CHFI Computer Forensics Fundamentals and Process — 25 Questions

Question 1

A forensic investigator is preparing to acquire the contents of a live system's RAM. Which of the following tools is specifically designed for this purpose and captures memory without altering the system state?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

FTK Imager. FTK Imager is specifically designed for live memory acquisition on Windows systems, capturing RAM contents via a kernel-level driver (e.g., win32dd or FTK Imager's own memory capture module) that reads physical memory without modifying the system state. It creates a forensic image (e.g., .mem or .raw) while maintaining data integrity through hashing (MD5/SHA1). This makes it the correct choice for acquiring RAM from a live system without altering evidence.

Answer

Tableau write blocker

Answer

EnCase

Answer

dd

Question 2

Which of the following best describes the 'Best Evidence Rule' as it applies to digital evidence?

Accepted Answer

A forensic image is considered the best evidence if the original is unavailable. The Best Evidence Rule requires that the original evidence be presented, but in digital forensics, a forensic image is considered the best evidence if the original is not practical.

Answer

Hearsay evidence is admissible if it is the only evidence available

Answer

The original digital media must be presented in court

Answer

Oral testimony is always better than written records

Question 3

Which THREE of the following are considered rules of evidence that digital evidence must satisfy to be admissible in court? (Select THREE)

Accepted Answer

Authenticity. Authenticity (B) is a core rule of evidence: digital evidence must be shown to be what it purports to be, typically via hash values (e.g., MD5/SHA-256), chain of custody, and witness testimony, so it is correctly included. Completeness (D) is also a recognized evidentiary rule requiring that when part of a recording, file, or communication is introduced, the opposing party may require introduction of any other part needed in fairness, so it is correct. Admissibility (E) is the overarching requirement that evidence be relevant, material, and not excluded by rules such as hearsay or privilege before the court will accept it, making it correct. Best evidence (A) is a real doctrine but it is not one of the three rules listed here as the selected set, and Hearsay (C) is an exclusionary rule rather than a rule digital evidence must satisfy, so neither belongs among the marked correct answers.

Answer

Best evidence

Answer

Hearsay

Question 4

During an investigation, an analyst creates a forensic image of a hard drive using FTK Imager and computes the MD5 hash of the image. Later, the hash is re-computed and found to match. What does this confirm?

Accepted Answer

The image is an exact copy and has not been altered. A matching MD5 hash confirms that the forensic image is bit-for-bit identical to the original drive at the time of acquisition and has not been modified since. MD5 is a cryptographic hash function that produces a 128-bit digest; any change to the image, even a single bit, would produce a completely different hash. This integrity verification is a foundational step in the forensic process to ensure the evidence is admissible and untampered.

Answer

FTK Imager is a valid forensic tool

Answer

The original hard drive is free of malware

Answer

The image was acquired without using a write blocker

Question 5

A first responder arrives at a scene where a computer is powered on and the user is present. According to standard forensic first responder procedures, what should the responder do FIRST?

Accepted Answer

Photograph the scene and document the system state. The first priority at a live scene is to preserve volatile evidence and establish a chain of custody. Photographing the scene and documenting the system state (e.g., running processes, open network connections, logged-in users) captures critical volatile data before any action is taken. This aligns with the order of volatility (RFC 3227), which mandates capturing memory and system state before altering the system.

Answer

Boot the system from a forensic USB to create a memory dump

Answer

Immediately disconnect the power cord to preserve the hard drive

Answer

Ask the user to log out so the system can be powered off safely

Question 6

In a UK-based investigation under the Police and Criminal Evidence Act (PACE), a forensic examiner is asked to seize computers from a business premises. Which of the following actions is MOST compliant with PACE requirements?

Accepted Answer

Seize only items that are specified in the search warrant and provide a receipt. PACE requires that during a search under warrant, only items specified in the warrant may be seized, and a receipt must be provided to the occupier. This ensures legal compliance, chain of custody, and respect for property rights, which are fundamental to admissible digital evidence.

Answer

Conduct a forensic analysis at the scene to determine relevance before seizure

Answer

Copy all data on-site and delete the originals to avoid leaving evidence behind

Answer

Enter the premises without a warrant because evidence may be destroyed

Question 7

In the context of US Fourth Amendment protections, which of the following scenarios would likely require a search warrant for a forensic examiner to legally seize and analyze a computer?

Accepted Answer

The computer is located in a private residence and there is no exigent circumstance. The Fourth Amendment requires a warrant for searches and seizures unless an exception applies. A computer in a private residence with no exigent circumstances (Option A) clearly requires a warrant. For a computer in plain view in a public area (Option B), the seizure itself may be lawful under the plain view doctrine, but the subsequent forensic analysis constitutes a separate search of digital data with a reasonable expectation of privacy, and therefore requires a warrant or an applicable exception. Consent (C) and regulatory inspection (D) are exceptions that may not require a warrant.

Answer

The computer's owner gives voluntary consent to search the device

Answer

The computer is seized from a business during a regulatory inspection with statutory authority

Question 8

Which TWO of the following are essential duties of a first responder at a digital crime scene? (Select two.)

Accepted Answer

Photograph the scene including the screen, connections, and surrounding area. First responders must secure the scene, document everything, preserve evidence, and avoid altering the system state. Photographing the scene and using a write blocker to image are correct; collecting volatile memory is a specialized task, not a first responder's primary duty, and powering off without capturing RAM is generally avoided.

Answer

Attempt to recover deleted files using forensic software on the live system

Answer

Power off the computer immediately to prevent data modification

Answer

Disconnect the computer from the network to stop remote access

Question 9

An organization receives a legal hold notice for a civil lawsuit. An employee later deletes relevant emails from their mailbox. Which legal principle is MOST likely violated?

Accepted Answer

Spoilation of evidence. The legal hold notice imposes a duty to preserve relevant evidence. Deleting emails after receiving such notice constitutes intentional destruction of evidence, which is spoliation. This violates the legal principle of spoliation of evidence, as the organization had a duty to preserve the emails for the pending litigation.

Answer

Best evidence rule

Answer

Locard's exchange principle

Answer

Probable cause

Question 10

Which TWO of the following are essential components of the forensic investigation process? (Select two.)

Accepted Answer

Analysis. Option D (Analysis) is correct because the forensic investigation process must include a technical examination of the collected data to determine what happened, how it happened, and which artifacts are relevant, making analysis a core investigative phase. Option E (Preservation) is correct because evidence must be safeguarded against alteration, loss, or contamination, typically through write blockers, hashing, and proper storage, so that the data remains forensically sound and admissible. Options A (Reporting), B (First response), and C (Chain of custody) are not among the two marked correct answers here, even though they are important supporting activities in many investigations; the question specifically requires the two essential components identified as Analysis and Preservation.

Answer

Reporting

Answer

First response

Answer

Chain of custody

Question 11

Which THREE of the following are valid rules of evidence that digital evidence must satisfy to be admissible in court? (Select three.)

Accepted Answer

Admissibility. Option B (Admissibility) is correct because digital evidence must be relevant, material, and obtained legally to be accepted by the court, meaning it must fall within an exception to hearsay and not violate exclusionary rules. Option D (Authenticity) is correct because the proponent must show the evidence is what it claims to be, typically through hashing (e.g., MD5/SHA-256), metadata, or witness testimony, satisfying Federal Rule of Evidence 901. Option E (Completeness) is correct because the rule of completeness requires that when part of a recording or document is introduced, the opposing party may require the introduction of any other part that ought in fairness to be considered, preventing misleading excerpts. Option A (Best evidence rule) is not among the marked correct answers here, and option C (Chain of custody) is likewise not marked, even though both are important evidentiary concepts; the question specifically asks for the three rules marked as correct, so they are excluded from this justification.

Answer

Best evidence rule

Answer

Chain of custody

Question 12

Which TWO of the following are types of evidence recognized in legal proceedings? (Select two.)

Accepted Answer

Direct evidence. Direct evidence (B) is recognized in legal proceedings because it directly proves a fact in issue without requiring an inference — for example, an eyewitness testifying to what they personally saw, or a forensic examiner stating a hard drive contained contraband. Circumstantial evidence (D) is also a recognized type; it proves a fact indirectly by inference, such as showing a suspect's login credentials were used to access a system at the time of the breach, from which the actor's involvement may be inferred. Both are standard evidentiary categories used in court and in digital forensics reporting. The other options are not among the two recognized types tested here: corroborative evidence (A) supports or strengthens other evidence rather than being a distinct recognized type in this context, demonstrative evidence (C) is a presentation aid such as a diagram or model, and primary evidence (E) is a term from documentary-evidence rules referring to the original document, not one of the two types called for.

Answer

Corroborative evidence

Answer

Demonstrative evidence

Answer

Primary evidence

Question 13

Which TWO of the following are essential components of the rules of evidence for digital evidence to be admissible in court? (Choose two.)

Accepted Answer

Authenticity. Option A (Authenticity) is correct because digital evidence must be proven to be what it purports to be—that the artifact, file, or log genuinely originated from the source claimed and has not been altered or substituted, typically established through hash values (e.g., MD5/SHA-256), chain of custody, and witness testimony. Option D (Admissibility) is correct because evidence must satisfy the legal rules and standards the court applies—relevance, reliability, and compliance with statutes or precedents—before the judge will allow it to be presented to the trier of fact. The unmarked options do not belong: Originality is not a standalone evidentiary requirement, since copies and forensic images are routinely admissible when properly authenticated; Expediency concerns convenience or speed, not legal validity; and Complexity is irrelevant to whether evidence meets the rules of evidence.

Answer

Originality

Answer

Expediency

Answer

Complexity

Question 14

Which THREE of the following are considered types of evidence under the rules of evidence? (Choose three.)

Accepted Answer

Circumstantial evidence. Under the rules of evidence, circumstantial evidence (C) is a recognized type of evidence because it proves a fact indirectly by inference from other facts, such as fingerprints or motive linking a suspect to a crime. Direct evidence (D) is also a recognized type because it directly proves a fact without inference, such as eyewitness testimony or a confession. Hearsay evidence (E) is likewise a recognized evidentiary category, defined as an out-of-court statement offered to prove the truth of the matter asserted, and it is governed by specific admissibility rules and exceptions. Corroborating evidence (A) is not a distinct type of evidence but rather describes evidence that supports or strengthens other evidence already presented. Best evidence (B) is not a type of evidence either; it is a rule (the best evidence rule) requiring the original writing, recording, or photograph to prove its content.

Answer

Corroborating evidence

Answer

Best evidence

Question 15

In a legal context, which rule of evidence requires that the evidence presented be sufficient to prove a fact and not be misleading?

Accepted Answer

Completeness. The question asks for a rule of evidence requiring evidence to be 'sufficient to prove a fact and not be misleading.' This is the definition of Completeness in evidence law (e.g., FRE 106), which allows introduction of omitted portions to avoid misleading the trier of fact. Reliability, on the other hand, concerns trustworthiness/accuracy (e.g., Daubert for expert testimony), not sufficiency or completeness. The explanation incorrectly invokes FRE 403, which is about excluding evidence for prejudice/confusion/misleading, not requiring evidence to be sufficient or complete.

Answer

Reliability

Answer

Admissibility

Answer

Authenticity

Question 16

During a forensic investigation, an examiner finds a log entry: 'User JohnDoe accessed file contract.pdf at 10:32:45 AM'. This log is considered which type of evidence?

Accepted Answer

Direct evidence. The log entry directly states that User JohnDoe accessed contract.pdf at a specific time, which is a firsthand account of the event without requiring inference. In digital forensics, direct evidence is evidence that, if believed, proves a fact without any additional reasoning or presumption. This log is a direct record of the user's action, making it direct evidence.

Answer

Circumstantial evidence

Answer

Hearsay

Answer

Best evidence

Question 17

Which TWO of the following are legal frameworks or regulations that govern search and seizure of digital evidence in the United Kingdom?

Accepted Answer

PACE (Police and Criminal Evidence Act). PACE (Police and Criminal Evidence Act) is correct because it is the core UK statutory framework setting out police powers of search, seizure, arrest, and detention in England and Wales, including provisions for obtaining search warrants and seizing digital evidence. GDPR is correct because, as retained in UK law via the Data Protection Act 2018 (UK GDPR), it governs the lawful processing, handling, and transfer of personal data encountered during digital evidence seizure, imposing requirements on law enforcement and forensic examiners. The Computer Fraud and Abuse Act (CFAA) is a US federal statute criminalizing unauthorized computer access, so it does not govern UK search and seizure. The Fourth Amendment to the US Constitution protects against unreasonable searches and seizures but applies only to US government action, not UK proceedings. The Sarbanes-Oxley Act (SOX) is US corporate financial reporting and accounting legislation and has no bearing on UK digital evidence seizure.

Answer

Computer Fraud and Abuse Act (CFAA)

Answer

Fourth Amendment to the US Constitution

Answer

Sarbanes-Oxley Act (SOX)

Question 18

Which TWO of the following are considered types of evidence under the rules of evidence?

Accepted Answer

Direct evidence. Direct evidence (Option B) is a type of evidence under the rules of evidence because it directly proves a fact without requiring any inference or presumption. In computer forensics, this could include a log entry showing an unauthorized login from a specific IP address at a specific time, which directly proves the fact of access. The rules of evidence recognize direct evidence as primary proof that stands on its own.

Answer

Best evidence rule

Answer

Hearsay evidence

Answer

Exculpatory evidence

Question 19

What is the primary goal of computer forensics?

Accepted Answer

To identify, preserve, analyze, and present digital evidence in a legally acceptable manner. The primary goal of computer forensics is to identify, preserve, analyze, and present digital evidence in a legally acceptable manner. This ensures that evidence is admissible in court, following strict chain-of-custody and forensic soundness principles. While prosecution may be an outcome, the core objective is the lawful handling of evidence, not conviction itself.

Answer

To prosecute cybercriminals

Answer

To recover deleted files for data recovery

Answer

To secure the network from future attacks

Question 20

A first responder arrives at a scene where a computer is on and logged in. There is a suspicion that the system contains volatile data that may be crucial to the investigation. According to best practices, what should the first responder do?

Accepted Answer

Collect volatile data using tools like FTK Imager or dd. Volatile data (e.g., RAM contents, network connections, running processes) is lost when the system loses power. FTK Imager or dd can capture a bit-for-bit image of memory and live system state while the computer remains on, preserving evidence that would otherwise vanish. This aligns with the order of volatility (RFC 3227), which prioritizes capturing volatile data before any other action.

Answer

Immediately pull the power cord to preserve the hard drive

Answer

Place the system in a Faraday bag and transport to lab

Answer

Take photos and then shut down normally