Free WGU Digital-Forensics-in-Cybersecurity Practice Exam with Questions & Answers | Set: 3

Comprehensive and Detailed Explanation From Exact Extract:

Real evidence (also called physical evidence) refers to tangible objects that are involved in the crime or relevant to the investigation. A USB flash drive is physical evidence because it is an actual device containing potentially relevant digital data.

Documentary evidence refers to written or recorded information, not physical devices.

Demonstrative evidence is used to illustrate or clarify facts (e.g., models, charts).

Testimonial evidence is oral or written statements provided by witnesses.

Comprehensive and Detailed Explanation From Exact Extract:

Mac OS X 10.8 (Mountain Lion) uses the HFS+ (Hierarchical File System Plus) file system by default for its native storage volumes. HFS+ is Apple’s proprietary file system introduced in the late 1990s, designed for macOS.

ReiserFS is a Linux file system.

MFS (Macintosh File System) is an outdated file system replaced by HFS.

NTFS is a Windows file system.

This is well documented in Apple technical specifications and forensic analysis standards for macOS systems.

Comprehensive and Detailed Explanation From Exact Extract:

The Electronic Communications Privacy Act (ECPA) regulates interception and recording of electronic communications and generally requires the consent of both parties involved in a conversation for legal recordings.

This consent requirement protects privacy rights during investigations.

Non-compliance can lead to evidence being inadmissible or legal penalties.