Key details for this exam, checked against the published exam outline
Each question shows the correct answer and an explanation of why it is right
A forensic investigator is acquiring evidence from an iPhone.
What should the investigator ensure before the iPhone is connected to the computer?
Comprehensive and Detailed Explanation From Exact Extract:
Before connecting an iPhone to a forensic workstation, the investigator must ensure that the phone does not sync with the computer automatically. Automatic syncing may alter, delete, or overwrite evidence stored on the device or the computer, compromising forensic integrity.
Jailbreak mode is not necessary and can complicate forensic analysis.
Powering off the device prevents acquisition of volatile data.
Root privileges (jailbreak) may aid access but are not mandatory before connection.
NIST mobile device forensic guidelines emphasize disabling automatic sync to preserve data integrity during acquisition.
A cybercriminal hacked into an Apple iPad that belongs to a company's chief executive officer (CEO). The cybercriminal deleted some important files on the data volume that must be retrieved.
Which hidden folder will contain the digital evidence?
Comprehensive and Detailed Explanation From Exact Extract:
On Apple iOS devices, deleted files are often moved to a hidden Trash folder before permanent deletion. The directory /.Trashes/501 is a hidden folder where deleted files for user ID 501 (the first user created on macOS/iOS devices) are temporarily stored.
This folder can contain files marked for deletion and thus is a prime location for recovery attempts.
/lost+found is a directory commonly used on Unix/Linux file systems for recovered file fragments after file system corruption but is not the default trash location on iOS.
/Private/etc and /etc contain system configuration files, not deleted user files.
Apple forensic investigations per NIST and training manuals such as those from Cellebrite and BlackBag Technologies indicate that user-deleted files on iOS devices reside in .Trashes or similar hidden directories until permanently removed.
Where is the default location for 32-bit programs installed by a user on a 64-bit version of Windows 7?
Comprehensive and Detailed Explanation From Exact Extract:
On 64-bit versions of Windows operating systems (including Windows 7), 32-bit applications are installed by default into the folder C:\Program Files (x86). This separation allows the OS to distinguish between 64-bit and 32-bit applications and apply appropriate system calls and redirection.
C:\Program Files is reserved for native 64-bit applications.
C:\ProgramData contains application data shared across users.
C:\Windows contains system files, not program installations.
This structure is documented in Microsoft Windows Internals and Windows Forensics guides, including official NIST guidelines on Windows forensic investigations.
How do forensic specialists show that digital evidence was handled in a protected, secure manner during the process of collecting and analyzing the evidence?
Comprehensive and Detailed Explanation From Exact Extract:
The chain of custody is a documented, chronological record detailing the seizure, custody, control, transfer, analysis, and disposition of evidence. Maintaining this record proves that the evidence was protected and unaltered, which is essential for court admissibility.
Each transfer or access must be logged with date, time, and handler.
Breaks in the chain can compromise the legal validity of evidence.
According to NIST and forensic best practices, the chain of custody documentation is mandatory for reliable evidence handling.
Thomas received an email stating he needed to follow a link and verify his bank account information to ensure it was secure. Shortly after following the instructions, Thomas noticed money was missing from his account.
Which digital evidence should be considered to determine how Thomas' account information was compromised?
Comprehensive and Detailed Explanation From Exact Extract:
The email messages, including headers and content, contain information about the phishing attempt, such as sender details and embedded links. Analyzing these messages can help trace the source of the scam and determine the method used to deceive the victim.
Email headers provide metadata for tracking the origin.
Forensic examination of emails is fundamental in investigating social engineering and phishing attacks.
NIST SP 800-101 and forensic email analysis protocols recommend thorough email message examination in phishing investigations.
How is the Windows swap file, also known as page file, used?
Comprehensive and Detailed Explanation From Exact Extract:
The Windows swap file, or page file, is a system file used to extend physical memory by storing data that cannot fit into the RAM. When RAM is full, the OS swaps inactive data pages to this file, thus augmenting RAM capacity.
It does not replace bad sectors; that function is for disk management utilities.
It is not primarily for security but for memory management.
It is not reserved exclusively for system files but is used dynamically for memory paging.
Microsoft's official documentation and forensic guides like NIST SP 800-86 describe the page file's role in virtual memory management and its importance in forensic analysis because it may contain fragments of memory and sensitive information.
A user at a company attempts to hide the combination to a safe that stores confidential information in a data file called vacationdetails.doc.
What is vacationdetails.doc called, in steganographic terms?
Comprehensive and Detailed Explanation From Exact Extract:
In steganography, the file that hides secret information is called the carrier. The carrier file appears normal and contains embedded hidden data (the payload).
Payload refers to the actual secret data hidden inside the carrier.
Snow refers to random noise or artifacts, often in images or files.
Channel refers to the medium or communication path used to transmit data.
Thus, vacationdetails.doc is the carrier file containing the hidden information.
Standard steganography literature and forensic documentation define the carrier as the file used to conceal payload data.
Exam domains verified against: Official WGU Digital-Forensics-in-Cybersecurity exam guide, last checked October 2026.
This domain evaluates the abilities of Cybersecurity Analysts and centers on the essential role that digital forensics plays within security operations. It addresses the methods used to investigate cyber events, interpret digital evidence, and determine how the results contribute to legal processes and organizational decisions.
Sample question from this domain above: Q5
This domain evaluates the capabilities of Cybersecurity Analysts and concentrates on examining gathered evidence through recognized forensic tools. It involves analyzing disks, file structures, system logs, and other digital sources while following standard investigation procedures that maintain precision and data integrity.
This domain evaluates the proficiency of Digital Forensics Technicians and focuses on retrieving evidence from deleted data, concealed information, and various system artifacts. It covers locating significant digital remnants, restoring usable material, and understanding the storage areas where system traces remain.
This domain evaluates the ability of Cybersecurity Analysts to prepare incident reports that convey the results of a forensic investigation. It involves organizing findings, presenting clear summaries, and delivering information to organizational leaders in a professional and coherent manner.
This domain evaluates the knowledge of Digital Forensics Technicians and centers on the legal frameworks and procedural rules that influence forensic practices. It covers recognizing applicable laws, organizational policies, and industry standards that ensure the investigative process remains valid, compliant, and reliable.
Common questions about the exam itself
