Quiz — Types
10 APPLY items on volatile vs persistent, artifact quadrants, and metadata on $DFIR_LAB.
Evidence Types — Module Quiz
Ten APPLY items. Name evidence classes on YOUR $DFIR_LAB map — never stranger-device collection, metadata tampering, or unauthorized log exports. Original Cyberlium. Next: Acquisition Literacy.
APPLY: Volatile vs persistent literacy helps by:
APPLY: True or False: RAM contents are generally volatile evidence.
APPLY: Disk artifacts primarily live on:
APPLY: Tutorial exports employer logs without ticket — you:
APPLY: Metadata includes:
APPLY: Order-of-volatility often prioritizes:
APPLY: Cyberlium NEVER allows:
APPLY: True or False: SHA-256 supports integrity verification in CoC.
APPLY: chmod 600 on evidence notes means:
APPLY: Next module after this quiz: