Forensic Procedures: revision quiz and key terms

Free practice for Forensic Procedures in Pearson BTEC National IT (AAQ). It covers: forensic collection of digital evidence, systematic forensic analysis of a suspect system, and writing security incident reports. Try the questions, then check the key terms.

Key terms for Forensic Procedures

Admissible evidence

Evidence collected and handled properly so that a court can accept it.

Fact

A statement that can be proved directly from the evidence with no interpretation, e.g. a log entry's timestamp.

File carving

Recovering deleted files from raw disk data that has not yet been overwritten.

Impact assessment

Judging how much harm an incident caused, e.g. data lost, cost and downtime.

Limitations

Things the investigation could not establish, such as unrecoverable data.

Metadata

Information about a file, such as when it was created or modified.

Opinion

The investigator's interpretation of, or judgement about, what the evidence means.

PACE 1984

The law on how police in England and Wales gather and handle evidence.

What Forensic Procedures covers

In RADevo this topic has a full topic test and a focused quiz for each part:

• D1 Forensic Collection of Evidence: Order of volatility, forensic images, write blockers, hashing, chain of custody, live and dead acquisition and handling evidence so it is admissible.
• D2 Records, Findings and Security Reports: Maintaining an accurate record, assessing the findings, and writing security reports for different audiences.