Digital Forensic Certification Practice Exam

What type of files provided useful information to Jayden during his investigation?

1. Document files

2. Password-protected files

3. System log files

4. Software installation files

The correct answer is: Password-protected files

During an investigation, password-protected files can provide valuable information if the investigator has the means to access them. Often, these files may contain sensitive or critical information that could be relevant to the investigation. By using specialized tools or techniques, an investigator can unlock these files, potentially revealing evidence such as communication records, financial documents, or proprietary data. This kind of information can be crucial for establishing intent, sequence of events, or validating other pieces of evidence. Other types of files mentioned can also be valuable, but they may not encompass the same level of sensitive or protected information that a password-protected file could hold. Document files may contain useful text but often are not secured in the same manner. System log files are important for understanding system activity but may lack the direct evidence needed for certain types of investigations. Software installation files provide insight into what software is installed but generally do not contain the sort of critical content an investigator may need.