Free Practice Questions for the WGU Courses and Certificates Digital-Forensics-in-Cybersecurity Exam (2026 Updated)

Comprehensive and Detailed Explanation From Exact Extract:

File slack is the space between the logical end of a file and the physical end of the last cluster allocated to the file. This space may contain residual data from previously deleted files or fragments, making it significant in forensic investigations.

Unallocated space refers to clusters not currently assigned to any file.

Volume slack includes slack space at the volume level but is less specific.

Host protected area is a reserved part of the disk for system use, unrelated to slack space.

File slack is a recognized forensic artifact often examined for hidden data or remnants.

Comprehensive and Detailed Explanation From Exact Extract:

The Privacy Protection Act (PPA) protects journalists by restricting law enforcement’s ability to search or seize materials intended for public dissemination unless certain exceptions apply. It safeguards journalistic sources and unpublished work from unwarranted government intrusion.

The PPA ensures freedom of the press and protects confidential information.

Law enforcement must comply with procedural safeguards before accessing journalistic materials.

Comprehensive and Detailed Explanation From Exact Extract:

The browser cache stores recently accessed web pages, images, and cookies, which may include phishing site content and related activity. Investigators analyzing phishing attacks collect browser cache data to reconstruct the victim’s web activity and detect malicious sites.

Cached web pages help corroborate victim statements and establish timelines.

Browser history and cache are volatile and must be preserved promptly.

Comprehensive and Detailed Explanation From Exact Extract:

Network transaction logs capture records of network connections, including source and destination IP addresses, ports, and timestamps. These logs are essential in identifying the attacker’s origin and understanding the nature of the intrusion.

Network logs provide traceability back to the attacker.

Forensic procedures prioritize collecting network logs to identify unauthorized access.

Comprehensive and Detailed Explanation From Exact Extract:

The ipconfig command executed at a Windows command prompt displays detailed network configuration information such as IP addresses, subnet masks, and default gateways. Collecting this information prior to seizure preserves volatile evidence relevant to the investigation.

Documenting network settings supports the understanding of the suspect system's connectivity at the time of seizure.

NIST recommends capturing volatile data (including network configuration) before shutting down or disconnecting a suspect machine.

Comprehensive and Detailed Explanation From Exact Extract:

The email messages, including headers and content, contain information about the phishing attempt, such as sender details and embedded links. Analyzing these messages can help trace the source of the scam and determine the method used to deceive the victim.

Email headers provide metadata for tracking the origin.

Forensic examination of emails is fundamental in investigating social engineering and phishing attacks.

Comprehensive and Detailed Explanation From Exact Extract:

Steganography is the technique of hiding information within another file, message, image, or medium to conceal the existence of the information itself. It differs from encryption in that the data is hidden, not just scrambled.

Steganalysis is the detection or analysis of hidden data.

Encryption and cryptography involve scrambling data but do not inherently hide its existence.

NIST and digital forensics guidelines define steganography as the art of concealed writing or data hiding, used by criminals to evade detection.

Comprehensive and Detailed Explanation From Exact Extract:

Disconnecting the computer from the network by unplugging the Ethernet cable prevents further spread of malware and stops external communication that could lead to data exfiltration. This containment step is vital before further evidence collection.

Maintaining system power preserves volatile memory.

Network disconnection is recommended by incident response guidelines.

Comprehensive and Detailed Explanation From Exact Extract:

The Windows Security Account Manager (SAM) file stores hashed passwords for local Windows user accounts. These hashes are used to authenticate users without storing plaintext passwords.

The SAM file stores local account password hashes, not network passwords.

Passwords are hashed (not encrypted) using algorithms like NTLM or LM hashes.

Network password management occurs elsewhere (e.g., Active Directory).

Comprehensive and Detailed Explanation From Exact Extract:

The chain of custody is a documented, chronological record detailing the seizure, custody, control, transfer, analysis, and disposition of evidence. Maintaining this record proves that the evidence was protected and unaltered, which is essential for court admissibility.

Each transfer or access must be logged with date, time, and handler.

Breaks in the chain can compromise the legal validity of evidence.

Comprehensive and Detailed Explanation From Exact Extract:

This describes the Communications Assistance to Law Enforcement Act (CALEA) requirement that telecommunications equipment and services include built-in capabilities that allow authorized law enforcement surveillance, including electronic monitoring and wiretapping.

CALEA mandates lawful intercept capabilities in telecommunications infrastructure.

It ensures that digital and VoIP communications can be monitored under proper legal warrant.

This rule supports modern digital evidence gathering and real-time surveillance operations.

Comprehensive and Detailed Explanation From Exact Extract:

The .bash_history file located in each user’s home directory (e.g., /Users/ < user > /.bash_history ) records the history of shell commands entered by the user in bash shell sessions. Reviewing this file allows investigators to see the commands executed by a specific user.

/var/vm contains virtual memory swap files, not command history.

/var/log contains system logs but not individual user shell command history.

/Users/ < user > /Library/Preferences stores application preferences.

NIST guidelines and macOS forensics literature confirm .bash_history as the standard location for shell command histories on OS X systems.

Comprehensive and Detailed Explanation From Exact Extract:

The CAN-SPAM Act requires that commercial emails include a clear and conspicuous mechanism allowing recipients to opt out of receiving future emails. This opt-out method cannot require payment or additional steps that would discourage recipients.

The act aims to reduce unsolicited commercial emails and spam.

Compliance is critical for lawful email marketing and forensic investigations involving email misuse.

Comprehensive and Detailed Explanation From Exact Extract:

A bit-level (bitstream) copy creates an exact sector-by-sector duplicate of the original media, capturing all files, deleted data, and slack space. This method is essential to preserve the entirety of digital evidence without modification.

Bit-level imaging maintains forensic soundness.

It allows investigators to perform analysis without altering original data.

Comprehensive and Detailed Explanation From Exact Extract:

On Apple iOS devices, deleted files are often moved to a hidden Trash folder before permanent deletion. The directory /.Trashes/501 is a hidden folder where deleted files for user ID 501 (the first user created on macOS/iOS devices) are temporarily stored.

This folder can contain files marked for deletion and thus is a prime location for recovery attempts.

/lost+found is a directory commonly used on Unix/Linux file systems for recovered file fragments after file system corruption but is not the default trash location on iOS.

/Private/etc and /etc contain system configuration files, not deleted user files.

Comprehensive and Detailed Explanation From Exact Extract:

NIST Special Publication 800-72 provides guidelines for mobile device forensics and identifies four device states during data extraction: active, idle, powered off, and locked. These states influence how data can be accessed and preserved.

Understanding these states helps forensic investigators select appropriate acquisition techniques.

NIST SP 800-72 is a key reference for mobile device forensic methodologies.

Comprehensive and Detailed Explanation From Exact Extract:

The Communications Assistance to Law Enforcement Act (CALEA) mandates telecommunications carriers to assist law enforcement in executing authorized wiretaps, including on Voice over IP (VoIP) calls, ensuring lawful interception capabilities.

CALEA requires built-in surveillance capabilities in communications systems.

It balances privacy rights with law enforcement needs.

Comprehensive and Detailed Explanation From Exact Extract:

Mac systems traditionally use the Hierarchical File System Plus (HFS+), which supports features such as journaling and metadata handling suited for Mac OS environments. Newer versions use APFS but HFS+ remains relevant.

NTFS is primarily a Windows file system.

EXT4 is a Linux file system.

FAT32 is a generic cross-platform file system but lacks advanced features.

Comprehensive and Detailed Explanation From Exact Extract:

Least Significant Bit (LSB) insertion involves modifying the least significant bits of image pixel data to embed hidden information. Changes are imperceptible to the human eye, making this a common steganographic technique.

LSB insertion is widely studied and targeted in steganalysis.

It allows covert data embedding without increasing file size significantly.

Comprehensive and Detailed Explanation From Exact Extract:

The SAM (Security Account Manager) file located in the Windows\System32\config directory stores hashed local user account passwords. It can be accessed and extracted using a live CD or bootable forensic tool, which allows the forensic investigator to bypass the running operating system and avoid altering the evidence.

IPSec is related to network security policies, not password storage.

HAL (Hardware Abstraction Layer) is a system file managing hardware interaction.

Ntidr is a boot loader file in Windows NT systems.

Cracking password hashes extracted from the SAM file is a common forensic practice to recover user passwords during investigations.