1. What phase involves recovering evidence without altering it? o A) Analysis B) Acquisition C) Recovery D) Presentation 2. Which type of investigation is based on IR policy? A) Criminal Investigation B) Internal Investigation C) Real-world Investigation D) Forensic Analysis 3. During the recovery phase, why should investigators work on copies? - A) To save time - B) To ensure the original evidence is preserved C) To alter the original data D) To simplify the process 4. What is a key challenge during the analysis phase? A) Maintaining Chain of Custody B) Reconstructing events C) Extracting data - D) Acquiring evidence 5. Presenting forensic findings in simple terms is important because: - A) It makes the investigator look professional B) It helps a jury or non-technical audience understand C) It speeds up the investigation D) It ensures data accuracy