Cybercrime Investigation and Digital Evidence Handling — Winter 2025

Define Forensic Science and mention its main branches.

What are digital evidences? Give two examples.

State Locard’s Exchange Principle in brief.

Define a computer system and list its basic components.

Explain the difference between primary memory and secondary memory.

Discuss the difference between volatile and non-volatile memory with examples.

Explain any two common data storage formats used in digital systems.

Evaluate cyber crime scene protocol.

What is hashing and why is it important in digital forensics?

Outline the key sections of a forensic investigation report.

What is meant by evidence documentation in digital forensics?

Analyze the importance of hashing in digital forensics.

Compare live forensic analysis and offline forensic analysis in terms of data collection and challenges.

What is data recovery, and why is it important in digital forensics?

Define hibernation file (hiberfil.sys) and state its forensic significance.

Define metadata and give two examples of metadata in files.

What are registry files, and how are they used in investigations?

Explain the importance of system restore elements in digital forensic investigations.

Analyze the digital investigation laws in context to digital forensics. Page 1 of

Define electronic discovery (e-discovery) in the context of digital forensics.

Explain how data privacy laws impact the process of digital forensics.

Examine the differences between software-based and hardware-based forensic tools.

What is tool validation in digital forensics, and why is it important?

What is browser history, and how can it assist an investigation?

State some limitations of relying on social platform data during an investigation. Page 2 of