Chapter 1 — Quiz

15 questions: 11 multiple choice, 2 true/false, and 2 short answer. Answers and a scoring band are at the bottom. No notes — see what stuck.

Multiple choice

Q1. Which statement best defines data recovery? - A) Investigating digital devices to produce court-admissible evidence - B) Restoring lost, deleted, corrupted, or inaccessible data on behalf of its owner - C) Permanently erasing data so that it cannot be reconstructed - D) Encrypting data to protect it from theft

Q2. The working definition of digital forensics is built on four verbs. They are: - A) Image, hash, recover, return - B) Seize, decrypt, copy, delete - C) Identify, preserve, analyze, present - D) Detect, contain, eradicate, recover

Q3. Which item belongs to the roughly 70% shared technical core of both disciplines? - A) Maintaining an unbroken chain of custody - B) Testifying under cross-examination - C) Understanding what a file system actually changes when a file is "deleted" - D) Obtaining a search warrant

Q4. "The original is sacred" is a rule in both disciplines, but for different reasons. In data recovery, the primary reason to avoid working on the original is that: - A) It is required for evidence to be admissible in court - B) The original is irreplaceable and may be failing, so every read risks finishing it off - C) The chain of custody demands it - D) The Fourth Amendment requires it

Q5. A file that begins with the bytes FF D8 FF and ends with FF D9 is a: - A) PNG image - B) PDF document - C) JPEG image - D) Windows registry hive

Q6. In a Sleuth Kit fls listing, an asterisk (*) before an entry tells you the file is: - A) Encrypted - B) Hidden by the user - C) Deleted — its metadata is still present and its clusters are marked free - D) A protected operating-system file

Q7. On a drive with 512-byte sectors, a partition that starts at logical block address (LBA) 2,048 begins at which byte offset? - A) 2,048 - B) 4,096 - C) 524,288 - D) 1,048,576

Q8. Which requirement is essential in digital forensics but generally optional in data recovery? - A) Making a copy of the data before working on it - B) An unbroken, documented chain of custody - C) Understanding the file system - D) Using software tools at all

Q9. Why does modern forensic practice prefer SHA-256 over MD5 for evidence integrity? - A) SHA-256 is much faster to compute on large drives - B) MD5 is cryptographically broken — collisions can be deliberately manufactured - C) MD5 produces a longer value and is therefore more secure - D) SHA-256 is mandated by the Federal Rules of Civil Procedure

Q10. An examiner finds that a file's $STANDARD_INFORMATION` timestamps are years older than its `$FILE_NAME timestamps. The most likely explanation is: - A) The file system is corrupted - B) The file was encrypted at some point - C) The timestamps were deliberately altered (timestomping) - D) The drive is mechanically failing

Q11. A "routine" recovery job arrives with no hint of anything legal. According to the chapter's war story, the safest default is to: - A) Work fast on the original to satisfy the client and keep costs down - B) Refuse the job unless the client first signs a liability waiver - C) Apply forensic-grade rigor you can later choose not to use — image first, hash, document - D) Assume it will never reach a court and skip the paperwork

True/False

Q12. Deleting a file and emptying the Recycle Bin overwrites the file's data on the disk. (True / False)

Q13. On a TRIM-enabled SSD, a file deleted 30 seconds ago may already be physically unrecoverable, even though the identical deletion on a hard drive would leave the data intact for months. (True / False)

Short answer

Q14. You hash a source drive, image it, hash the image, and the two SHA-256 values match. In one or two sentences, state what this match proves — and one important thing it does not prove.

Q15. A friend asks you to "just recover the deleted files" from a laptop that belongs to his former business partner. Name two distinct concerns this raises from Chapter 1 — one legal/ethical and one about discipline/optionality — and one thing you would do before connecting the drive.

---

Answer key

Q1 — B. Recovery restores lost data for its owner; option A is forensics, C is secure deletion, D is encryption.

Q2 — C. Identify, preserve, analyze, present. (Option D is the incident-response lifecycle — a tempting distractor, but not the forensics definition.)

Q3 — C. How storage and file systems work — including what "delete" really does — serves both disciplines. A, B, and D are forensics-specific, living in the 30% that diverges.

Q4 — B. Recovery protects the original because it is irreplaceable and often failing; forensics protects it for admissibility. Same commandment, opposite motives.

Q5 — C. FF D8 FF is the JPEG Start-Of-Image header and FF D9 is its End-Of-Image footer. (PNG starts 89 50 4E 47; PDF starts 25 50 44 46.)

Q6 — C. The * flags a deleted entry: the file system still knows the name, size, and cluster run, but the space is marked free.

Q7 — D. 2,048 × 512 = 1,048,576 bytes = 1 MiB, the conventional start of the first partition.

Q8 — B. Chain of custody is mandatory in forensics and usually unnecessary in recovery. A and C are part of the shared core; tools (D) are used in both.

Q9 — B. MD5's collision resistance is broken — two different inputs can be crafted to share a hash — so SHA-256 is preferred, though many examiners still record MD5 to match legacy tooling.

Q10 — C. The user-modifiable $STANDARD_INFORMATION` times were altered, while the harder-to-forge `$FILE_NAME times were not; the disagreement is the tell.

Q11 — C. You can always choose not to use rigor you have; you can never retroactively add rigor you skipped. Preserve optionality.

Q12 — False. Deletion removes a pointer and frees the space; the bytes persist until something overwrites them. This is the engine of both disciplines.

Q13 — True. TRIM and garbage collection routinely erase deleted blocks at the hardware level within seconds, so flash behaves very differently from magnetic media.

Q14 — Model answer. It proves the image is a bit-for-bit faithful copy of the source as it existed at the moment of hashing — integrity and faithfulness of the copy. It does not prove the source was unaltered before you hashed it (hence: hash with a write blocker in place, before touching anything), nor does it say anything about whether the data's contents are truthful or authentic — only that copy equals source.

Q15 — Model answer. (1) Legal/ethical: you may only access data you are authorized to access; your friend may not own the device or hold the partner's consent, so connecting it could violate the CFAA or privacy/wiretap law — "he handed it to me" is not proof of authority. (2) Discipline/optionality: a favor between feuding ex-partners is exactly the job that becomes litigation, so default to forensic rigor. Before connecting: confirm authority in writing, then write-block, image, hash, and start a chain-of-custody record — preserving options you may later need.

Scoring: 14–15 correct — you own the foundation; move to Chapter 2 with confidence. 11–13 — solid; reread the section behind any miss. 8–10 — re-skim "Where the disciplines diverge" and "Six principles" before continuing. Below 8 — reread the chapter; everything ahead is built on it.