WGU Digital Forensics in Cybersecurity (D431/C840) Course Exam WGU (D431/C840) Digital Forensics in Cybersecurity Course Exam Questions

Answer : A

Comprehensive and Detailed Explanation From Exact Extract:

Solid-state drives (SSDs) use flash memory and have no moving mechanical parts, making them more resistant to physical shock and damage compared to magnetic drives, which rely on spinning platters.

This resilience makes SSDs favorable in environments with higher physical risk.

However, data recovery from SSDs can be more complex due to wear-leveling and TRIM features.

NIST and forensic hardware guides highlight SSD durability advantages over traditional magnetic storage.

Answer : A

Comprehensive and Detailed Explanation From Exact Extract:

To legally search the computer located in the home, the detective must obtain consent from someone with authority over the premises --- in this case, the parents. Parental consent is generally sufficient for searches within their household unless other legal considerations apply. This ensures compliance with constitutional protections against unlawful searches.

Obtaining valid consent is a fundamental requirement under the Fourth Amendment for legal search and seizure.

Forensic investigators must avoid searches without proper consent or a warrant to maintain admissibility of evidence.

NIST SP 800-101 and standard forensic ethics protocols emphasize obtaining lawful consent or warrants prior to accessing digital evidence.

Answer : D

Comprehensive and Detailed Explanation From Exact Extract:

File slack is the space between the logical end of a file and the physical end of the last cluster allocated to the file. This space may contain residual data from previously deleted files or fragments, making it significant in forensic investigations.

Unallocated space refers to clusters not currently assigned to any file.

Volume slack includes slack space at the volume level but is less specific.

Host protected area is a reserved part of the disk for system use, unrelated to slack space.

File slack is a recognized forensic artifact often examined for hidden data or remnants.

This concept is extensively described in forensic textbooks and NIST publications on file systems, including SP 800-86 and SWGDE best practices.

Answer : C

Comprehensive and Detailed Explanation From Exact Extract:

In steganography, the carrier is the file or medium used to hide the secret message. In this example, the sound file is the carrier because it contains the hidden message embedded using the least significant bit method. The message is the payload, and the website is merely the distribution platform.

LSB is the embedding technique, not the carrier.

The message is the payload, not the carrier.

The website is not involved in data hiding.

NIST and steganography references clearly define the carrier as the container holding the hidden data.

Answer : D

Comprehensive and Detailed Explanation From Exact Extract:

XRY is a commercial forensic tool specifically designed to extract data from mobile devices, including Apple iPhones. It has capabilities to bypass or work around iOS passcodes under certain conditions to acquire data for forensic analysis.

iStumbler is a Wi-Fi scanning tool.

Ophcrack and LOphtCrack are password cracking tools for Windows systems, not mobile devices.

XRY is widely referenced in digital forensics training and NIST mobile device forensic guidelines as a leading tool for iOS data extraction.

Answer : B

Comprehensive and Detailed Explanation From Exact Extract:

The Chain of Custody (CoC) is the documented and unbroken transfer record of evidence handling, from seizure to presentation in court. It ensures that the evidence has been preserved, controlled, and protected from tampering or alteration.

Evidence record documents evidence details but is less formal than CoC.

Event log and audit log are system-generated records and do not replace the formal CoC.

CoC is a fundamental forensic principle as outlined by NIST SP 800-86 and the Scientific Working Group on Digital Evidence (SWGDE) best practices, ensuring evidence admissibility and reliability in legal proceedings.

Answer : A

Comprehensive and Detailed Explanation From Exact Extract:

File timestamps, including creation time, last modified time, and last accessed time, are fundamental metadata attributes stored with each file on a file system. When files are modified, these timestamps usually update, providing direct evidence about when changes occurred. Examining file timestamps helps forensic investigators identify which files were altered and estimate the time of unauthorized activity.

IP addresses (private or public) are network-related evidence, not stored on the storage media's files directly.

Operating system version is system information but does not help identify specific file modifications.

Analysis of file timestamps is a standard forensic technique endorsed by NIST SP 800-86 (Guide to Integrating Forensic Techniques into Incident Response) for determining file activity and changes on digital media.