Get the Preplance app for a seamless learning experience. Practice offline, get daily streaks, and stay ahead with real-time interview updates.
Get it on
Google Play
4.9/5 Rating on Store
Incident Response · Question Set
Forensics & Evidence interview questions for placements and exams.
Questions
14
Included in this set
Subject
Incident Response
Explore more sets
Difficulty
Mixed
Level of this set
Go through each question and its explanation. Use this set as a focused practice pack for Incident Response.
Digital forensics focuses on identifying, collecting, preserving, and analyzing digital evidence in a legally acceptable way. It ensures the facts of the incident are accurately established and can support legal or disciplinary actions.
For complete preparation, combine this set with full subject-wise practice for Incident Response. You can also explore other subjects and sets from the links below.
The chain of custody is a formal record documenting who handled the evidence, when, and why. It guarantees that evidence integrity is maintained from collection to presentation in court or internal proceedings.
Volatile data resides in system memory and disappears when power is lost. Examples include running processes, network connections, and cached credentials. Collecting volatile data early is crucial in live incident response.
Forensic professionals collect data based on its volatility—starting from the most temporary to the most stable. Memory and network data are collected first since they can change or disappear quickly, followed by disks, logs, and finally backups.
A write blocker ensures no data is written to the evidence drive during imaging. It preserves the original state of the drive, guaranteeing evidence authenticity throughout the acquisition process.
A forensic image is an exact replica of a storage medium created using tools like FTK Imager or dd. It ensures that all data, including hidden or deleted content, is preserved without altering the original evidence.
Hashes generate a unique digital fingerprint of evidence. If the hash value remains unchanged, it confirms that the evidence has not been modified since collection — a key legal requirement in forensics.
FTK Imager is a popular forensic tool used to acquire and preview data without altering the source. It supports imaging drives, verifying hashes, and exporting evidence in court-acceptable formats.
Live forensics is performed on running systems to capture volatile data like RAM, active connections, or live malware behavior. Dead forensics works on powered-off systems or forensic images, analyzing disks, logs, and persistent artifacts. Both complement each other for complete analysis.
Preservation maintains data integrity and ensures that evidence is admissible in legal or compliance investigations. Tampering, even unintentionally, can invalidate critical proof. Secure storage, controlled access, and proper documentation keep the evidence credible.
Reports should be clear, factual, and legally defensible. Include scope, tools used, findings, timelines, and conclusions without speculation. Visual aids like timelines or hash summaries help non-technical stakeholders understand the evidence flow.
Common mistakes include failing to document evidence properly, skipping hash verification, altering source media, or analyzing live data without authorization. Avoiding these ensures the evidence remains reliable and legally defensible.
• **Direct evidence** directly links the suspect to a crime (e.g., an email admitting data theft). • **Documentary evidence** includes logs, screenshots, or captured files supporting an event. • **Testimonial evidence** comes from statements made by witnesses or experts. Combining all three provides stronger investigative conclusions.
Chain of custody records include: 1. Unique evidence ID and description. 2. Collection time, date, and location. 3. Name and signature of collector. 4. Transfer details — who handled it next and why. 5. Storage conditions and final disposition. These details prove authenticity throughout the investigation.