CHFI Computer Forensics Fundamentals and Process — 10 Questions

Question 1

A forensic investigator is preparing to acquire the contents of a live system's RAM. Which of the following tools is specifically designed for this purpose and captures memory without altering the system state?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

FTK Imager. FTK Imager is specifically designed for live memory acquisition on Windows systems, capturing RAM contents via a kernel-level driver (e.g., win32dd or FTK Imager's own memory capture module) that reads physical memory without modifying the system state. It creates a forensic image (e.g., .mem or .raw) while maintaining data integrity through hashing (MD5/SHA1). This makes it the correct choice for acquiring RAM from a live system without altering evidence.

Answer

Tableau write blocker

Answer

EnCase

Answer

dd

Question 2

Which of the following best describes the 'Best Evidence Rule' as it applies to digital evidence?

Accepted Answer

A forensic image is considered the best evidence if the original is unavailable. The Best Evidence Rule requires that the original evidence be presented, but in digital forensics, a forensic image is considered the best evidence if the original is not practical.

Answer

Hearsay evidence is admissible if it is the only evidence available

Answer

The original digital media must be presented in court

Answer

Oral testimony is always better than written records

Question 3

Which THREE of the following are considered rules of evidence that digital evidence must satisfy to be admissible in court? (Select THREE)

Accepted Answer

Authenticity. Authenticity (B) is a core rule of evidence: digital evidence must be shown to be what it purports to be, typically via hash values (e.g., MD5/SHA-256), chain of custody, and witness testimony, so it is correctly included. Completeness (D) is also a recognized evidentiary rule requiring that when part of a recording, file, or communication is introduced, the opposing party may require introduction of any other part needed in fairness, so it is correct. Admissibility (E) is the overarching requirement that evidence be relevant, material, and not excluded by rules such as hearsay or privilege before the court will accept it, making it correct. Best evidence (A) is a real doctrine but it is not one of the three rules listed here as the selected set, and Hearsay (C) is an exclusionary rule rather than a rule digital evidence must satisfy, so neither belongs among the marked correct answers.

Answer

Best evidence

Answer

Hearsay

Question 4

During an investigation, an analyst creates a forensic image of a hard drive using FTK Imager and computes the MD5 hash of the image. Later, the hash is re-computed and found to match. What does this confirm?

Accepted Answer

The image is an exact copy and has not been altered. A matching MD5 hash confirms that the forensic image is bit-for-bit identical to the original drive at the time of acquisition and has not been modified since. MD5 is a cryptographic hash function that produces a 128-bit digest; any change to the image, even a single bit, would produce a completely different hash. This integrity verification is a foundational step in the forensic process to ensure the evidence is admissible and untampered.

Answer

FTK Imager is a valid forensic tool

Answer

The original hard drive is free of malware

Answer

The image was acquired without using a write blocker

Question 5

A first responder arrives at a scene where a computer is powered on and the user is present. According to standard forensic first responder procedures, what should the responder do FIRST?

Accepted Answer

Photograph the scene and document the system state. The first priority at a live scene is to preserve volatile evidence and establish a chain of custody. Photographing the scene and documenting the system state (e.g., running processes, open network connections, logged-in users) captures critical volatile data before any action is taken. This aligns with the order of volatility (RFC 3227), which mandates capturing memory and system state before altering the system.

Answer

Boot the system from a forensic USB to create a memory dump

Answer

Immediately disconnect the power cord to preserve the hard drive

Answer

Ask the user to log out so the system can be powered off safely

Question 6

In a UK-based investigation under the Police and Criminal Evidence Act (PACE), a forensic examiner is asked to seize computers from a business premises. Which of the following actions is MOST compliant with PACE requirements?

Accepted Answer

Seize only items that are specified in the search warrant and provide a receipt. PACE requires that during a search under warrant, only items specified in the warrant may be seized, and a receipt must be provided to the occupier. This ensures legal compliance, chain of custody, and respect for property rights, which are fundamental to admissible digital evidence.

Answer

Conduct a forensic analysis at the scene to determine relevance before seizure

Answer

Copy all data on-site and delete the originals to avoid leaving evidence behind

Answer

Enter the premises without a warrant because evidence may be destroyed

Question 7

In the context of US Fourth Amendment protections, which of the following scenarios would likely require a search warrant for a forensic examiner to legally seize and analyze a computer?

Accepted Answer

The computer is located in a private residence and there is no exigent circumstance. The Fourth Amendment requires a warrant for searches and seizures unless an exception applies. A computer in a private residence with no exigent circumstances (Option A) clearly requires a warrant. For a computer in plain view in a public area (Option B), the seizure itself may be lawful under the plain view doctrine, but the subsequent forensic analysis constitutes a separate search of digital data with a reasonable expectation of privacy, and therefore requires a warrant or an applicable exception. Consent (C) and regulatory inspection (D) are exceptions that may not require a warrant.

Answer

The computer's owner gives voluntary consent to search the device

Answer

The computer is seized from a business during a regulatory inspection with statutory authority

Question 8

Which TWO of the following are essential duties of a first responder at a digital crime scene? (Select two.)

Accepted Answer

Photograph the scene including the screen, connections, and surrounding area. First responders must secure the scene, document everything, preserve evidence, and avoid altering the system state. Photographing the scene and using a write blocker to image are correct; collecting volatile memory is a specialized task, not a first responder's primary duty, and powering off without capturing RAM is generally avoided.

Answer

Attempt to recover deleted files using forensic software on the live system

Answer

Power off the computer immediately to prevent data modification

Answer

Disconnect the computer from the network to stop remote access

Question 9

An organization receives a legal hold notice for a civil lawsuit. An employee later deletes relevant emails from their mailbox. Which legal principle is MOST likely violated?

Accepted Answer

Spoilation of evidence. The legal hold notice imposes a duty to preserve relevant evidence. Deleting emails after receiving such notice constitutes intentional destruction of evidence, which is spoliation. This violates the legal principle of spoliation of evidence, as the organization had a duty to preserve the emails for the pending litigation.

Answer

Best evidence rule

Answer

Locard's exchange principle

Answer

Probable cause

Question 10

Which TWO of the following are essential components of the forensic investigation process? (Select two.)

Accepted Answer

Analysis. Option D (Analysis) is correct because the forensic investigation process must include a technical examination of the collected data to determine what happened, how it happened, and which artifacts are relevant, making analysis a core investigative phase. Option E (Preservation) is correct because evidence must be safeguarded against alteration, loss, or contamination, typically through write blockers, hashing, and proper storage, so that the data remains forensically sound and admissible. Options A (Reporting), B (First response), and C (Chain of custody) are not among the two marked correct answers here, even though they are important supporting activities in many investigations; the question specifically requires the two essential components identified as Analysis and Preservation.

Answer

Reporting

Answer

First response

Answer

Chain of custody