name and version, and $AttrDef the definitions of attribute types. None of them records the history of individual files.

Discuss in Forum

In RAM forensics, which memory region is most likely to contain remnants of decrypted full-disk encryption keys ?

A.Session Manager Subsystem (smss.exe) stack
B.User-mode process heaps
C.Non-paged pool
D.None of the above

Exam Year(s)

Tripura Public Service Commission - 2026,

Answer: C

Decrypted full-disk encryption keys are most likely in the non-paged pool.

Full-disk encryption on Windows, such as BitLocker, is done by a kernel-mode driver that decrypts every sector as it is read. The driver keeps its key material in kernel memory allocated from the non-paged pool, which is never written out to the page file and is always resident in RAM. Memory forensics tools therefore recover such keys by scanning kernel pool allocations in a RAM image.

The smss.exe stack belongs to the Session Manager, a user-mode process that starts sessions and has no part in disk encryption. User-mode process heaps hold application data, not the keys of a kernel driver. Since one of the listed regions does fit, 'None of the above' is wrong.

Discuss in Forum

Which evidence acquisition method ensures bit-level replication including slack space and unallocated clusters ?

A.Logical acquisition
B.Physical acquisition
C.Sparse acquisition
D.Targeted acquisition

Exam Year(s)

Tripura Public Service Commission - 2026,

Answer: B

The method is physical acquisition.

A physical acquisition makes a bit-stream image of the whole storage device, sector by sector, regardless of what the file system says is in use. It therefore captures file slack, unallocated clusters, deleted files and hidden areas, which is what an examiner needs for carving and recovering deleted evidence.

A logical acquisition copies only the files and folders the file system presents, so slack and unallocated space are lost. A sparse acquisition collects selected files plus some fragments of unallocated data, and a targeted acquisition collects only chosen items. Neither is a complete bit-level copy.

Discuss in Forum

Which of the following indicates a PNG file signature ?

A.FF D8 FF E0
B.50 4B 03 04
C.89 50 4E 47
D.None of these

Exam Year(s)

Tripura Public Service Commission - 2026,

Answer: C

The PNG signature is 89 50 4E 47.

Every PNG file begins with the eight bytes 89 50 4E 47 0D 0A 1A 0A. After the non-ASCII byte 89, the next three bytes are the ASCII letters P N G. Forensic tools use such signatures (magic numbers) to identify files whatever their extension.

FF D8 FF E0 is the start of a JPEG file in JFIF format. 50 4B 03 04 spells 'PK' and marks a ZIP archive, which also covers DOCX, XLSX, JAR and APK files. So 'None of these' is wrong.

Discuss in Forum

SD forensics is generally more challenging than HDD forensics primarily due to which of the following factors ?

A.TRIM operations and wear-leveling
B.Higher storage size
C.Lack of MBR
D.Encryption is always present

Exam Year(s)

Tripura Public Service Commission - 2026,

Answer: A

The main factor is TRIM operations and wear-leveling.

The question's 'SD' is flash storage (solid-state drives, and in the same way SD cards), which behaves very differently from a magnetic hard disk. On an HDD, a deleted file stays in place until overwritten, so it can be recovered. On flash, the TRIM command tells the drive which blocks are no longer in use, and the drive's own garbage collection erases them, often within moments and even while the device is write-blocked. Wear-leveling constantly remaps logical blocks to different physical cells, so data moves and old copies sit in areas the examiner cannot address.

Storage size is not inherently larger on flash, flash drives use MBR or GPT partition tables like hard disks, and encryption is optional, not always present.

Discuss in Forum

Which forensic acquisition is preferred when the system is suspected to contain full-disk encryption ?

A.Live acquisition
B.Sparse acquisition
C.Logical image
D.Offline imaging

Exam Year(s)

Tripura Public Service Commission - 2026,

Answer: A

The preferred method is live acquisition.

With full-disk encryption, the data on the disk is readable only while the system is running with the volume unlocked. If the machine is switched off and imaged in the usual way, the examiner gets only ciphertext and needs the password or recovery key. A live acquisition captures the decrypted data while it is accessible, together with the RAM contents, which may hold the encryption keys themselves.

Offline imaging (dead-box acquisition) is exactly the approach that loses access to encrypted data. Sparse and logical acquisitions only reduce what is collected; they do not address encryption, and they still have to be done while the system is live to be readable.

Discuss in Forum

Which of the following storage media typically exhibits the highest volatility in digital evidence ?

A.RAM
B.SSD
C.CPU Cache
D.Network Logs

Exam Year(s)

Tripura Public Service Commission - 2026,

Answer: C

The most volatile is the CPU cache.

Evidence is collected in order of volatility, most short-lived first. RFC 3227, the standard guideline, puts CPU registers and cache at the top: their contents change in nanoseconds as the processor runs. Next come routing and ARP tables, the process table and main memory (RAM), then temporary file systems, disks, remote logs and archival media.

RAM is volatile too, but its contents last as long as the power and survive for seconds or more, so it comes after cache. An SSD is persistent storage, and network logs are stored records, both near the bottom of the order.

Discuss in Forum

In the detection of image-based steganography, the "RS steganalysis" technique is primarily used to identify which of the following ?

A.Hidden audio content
B.Modified EXIF metadata
C.Pixel relationship irregularities
D.None of these

Exam Year(s)

Tripura Public Service Commission - 2026,

Answer: C

RS steganalysis identifies pixel relationship irregularities.

RS (Regular-Singular) steganalysis, introduced by Fridrich, Goljan and Du, detects LSB embedding in images. It divides the image into small groups of pixels, applies flipping functions to their least significant bits, and counts how many groups become more regular or more singular (smoother or noisier). In a natural image these counts follow a predictable relationship; LSB embedding disturbs it, and the size of the disturbance even estimates the length of the hidden message.

It analyses pixel values, so it does not look for hidden audio, and EXIF metadata is a separate forensic check. Since one option is correct, 'None of these' is wrong.

Discuss in Forum

10.

A widely used method of embedding hidden data inside images by manipulating the Least Significant Bits (LSB) of pixel values belongs to which category of steganography ?

A.Transform-domain steganography
B.Spread spectrum steganography
C.Substitution-based steganography
D.Distortion-based steganography

Exam Year(s)

Tripura Public Service Commission - 2026,

Answer: C

LSB embedding is substitution-based steganography.

In LSB steganography, the least significant bit of each pixel value is replaced with a bit of the secret message. Changing only the lowest bit alters each colour value by at most 1, which the eye cannot see. Because the technique works by substituting bits of the cover image directly in the spatial domain, it is classed as substitution (spatial-domain) steganography.

Transform-domain methods hide data in DCT or wavelet coefficients, as in JPEG steganography. Spread spectrum methods spread the message across the image like low-level noise. Distortion-based methods encode data as a deliberate change from the original cover, which the receiver needs in order to decode.

Discuss in Forum

Loading…

Topics

Other Subjects

Tags: Digital Forensics Questions and Answers || Digital Forensics MCQ Questions and Answers || Digital Forensics GK Questions and Answers || Digital Forensics GK MCQ Questions || Digital Forensics Multiple Choice Questions and Answers || Digital Forensics GK || GK on Digital Forensics || Cyber Security Questions and Answers || Cyber Security MCQ Questions and Answers || Cyber Security GK Questions and Answers || GK on Cyber Security

Digital Forensics Questions and Answers

Topics

Other Subjects

About Us

Stay informed about all important Dates & Notifications