CHFI Practice Exam 65 — 20 Questions

Question 1

A forensic examiner has acquired a disk image using FTK Imager and needs to ensure the image is an exact duplicate of the original drive. Which THREE of the following methods can be used to verify integrity? (Select THREE)

Accepted Answer

Compute the SHA-256 hash of the image and compare it to the original drive's hash. Option A is correct because SHA-256 is a cryptographic hash function that produces a unique 256-bit digest. By computing the SHA-256 hash of the acquired image and comparing it to the hash computed from the original drive, the examiner can verify bit-for-bit integrity with extremely high collision resistance, ensuring the image is an exact duplicate.

Answer

Verify the cyclical redundancy check (CRC-32) of the image file

Answer

Check the file size of the image matches the original drive's capacity

Question 2

Which TWO of the following are valid justifications for a first responder to power off a computer at a crime scene? (Select TWO)

Accepted Answer

The computer is destroying evidence (e.g., running a data wiping program). Option C is correct because if a computer is actively running a data wiping program (e.g., a tool that overwrites storage sectors with zeros or random data), leaving it powered on will cause the irreversible destruction of potential evidence. A first responder must immediately cut power to halt the wiping process and preserve the remaining data, as volatile memory (RAM) is not the primary concern in this scenario—the non-volatile storage is being actively sanitized.

Answer

To prevent the computer from overheating

Answer

To save time during the investigation

Answer

The computer is actively being used to commit a crime

Question 3

Which TWO of the following hashing algorithms are commonly used to verify the integrity of forensic images? (Choose two.)

Accepted Answer

SHA-1. SHA-1 and MD5 are the two hashing algorithms most commonly used in forensic practice to verify the integrity of forensic images. They produce a fixed-size hash value (160-bit for SHA-1, 128-bit for MD5) that acts as a digital fingerprint; if the hash of the original image matches the hash of a copy, the data is considered unchanged. Despite known collision weaknesses, they remain the de facto standards in tools like FTK Imager, EnCase, and dd due to their speed and widespread tool support.

Answer

SHA-3

Answer

RSA

Answer

AES

Question 4

Which THREE of the following are valid rules of evidence that digital evidence must satisfy to be admissible in court? (Select three.)

Accepted Answer

Admissibility. Option B (Admissibility) is correct because digital evidence must be legally permissible in court, meaning it must be obtained lawfully and not violate constitutional rights. Admissibility is a foundational rule that ensures evidence meets legal standards for consideration by the court, often tied to the Federal Rules of Evidence (FRE) or similar jurisdictional rules. Without admissibility, even the most compelling digital evidence cannot be presented to the jury.

Answer

Best evidence rule

Answer

Chain of custody

Question 5

During a forensic investigation, an analyst acquires a hard drive using a hardware write blocker. Which of the following is the PRIMARY reason for using a hardware write blocker?

Accepted Answer

To ensure that the operating system does not mount the drive as writable.. The primary reason for using a hardware write blocker is to physically intercept the SATA/IDE bus between the suspect drive and the forensic workstation, ensuring that only read commands (e.g., ATA READ DMA) are passed through while blocking any write commands (e.g., ATA WRITE DMA). This prevents the operating system from mounting the drive as writable, which would otherwise cause automatic writes (e.g., timestamp updates, journaling, or prefetch creation) that alter evidence and break the chain of custody.

Answer

To increase the transfer speed of the imaging process.

Answer

To bypass the drive's password protection.

Answer

To compress the data during imaging.

Question 6

A first responder arrives at a scene where a computer is powered on and the user is present. According to standard forensic first responder procedures, what should the responder do FIRST?

Accepted Answer

Photograph the scene and document the system state. Option A is correct because the first priority at a live scene is to preserve volatile evidence and establish a chain of custody. Photographing the scene and documenting the system state (e.g., running processes, open network connections, logged-in users) captures critical volatile data before any action is taken. This aligns with the order of volatility (RFC 3227), which mandates capturing memory and system state before altering the system.

Answer

Boot the system from a forensic USB to create a memory dump

Answer

Immediately disconnect the power cord to preserve the hard drive

Answer

Ask the user to log out so the system can be powered off safely

Question 7

During an e-discovery process, a legal hold is issued. What is the PRIMARY purpose of a legal hold?

Accepted Answer

To prevent the destruction or alteration of potentially relevant evidence. The primary purpose of a legal hold is to preserve all forms of potentially relevant evidence by suspending normal data retention and deletion policies. This ensures that data, including emails, documents, and logs, is not altered or destroyed during the e-discovery process, which is critical for maintaining the integrity of evidence for litigation.

Answer

To authorize forensic examiners to image all company devices

Answer

To encrypt all data to prevent unauthorized access during litigation

Answer

To notify the opposing party of the intent to use electronic evidence

Question 8

A security analyst responds to a suspected data breach. The analyst documents the scene, photographs the computer, and labels the cables. Which phase of the forensic investigation process is being performed?

Accepted Answer

First response. The actions described—documenting the scene, photographing the computer, and labeling cables—are part of the First Response phase. This phase occurs immediately after an incident is detected and focuses on preserving the integrity of the scene and evidence before any collection or analysis begins. In the CHFI methodology, First Response includes securing the area, creating a detailed log of the initial state, and ensuring no unauthorized changes occur.

Answer

Collection

Answer

Examination

Answer

Reporting

Question 9

A forensic investigator uses FTK Imager to create a forensic image of a suspect's laptop. The acquisition generates both an E01 file and a corresponding hash file. Which statement accurately describes the integrity verification process in FTK Imager?

Accepted Answer

The image file includes embedded hash values that can be verified later to ensure data integrity. Option D is correct because FTK Imager embeds hash values (MD5 and SHA1) directly into the E01 file during acquisition. These embedded hashes can be verified later by FTK Imager or compatible tools to confirm that the image has not been altered, ensuring data integrity without relying on an external hash file.

Answer

The hash is computed only when the image is mounted for analysis, not during acquisition

Answer

FTK Imager does not support hash verification; a separate tool must be used

Answer

The hash is compared to a known-good hash from the manufacturer's database

Question 10

A company's legal department issues a legal hold notice for electronically stored information (ESI) related to a pending lawsuit. The IT department is tasked with preserving data. Which of the following actions is MOST likely to violate the legal hold requirements?

Accepted Answer

Continuing to run a script that deletes temporary files older than 24 hours.. Option C is correct because continuing to run a script that deletes temporary files older than 24 hours directly destroys ESI that may be relevant to the lawsuit, violating the legal hold requirement to preserve all potentially relevant data. Legal hold mandates the suspension of any automated or manual processes that could alter or delete ESI, including temporary files that might contain fragments of relevant documents or metadata. Unlike suspending routine email deletion (Option B), which is a preservation action, the script actively purges data and thus breaches the hold.

Answer

Notifying all employees to preserve documents related to the lawsuit.

Answer

Suspending routine deletion of emails older than 30 days.

Answer

Taking a forensic image of the relevant servers.

Question 11

A forensic analyst creates a forensic image of a hard drive using the dd command: dd if=/dev/sda of=/evidence/image.dd bs=4096 conv=noerror,sync. What is the purpose of the 'conv=noerror,sync' option?

Accepted Answer

It continues on read errors and pads the output with zeros to maintain the same size. The `conv=noerror,sync` option in the `dd` command instructs the tool to continue processing when a read error is encountered (`noerror`) and to pad the output block with zeros (`sync`) to maintain the same total size as the original drive. This ensures that the forensic image remains a bit-for-bit copy in terms of size, even if physical sectors are unreadable, preserving the integrity of the acquisition process for analysis.

Answer

It verifies the hash of the image after creation

Answer

It synchronizes the output with the input to ensure data integrity

Answer

It enables direct memory access for faster imaging

Question 12

What is the PRIMARY purpose of a chain of custody document in a forensic investigation?

Accepted Answer

To provide a chronological record of who handled the evidence, when, and why.. The chain of custody document is the foundational record that ensures evidence integrity and admissibility in court. Its primary purpose is to create a chronological, unbroken log of every person who handled the evidence, the exact time and date of each transfer, and the reason for the transfer. This directly supports the legal requirement to prove that the evidence has not been tampered with or altered from the moment of seizure to its presentation in court.

Answer

To document the tools used during the investigation.

Answer

To list all the files found on the suspect's computer.

Answer

To authorize the search and seizure of digital evidence.

Question 13

A forensic investigator is documenting evidence for a case. What is the PRIMARY purpose of maintaining an unbroken chain of custody for digital evidence?

Accepted Answer

To prove that the evidence has not been altered or tampered with.. The primary purpose of maintaining an unbroken chain of custody is to establish the integrity and authenticity of digital evidence by documenting every person who handled it, every transfer, and every access event. This documentation allows the court to verify that the evidence has not been altered, tampered with, or corrupted from the moment of seizure through analysis and presentation. Without a provable chain of custody, the evidence may be deemed inadmissible under rules like Federal Rule of Evidence 901 or similar standards in other jurisdictions.

Answer

To track the storage location of the evidence.

Answer

To speed up the investigation process.

Answer

To assign responsibility for the evidence to a single individual.

Question 14

Which TWO of the following are essential components of the rules of evidence for digital evidence to be admissible in court? (Choose two.)

Accepted Answer

Authenticity. Authenticity is a core component of the rules of evidence because it requires the proponent to show that the digital evidence is what it claims to be and has not been tampered with. For digital evidence, this is typically established through cryptographic hash verification (e.g., SHA-256) and a documented chain of custody. Without authenticity, the court cannot rely on the evidence's integrity, making it inadmissible.

Answer

Originality

Answer

Expediency

Answer

Complexity

Question 15

A forensic analyst is preparing to testify as an expert witness in court. Which of the following characteristics is MOST essential for the court to accept the analyst's testimony?

Accepted Answer

The analyst's methods are generally accepted in the forensic community. The court's acceptance of expert testimony hinges on the reliability and validity of the methods used, not the analyst's personal involvement or credentials. Under the Daubert standard (or Frye standard in some jurisdictions), the key factor is whether the forensic methods have been subjected to peer review, are generally accepted within the relevant scientific community, and have a known error rate. This ensures the testimony is based on sound scientific principles, not just the analyst's qualifications or role in the case.

Answer

The analyst has direct knowledge of the case

Answer

The analyst has a certification in computer forensics

Answer

The analyst is employed by the prosecution

Question 16

In a UK-based investigation, law enforcement officers seize a computer without a warrant. The suspect argues the seizure violated his rights under the Police and Criminal Evidence Act 1984 (PACE). Which of the following is a key consideration under PACE regarding the admissibility of the seized evidence?

Accepted Answer

The court may exclude the evidence if its admission would be unfair to the suspect.. Under Section 78 of PACE, the court has discretion to exclude prosecution evidence if its admission would have such an adverse effect on the fairness of the proceedings that it ought not to be admitted. Since the computer was seized without a warrant, the court must weigh the potential breach of PACE safeguards against the probative value of the digital evidence. This is not automatic exclusion, but a judicial balancing test specific to the circumstances of the seizure.

Answer

The evidence is automatically admissible because it was seized during an investigation.

Answer

The evidence is admissible because it is circumstantial.

Answer

The evidence is admissible only if the suspect signed a consent form.

Question 17

Locard's exchange principle in digital forensics states that:

Accepted Answer

Every contact leaves a trace, and digital evidence is no exception. Locard's exchange principle, originally from forensic science, asserts that whenever two objects come into contact, a transfer of material occurs. In digital forensics, this translates to the fact that digital devices and systems inevitably leave traces of their interactions—such as log entries, metadata, file artifacts, or network packets—making it possible to reconstruct events. Option D correctly captures this core idea that every contact leaves a trace, and digital evidence is no exception.

Answer

The chain of custody must be documented for all evidence

Answer

Digital evidence is always stored in the cloud

Answer

Only the forensic examiner can handle evidence

Question 18

You are a forensic investigator responding to a security incident at a medium-sized company. The incident involved an attacker gaining unauthorized access to a Windows Server 2019 system. The server was taken offline by the IT team immediately after detection. Your task is to acquire forensic evidence from the server's hard drive. The server has a single 500 GB NTFS partition. You have a forensic workstation with a write blocker, a SATA-to-USB adapter, and a forensic imaging tool that supports both dd and EWF (E01) formats. The server is still physically in the server room, and the IT team has powered it off. You need to create a forensic image that preserves the integrity of the evidence and allows for efficient analysis. Which of the following is the most appropriate course of action?

Accepted Answer

Remove the hard drive, connect it via a write blocker to the forensic workstation, and create an EWF (E01) image stored locally on the forensic workstation's internal drive.. Option D is correct because it follows best practices for forensic acquisition: removing the hard drive and connecting it via a write blocker ensures that no data is altered during imaging. Using EWF (E01) format provides compression, metadata, and integrity checks (e.g., CRC32, MD5, SHA-1), which are essential for efficient analysis and evidence preservation. Storing the image locally on the forensic workstation avoids network latency and potential data corruption.

Answer

Boot the server using a forensic live CD, connect an external USB drive to the server, and use 'dd' to create a raw image on the external drive.

Answer

Use the server's built-in backup utility to create a system state backup and copy it to a network share.

Answer

Remove the hard drive, connect it via a write blocker to the forensic workstation, and then use 'dd' over a network connection to send the image to a remote server.

Question 19

You are a forensic investigator responding to an incident on a Windows 10 workstation used by a finance manager. The user reports that a critical spreadsheet containing quarterly budget data was accidentally deleted from the Desktop yesterday at approximately 3:00 PM. The system has been used normally since then, and the user has not emptied the Recycle Bin. You have created a forensic image of the drive using FTK Imager. The Recycle Bin contains a file named 'Quarterly_Budget.xlsx', but it appears to be a shortcut (size 1 KB). The user insists the original file was several megabytes. You need to recover the original file. Which action should you take next?

Accepted Answer

Search the $Recycle.Bin folder on the forensic image to locate the original file data, which may be stored under a different name.. When a file is moved to the Recycle Bin on Windows 10, the original file data is not stored in the Recycle Bin itself; instead, a hidden file (with a random name) is created in the `$Recycle.Bin` folder on the volume, and a shortcut (the visible entry) is placed in the Recycle Bin. The shortcut points to the hidden file, which retains the original data. Since the visible entry is only 1 KB, the actual file content must be located in the `$Recycle.Bin` folder under a different name, making option A the correct next step.

Answer

Restore a previous version of the Desktop folder from Volume Shadow Copy.

Answer

Use file carving techniques to recover the file from unallocated space on the Desktop.

Answer

Check the Recycle Bin on the live system; the file should be there and can be restored.

Question 20

You are a forensic investigator for a healthcare organization that uses a hybrid cloud model. Your team receives an alert that a large amount of protected health information (PHI) was exfiltrated from an AWS S3 bucket to an external IP address. The organization uses AWS CloudTrail for API logging and VPC Flow Logs for network traffic. The incident occurred between 02:00 and 03:00 UTC. Upon reviewing CloudTrail logs, you see that the bucket policy was modified at 01:55 UTC to allow public read access, and then a series of GetObject requests from an IP address in a foreign country occurred. The VPC Flow Logs show outbound traffic from the bucket's VPC to that IP. The bucket policy change was made using the root user credentials of the AWS account. The organization has multi-factor authentication (MFA) enabled for all users, including root. However, the CloudTrail log for the policy change does not indicate MFA usage. You need to determine the most likely root cause of the breach. Which of the following is the most plausible explanation?

Accepted Answer

The root user's credentials were compromised and used to modify the bucket policy. The root user credentials were likely compromised because the CloudTrail log for the bucket policy change at 01:55 UTC shows no MFA usage, despite MFA being enforced for all users including root. This indicates the attacker used stolen root access keys or password without the MFA token, which is a common attack vector when credentials are phished or leaked. The subsequent GetObject requests from a foreign IP and outbound VPC Flow Logs confirm the exfiltration path.

Answer

The bucket policy was automatically modified by an AWS service

Answer

An insider with IAM permissions made the change using a legitimate session

Answer

The CloudTrail logs are inaccurate and the policy change was not made