Digital Forensics — MCQs

A physician is accused of death threats via anonymous email. Investigation reveals the email was sent through multiple proxy servers and TOR network from a public WiFi location. The suspect's home computer shows no direct evidence. Evaluate which combination of digital artifacts would MOST conclusively link the suspect to the anonymous communication?

A hospital's electronic medical records system was allegedly tampered with to alter a patient's medication history before a medico-legal case. The accused claims system errors caused the changes. Multiple users have access. How would you BEST establish intentional tampering versus system malfunction?

An autopsy surgeon receives a laptop allegedly containing child pornography. Initial examination shows no illegal images in accessible folders, but forensic tools detect suspicious encrypted container files. Anti-forensic timestamp manipulation is suspected. Which analytical approach would provide the MOST legally defensible evidence?

A medical professional is accused of leaking confidential patient data via USB drive. Forensic examination reveals no files on the USB, but Registry analysis shows recent USB activity. File carving recovers deleted patient records. Which combination of artifacts would BEST establish the accused's intent and timeline?

During investigation of a cyberstalking case, a victim's smartphone was found formatted. Which technique would be MOST effective for recovering deleted WhatsApp conversations?