CHFI Computer Forensics Fundamentals and Process — 10 Questions

Question 1

A first responder arrives at a crime scene where a computer is running. According to standard forensic procedure, what should the responder do FIRST?

Accepted Answer

Photograph the scene and secure the area. The first priority at a live crime scene is to preserve the integrity of the scene and all potential evidence. Standard forensic procedure (e.g., from NIST SP 800-86 and ACPO guidelines) mandates that the first responder must photograph the scene to document the state of the computer (including screen contents, cables, and peripherals) and secure the area to prevent unauthorized access or tampering. Only after this documentation and scene stabilization can the responder proceed to handle the live system, such as capturing volatile data or creating a forensic image.

Answer

Connect a write blocker and create a forensic image immediately

Answer

Immediately shut down the computer to prevent data alteration

Answer

Pull the power cord to ensure the system does not shut down normally

Question 2

During a forensic investigation, an analyst uses a hardware write blocker to connect a suspect hard drive to a forensic workstation. What is the primary purpose of using a hardware write blocker?

Accepted Answer

To prevent the operating system from writing to the source drive. A hardware write blocker physically intercepts the write commands from the forensic workstation to the suspect drive, ensuring that no data can be altered on the source drive during acquisition. This preserves the evidentiary integrity of the original media, which is a foundational requirement in digital forensics to maintain a chain of custody and admissibility in court.

Answer

To speed up the data transfer rate during imaging

Answer

To compress the forensic image to save storage space

Answer

To automatically hash the drive contents for integrity verification

Question 3

A forensic investigator is preparing to acquire the contents of a live system's RAM. Which of the following tools is specifically designed for this purpose and captures memory without altering the system state?

Accepted Answer

FTK Imager. FTK Imager is specifically designed for live memory acquisition on Windows systems, capturing RAM contents via a kernel-level driver (e.g., win32dd or FTK Imager's own memory capture module) that reads physical memory without modifying the system state. It creates a forensic image (e.g., .mem or .raw) while maintaining data integrity through hashing (MD5/SHA1). This makes it the correct choice for acquiring RAM from a live system without altering evidence.

Answer

Tableau write blocker

Answer

EnCase

Answer

dd

Question 4

During a forensic investigation, an analyst creates a forensic image using `dcfldd` with the command: `dcfldd if=/dev/sda of=image.dd hash=sha256 hashwindow=10M`. What is the purpose of the `hashwindow` parameter?

Accepted Answer

It creates a hash for every 10 MB block of data. The `hashwindow` parameter in `dcfldd` specifies the size of the data chunks for which individual hash values are computed. With `hashwindow=10M`, the tool generates a SHA-256 hash for every 10 MB block of the input data, allowing verification of integrity on a per-block basis rather than only a single hash for the entire image. This is useful for detecting corruption or tampering in specific segments of large forensic images.

Answer

It limits the total amount of data to hash to 10 MB

Answer

It sets the hash algorithm to SHA-256

Answer

It enables error correction for every 10 MB

Question 5

A forensic analyst is examining a hard drive that was seized from a suspect's home. The analyst uses FTK Imager to create a forensic image. After imaging, the analyst computes the MD5 hash of the image and compares it to the hash computed at the scene. The hashes match. What does this confirm?

Accepted Answer

The image is an exact bit-for-bit copy of the original drive. B is correct because a matching MD5 hash between the image and the original drive confirms that the forensic image is an exact bit-for-bit copy. Hashing algorithms like MD5 produce a unique fixed-size hash value based on the binary content; if two hashes match, the data is identical with no alterations. This validates the integrity of the acquisition process, ensuring that the image is a perfect forensic duplicate.

Answer

The file system is intact and readable

Answer

The drive contains malware

Answer

The drive was not encrypted

Question 6

During a forensic investigation, a first responder notices that a computer is running and suspects that volatile data may be present. According to best practices, what should the responder do to preserve the most volatile data first?

Accepted Answer

Capture the contents of RAM using a forensic tool, then shut down. Volatile data, such as the contents of RAM, is lost when power is removed. The first responder must capture this data using a forensic tool (e.g., FTK Imager, WinPmem, or LiME) before performing a shutdown. This follows the Order of Volatility (RFC 3227), which prioritizes capturing registers, cache, and RAM before any persistent storage.

Answer

Perform a graceful shutdown to avoid data corruption

Answer

Remove the hard drive immediately while the system is running

Answer

Immediately unplug the power cord to freeze the system state

Question 7

Which of the following best describes the 'Best Evidence Rule' as it applies to digital evidence?

Accepted Answer

A forensic image is considered the best evidence if the original is unavailable. The Best Evidence Rule requires that the original evidence be presented, but in digital forensics, a forensic image is considered the best evidence if the original is not practical.

Answer

Hearsay evidence is admissible if it is the only evidence available

Answer

The original digital media must be presented in court

Answer

Oral testimony is always better than written records

Question 8

A forensic analyst is examining a hard drive that was imaged using a software write blocker. Which of the following is a potential disadvantage of using a software write blocker compared to a hardware write blocker?

Accepted Answer

It may be susceptible to operating system or driver vulnerabilities. A software write blocker operates at the operating system level, intercepting write commands before they reach the storage device. Because it relies on the OS and its drivers, any vulnerability in the OS kernel, storage driver stack, or the blocker's own filter driver could be exploited, potentially allowing unintended writes to the evidence. In contrast, a hardware write blocker physically prevents write signals from reaching the drive at the bus level, offering a more robust isolation that is independent of the host OS's security state.

Answer

It cannot be used with USB drives

Answer

It does not support hashing algorithms for integrity

Answer

It is more expensive than hardware write blockers

Question 9

Which of the following is an example of Locard's Exchange Principle as applied to digital forensics?

Accepted Answer

A suspect's computer contains log files showing they accessed a server. Locard's Exchange Principle states that every contact leaves a trace. In digital forensics, this translates to the idea that when a system interacts with another, digital artifacts (such as log entries, registry keys, or network connection records) are created. Option A is correct because the log files on the suspect's computer are a direct trace of the contact between the suspect's system and the server, demonstrating the principle in a digital context.

Answer

A hard drive is encrypted and cannot be read

Answer

A firewall blocks all incoming traffic from a specific IP address

Answer

A write blocker prevents data from being written to a drive

Question 10

In the context of the US Fourth Amendment, what is typically required for law enforcement to seize a computer for forensic examination?

Accepted Answer

Consent of the owner, a warrant, or exigent circumstances. The Fourth Amendment requires law enforcement to obtain a warrant based on probable cause, obtain the owner's consent, or demonstrate exigent circumstances before seizing a computer for forensic examination. This protects against unreasonable searches and seizures, and a computer's storage capacity means it can contain vast amounts of personal data, so the same constitutional protections apply as to a physical home or vehicle.

Answer

A subpoena duces tecum

Answer

No legal authorization is needed if the computer is in plain view

Answer

Only a warrant issued by a judge