CHFI Practice Exam 58 — 20 Questions

Question 1

An organization receives a legal hold notice regarding pending litigation. The IT department is instructed to preserve all relevant electronically stored information. What is the primary action the IT department should take?

Accepted Answer

Place a hold on relevant data and suspend routine deletion policies. The primary action is to place a legal hold on relevant data and suspend routine deletion policies. This ensures that all potentially relevant electronically stored information (ESI) is preserved in its current state, preventing spoliation and compliance with the legal hold notice. Suspending deletion policies stops automated processes like email purge jobs or document retention schedules from destroying evidence, which is a foundational step in the e-discovery process.

Answer

Ignore the notice and continue normal operations

Answer

Create a forensic image of all servers immediately

Answer

Permanently delete all emails older than 30 days to reduce storage

Question 2

During a forensic investigation, an examiner finds a log entry: 'User JohnDoe accessed file contract.pdf at 10:32:45 AM'. This log is considered which type of evidence?

Accepted Answer

Direct evidence. The log entry directly states that User JohnDoe accessed contract.pdf at a specific time, which is a firsthand account of the event without requiring inference. In digital forensics, direct evidence is evidence that, if believed, proves a fact without any additional reasoning or presumption. This log is a direct record of the user's action, making it direct evidence.

Answer

Circumstantial evidence

Answer

Hearsay

Answer

Best evidence

Question 3

Which TWO of the following are essential components of a proper chain of custody documentation? (Select TWO)

Accepted Answer

Date and time of each transfer of custody along with the names of individuals involved. Option C is correct because the chain of custody documentation must record the date, time, and identity of each individual who handles the evidence to ensure a complete, unbroken record of custody. This allows the court to verify that evidence was not tampered with or altered between collection and presentation. Without these timestamps and names, the chain of custody is legally insufficient.

Answer

The forensic tools used to analyze the evidence

Answer

The hash value of the evidence at the time of acquisition

Answer

Digital signatures of all individuals who handled the evidence

Question 4

An investigator needs to acquire data from a suspect's hard drive without altering any data. Which tool is MOST appropriate to ensure write-blocking at the hardware level?

Accepted Answer

Tableau Forensic Bridge (hardware write-blocker). A hardware write-blocker like the Tableau Forensic Bridge sits between the suspect drive and the forensic workstation at the physical layer, intercepting and blocking any write commands (e.g., ATA WRITE DMA, SCSI WRITE) before they reach the drive. This ensures that no data—including metadata, timestamps, or file system artifacts—is altered during acquisition, which is critical for maintaining evidentiary integrity. Software-based blockers can be bypassed by the OS or a malicious driver, making hardware-level blocking the gold standard in forensic acquisition.

Answer

FTK Imager (software write-blocker)

Answer

dd command with 'iflag=noatime'

Answer

EnCase software acquisition module

Question 5

A forensic examiner uses a hardware write blocker when imaging a suspect's hard drive. What is the primary function of a hardware write blocker?

Accepted Answer

To prevent any data from being written to the suspect drive. A hardware write blocker is a device placed between the suspect drive and the forensic workstation that intercepts and blocks any write commands from the host system. Its primary function is to ensure that no data—such as file system metadata, temporary files, or operating system writes—can be written to the suspect drive, thereby preserving the original evidence in a forensically sound manner. This is critical for maintaining the integrity of the evidence and ensuring it is admissible in court.

Answer

To encrypt the data on the suspect drive

Answer

To connect the suspect drive via USB

Answer

To increase the speed of data acquisition

Question 6

A first responder arrives at a scene where a computer is on and logged in. There is a suspicion that the system contains volatile data that may be crucial to the investigation. According to best practices, what should the first responder do?

Accepted Answer

Collect volatile data using tools like FTK Imager or dd. Option D is correct because volatile data (e.g., RAM contents, network connections, running processes) is lost when the system loses power. FTK Imager or dd can capture a bit-for-bit image of memory and live system state while the computer remains on, preserving evidence that would otherwise vanish. This aligns with the order of volatility (RFC 3227), which prioritizes capturing volatile data before any other action.

Answer

Immediately pull the power cord to preserve the hard drive

Answer

Place the system in a Faraday bag and transport to lab

Answer

Take photos and then shut down normally

Question 7

Which hashing algorithm is commonly used in forensic imaging to verify the integrity of evidence and is considered more secure than MD5?

Accepted Answer

SHA-256. SHA-256 is the correct answer because it is a widely adopted cryptographic hash function in forensic imaging tools (e.g., FTK Imager, EnCase) to verify evidence integrity. It produces a 256-bit (32-byte) hash value and is considered collision-resistant, making it significantly more secure than MD5, which has known collision vulnerabilities.

Answer

SHA-1

Answer

CRC32

Answer

MD5

Question 8

In the context of e-discovery, what does the 'best evidence rule' require regarding digital documents?

Accepted Answer

That the original electronic file or a reliable duplicate be produced.. The best evidence rule, codified in Federal Rule of Evidence 1002, requires the original writing, recording, or photograph to prove its content unless otherwise provided. In e-discovery, an original electronic file or a reliable duplicate (e.g., a bit-for-bit forensic image verified by a hash such as MD5 or SHA-1) satisfies this rule because the duplicate is functionally equivalent to the original for evidentiary purposes.

Answer

That all evidence be authenticated by a witness.

Answer

That only paper copies of digital documents are admissible.

Answer

That metadata is preserved in all copies.

Question 9

Which US Constitutional amendment primarily governs the legality of searching and seizing digital devices?

Accepted Answer

Fourth Amendment. The Fourth Amendment protects against unreasonable searches and seizures, requiring law enforcement to obtain a warrant based on probable cause before searching or seizing digital devices. This directly governs the legality of accessing data on computers, smartphones, and storage media in forensic investigations.

Answer

Fifth Amendment

Answer

Fourteenth Amendment

Answer

First Amendment

Question 10

Under the US Fourth Amendment, when is a warrant generally NOT required for a computer search and seizure?

Accepted Answer

When the suspect has given consent. Under the Fourth Amendment, a warrant is generally required for searches and seizures, but one well-established exception is voluntary consent. When a suspect freely and knowingly agrees to a search of their computer or digital device, law enforcement may proceed without a warrant, provided the consent is not coerced and the scope of the search is not exceeded. This principle applies regardless of whether the data is stored locally or remotely, as long as the consenting party has actual or apparent authority over the device or data.

Answer

When the evidence is stored in the cloud

Answer

When the computer is owned by a corporation

Answer

When the investigation involves a civil case

Question 11

Which THREE of the following are best practices for a first responder when arriving at a computer crime scene?

Accepted Answer

Photograph the entire scene, including the computer screen and connections. Option A is correct because photographing the entire scene, including the computer screen and connections, preserves a visual record of the state of the evidence before any changes are made. This documentation is critical for establishing the chain of custody and proving that the evidence was not tampered with. It also captures the exact configuration of cables and peripherals, which can be vital for later analysis.

Answer

Turn off the computer immediately to prevent remote access

Answer

Boot the computer from a forensic CD to preview the hard drive

Question 12

During a forensic investigation, an analyst uses a hardware write blocker to connect a suspect hard drive to a forensic workstation. Which of the following is the PRIMARY reason for using a write blocker?

Accepted Answer

To prevent any modification to the suspect drive during acquisition. The primary reason for using a hardware write blocker is to ensure that the suspect drive is connected in a read-only manner, preventing any write operations from the forensic workstation from reaching the drive. This preserves the integrity of the evidence by guaranteeing that no data is altered, added, or deleted during the acquisition process, which is a fundamental requirement for admissibility in legal proceedings.

Answer

To allow the suspect drive to be mounted as read-write for analysis

Answer

To decrypt the drive automatically without the key

Answer

To speed up the imaging process by caching writes

Question 13

A forensic analyst is examining a hard drive that was imaged using a software write blocker. Which of the following is a potential disadvantage of using a software write blocker compared to a hardware write blocker?

Accepted Answer

It may be susceptible to operating system or driver vulnerabilities. A software write blocker operates at the operating system level, intercepting write commands before they reach the storage device. Because it relies on the OS and its drivers, any vulnerability in the OS kernel, storage driver stack, or the blocker's own filter driver could be exploited, potentially allowing unintended writes to the evidence. In contrast, a hardware write blocker physically prevents write signals from reaching the drive at the bus level, offering a more robust isolation that is independent of the host OS's security state.

Answer

It cannot be used with USB drives

Answer

It does not support hashing algorithms for integrity

Answer

It is more expensive than hardware write blockers

Question 14

During an investigation, an analyst creates a forensic image of a hard drive using FTK Imager and computes the MD5 hash of the image. Later, the hash is re-computed and found to match. What does this confirm?

Accepted Answer

The image is an exact copy and has not been altered. A matching MD5 hash confirms that the forensic image is bit-for-bit identical to the original drive at the time of acquisition and has not been modified since. MD5 is a cryptographic hash function that produces a 128-bit digest; any change to the image, even a single bit, would produce a completely different hash. This integrity verification is a foundational step in the forensic process to ensure the evidence is admissible and untampered.

Answer

FTK Imager is a valid forensic tool

Answer

The original hard drive is free of malware

Answer

The image was acquired without using a write blocker

Question 15

What is the primary purpose of maintaining a chain of custody during a forensic investigation?

Accepted Answer

To document the handling of evidence from collection to presentation in court. The primary purpose of maintaining a chain of custody is to create a documented, unbroken record of every person who handled the evidence, from the moment it is collected until it is presented in court. This documentation is critical to establish the authenticity and integrity of the evidence, ensuring it has not been tampered with or altered, which is a foundational requirement for admissibility under legal standards like the Federal Rules of Evidence (FRE) 901. Without a proper chain of custody, the evidence can be challenged as inadmissible due to lack of trustworthiness.

Answer

To reduce the size of evidence for easier storage

Answer

To analyze the evidence for hidden data

Answer

To encrypt the evidence to prevent unauthorized access

Question 16

Which type of evidence is a witness's statement that they saw someone log into a computer?

Accepted Answer

Direct evidence. Direct evidence is testimony or other proof that directly proves a fact without requiring any inference. A witness's statement that they saw someone log into a computer is direct evidence because it is based on the witness's firsthand observation of the act itself, not on any deduction or assumption. In digital forensics, direct evidence can include eyewitness accounts of specific actions on a system, such as entering credentials or accessing files.

Answer

Hearsay evidence

Answer

Best evidence

Answer

Circumstantial evidence

Question 17

In a UK-based investigation, the police seize a computer without a warrant. The suspect's lawyer argues that the evidence is inadmissible because it violates which law?

Accepted Answer

Police and Criminal Evidence Act (PACE). The Police and Criminal Evidence Act (PACE) 1984 governs the powers of police in England and Wales to search, seize, and retain evidence. Without a warrant, the seizure of a computer likely violates PACE's requirements for lawful entry and seizure, making the evidence inadmissible under UK law.

Answer

Fourth Amendment to the US Constitution

Answer

General Data Protection Regulation (GDPR)

Answer

Computer Misuse Act

Question 18

Which TWO of the following are types of write blockers used in forensic imaging? (Select two.)

Accepted Answer

Hardware write blocker. Hardware write blockers (Option D) are physical devices that sit between the suspect drive and the forensic workstation, intercepting and blocking any write commands at the SATA/IDE/USB bus level. They ensure that no data is altered on the source drive during imaging by electrically or mechanically preventing write signals from reaching the drive.

Answer

Encryption write blocker

Answer

Network write blocker

Answer

Hash write blocker

Question 19

An organization receives a legal hold notice regarding a pending lawsuit. The IT department is instructed to preserve all relevant electronically stored information (ESI). Which of the following actions must be taken FIRST?

Accepted Answer

Immediately suspend any automated data deletion policies. When a legal hold notice is issued, the first priority is to preserve all potentially relevant ESI by immediately suspending any automated data deletion policies (e.g., retention schedules, auto-archiving, or purge scripts). This prevents spoliation of evidence before any collection or analysis begins. Failure to do so could result in sanctions for destroying discoverable data.

Answer

Perform a full forensic analysis of all systems

Answer

Notify all employees to delete personal files

Answer

Delete all emails older than 30 days to reduce storage

Question 20

A forensic analyst needs to collect evidence from a running Windows system without altering the system state. Which tool should they use to acquire volatile memory?

Accepted Answer

DumpIt. DumpIt is a lightweight memory acquisition tool designed specifically for capturing the contents of volatile memory (RAM) on a running Windows system. It minimizes interaction with the system to avoid altering the memory state, making it ideal for forensic collection of live evidence.

Answer

Wireshark

Answer

dd

Answer

Tableau write blocker