You must be able to select the correct lab control for a scenario: secure physical access first, document chain of custody at every transfer, isolate acquisition networks, and identify core lab components. The single most important thing is preserving evidence integrity and admissibility.
Start practicing
Computer Forensics Lab — choose a session length
Free · No account required
Domain overview
The Computer Forensics Lab domain covers how a lab is planned, secured, and operated so evidence stays admissible. CHFI tests physical security, chain of custody, network design for acquisition integrity, and the essential lab components, usually as scenario questions asking which control or practice comes first or matters most.
Exam objectives
Physical access controls: locks, restricted entry, visitor logs, and surveillance protecting the lab first
Chain of custody documentation: evidence tags, transfer logs, and signed receipts for every handler
Isolated network design with segmented or air-gapped forensic subnets to prevent evidence contamination
Essential lab components: forensic workstations, write blockers, evidence storage, and validated imaging tools
Choosing network or software controls before physical access security, when physical protection is the foundational first step
Treating chain of custody as a form only, forgetting continuous documentation from seizure through return or destruction
Connecting acquisition systems to production networks, letting malware or remote access alter evidence integrity
Click any question to see the full explanation and answer options, or start a focused practice session above.
A forensic lab is designing a network architecture to ensure the integrity of evidence during acquisition. What is the most critical design consideration?
2A forensic lab is establishing a chain of custody procedure. Which practice is considered best according to CHFI guidelines?
3Which TWO of the following are essential components of a computer forensics lab according to CHFI best practices?
4A forensic lab manager is setting up a new lab and must decide on the physical security measures. Which of the following is the MOST important to implement first?
5You are a forensic examiner at a corporate security firm. You receive a laptop from the HR department that belonged to a terminated employee. The laptop was used for company business and is suspected of containing unauthorized file-sharing software. The laptop is running Windows 10 with BitLocker drive encryption enabled. Before shutdown, the employee was logged into the system. HR claims the laptop was shut down properly and then handed over within an hour. You are asked to acquire a forensic image of the hard drive for analysis. However, when you boot the laptop, you are prompted for the BitLocker recovery key. HR does not have the key, and the employee refuses to cooperate. The laptop also has a TPM chip. Which of the following is the most appropriate course of action to acquire the data?
6A forensic lab in a shared office building must protect evidence against unauthorized physical access, environmental damage, and electromagnetic interference. The lab manager is documenting the physical controls for an accreditation audit. Which control best addresses the risk of an intruder removing a seized hard drive from the evidence room?
7A junior examiner is preparing a forensics lab workstation that will be used to image suspect drives. The lab policy states the workstation must never write to a connected suspect drive. Which practice ensures this requirement is met?
8A forensic lab receives a sealed evidence bag containing a laptop seized during an investigation. The chain-of-custody form shows the bag was sealed at the scene by an officer. Before beginning analysis, the examiner must document the evidence. Which action best preserves the chain of custody at this point?
9A forensics lab is preparing a new acquisition workstation for imaging suspect drives. The lab manager wants to ensure the workstation itself does not introduce evidence contamination or alter suspect media during imaging. Which two practices should be implemented? (Choose two.)
You must be able to select the correct lab control for a scenario: secure physical access first, document chain of custody at every transfer, isolate acquisition networks, and identify core lab components. The single most important thing is preserving evidence integrity and admissibility.
The Courseiva CHFI question bank contains 9 questions in the Computer Forensics Lab domain, covering the 8% of the exam attributed to this domain in the official EC-Council blueprint. Click any question to see the full explanation and answer breakdown.
Start with a 10-question focused session to identify your baseline accuracy in this domain. Read every explanation — even for questions you answer correctly — to understand the reasoning. Once you score consistently above 80%, move to a 20–30 question session to confirm depth before moving to the next domain.
Yes — the session launcher on this page draws questions exclusively from the Computer Forensics Lab domain. Choose 10, 20, 30, or 50 questions for a focused session, or click individual questions to review them one by one.
Save your results, see per-domain analytics, and get readiness scores — free, for every certification.
Sign Up FreeFree forever · Every certification included