CHFI Computer Forensics Fundamentals and Process — 30 Questions

Question 1

A first responder arrives at a crime scene where a computer is running. According to standard forensic procedure, what should the responder do FIRST?

Accepted Answer

Photograph the scene and secure the area. Option A is correct because the first priority at a live crime scene is to preserve the integrity of the scene and all potential evidence. Standard forensic procedure (e.g., from NIST SP 800-86 and ACPO guidelines) mandates that the first responder must photograph the scene to document the state of the computer (including screen contents, cables, and peripherals) and secure the area to prevent unauthorized access or tampering. Only after this documentation and scene stabilization can the responder proceed to handle the live system, such as capturing volatile data or creating a forensic image.

Answer

Connect a write blocker and create a forensic image immediately

Answer

Immediately shut down the computer to prevent data alteration

Answer

Pull the power cord to ensure the system does not shut down normally

Question 2

During a forensic investigation, an analyst uses a hardware write blocker to connect a suspect hard drive to a forensic workstation. What is the primary purpose of using a hardware write blocker?

Accepted Answer

To prevent the operating system from writing to the source drive. A hardware write blocker physically intercepts the write commands from the forensic workstation to the suspect drive, ensuring that no data can be altered on the source drive during acquisition. This preserves the evidentiary integrity of the original media, which is a foundational requirement in digital forensics to maintain a chain of custody and admissibility in court.

Answer

To speed up the data transfer rate during imaging

Answer

To compress the forensic image to save storage space

Answer

To automatically hash the drive contents for integrity verification

Question 3

A forensic investigator is preparing to acquire the contents of a live system's RAM. Which of the following tools is specifically designed for this purpose and captures memory without altering the system state?

Accepted Answer

FTK Imager. FTK Imager is specifically designed for live memory acquisition on Windows systems, capturing RAM contents via a kernel-level driver (e.g., win32dd or FTK Imager's own memory capture module) that reads physical memory without modifying the system state. It creates a forensic image (e.g., .mem or .raw) while maintaining data integrity through hashing (MD5/SHA1). This makes it the correct choice for acquiring RAM from a live system without altering evidence.

Answer

Tableau write blocker

Answer

EnCase

Answer

dd

Question 4

During a forensic investigation, an analyst creates a forensic image using `dcfldd` with the command: `dcfldd if=/dev/sda of=image.dd hash=sha256 hashwindow=10M`. What is the purpose of the `hashwindow` parameter?

Accepted Answer

It creates a hash for every 10 MB block of data. The `hashwindow` parameter in `dcfldd` specifies the size of the data chunks for which individual hash values are computed. With `hashwindow=10M`, the tool generates a SHA-256 hash for every 10 MB block of the input data, allowing verification of integrity on a per-block basis rather than only a single hash for the entire image. This is useful for detecting corruption or tampering in specific segments of large forensic images.

Answer

It limits the total amount of data to hash to 10 MB

Answer

It sets the hash algorithm to SHA-256

Answer

It enables error correction for every 10 MB

Question 5

What is the primary goal of the chain of custody in a digital forensic investigation?

Accepted Answer

To maintain the integrity and admissibility of evidence. The chain of custody is a documented chronological record that tracks the seizure, custody, control, transfer, analysis, and disposition of digital evidence. Its primary goal is to maintain the integrity and admissibility of evidence by proving that the evidence has not been tampered with or altered from the moment it was collected until it is presented in court. This is critical because any break in the chain can lead to evidence being deemed inadmissible under rules like the Federal Rules of Evidence (FRE) or the Daubert standard.

Answer

To encrypt the evidence during transport

Answer

To speed up the forensic analysis process

Answer

To ensure that the forensic tools used are properly licensed

Question 6

A forensic analyst is examining a hard drive that was seized from a suspect's home. The analyst uses FTK Imager to create a forensic image. After imaging, the analyst computes the MD5 hash of the image and compares it to the hash computed at the scene. The hashes match. What does this confirm?

Accepted Answer

The image is an exact bit-for-bit copy of the original drive. B is correct because a matching MD5 hash between the image and the original drive confirms that the forensic image is an exact bit-for-bit copy. Hashing algorithms like MD5 produce a unique fixed-size hash value based on the binary content; if two hashes match, the data is identical with no alterations. This validates the integrity of the acquisition process, ensuring that the image is a perfect forensic duplicate.

Answer

The file system is intact and readable

Answer

The drive contains malware

Answer

The drive was not encrypted

Question 7

During a forensic investigation, a first responder notices that a computer is running and suspects that volatile data may be present. According to best practices, what should the responder do to preserve the most volatile data first?

Accepted Answer

Capture the contents of RAM using a forensic tool, then shut down. Option C is correct because volatile data, such as the contents of RAM, is lost when power is removed. The first responder must capture this data using a forensic tool (e.g., FTK Imager, WinPmem, or LiME) before performing a shutdown. This follows the Order of Volatility (RFC 3227), which prioritizes capturing registers, cache, and RAM before any persistent storage.

Answer

Perform a graceful shutdown to avoid data corruption

Answer

Remove the hard drive immediately while the system is running

Answer

Immediately unplug the power cord to freeze the system state

Question 8

Which of the following best describes the 'Best Evidence Rule' as it applies to digital evidence?

Accepted Answer

A forensic image is considered the best evidence if the original is unavailable. The Best Evidence Rule requires that the original evidence be presented, but in digital forensics, a forensic image is considered the best evidence if the original is not practical.

Answer

Hearsay evidence is admissible if it is the only evidence available

Answer

The original digital media must be presented in court

Answer

Oral testimony is always better than written records

Question 9

An organization receives a legal hold notice regarding pending litigation. The IT department is instructed to preserve all relevant electronically stored information. What is the primary action the IT department should take?

Accepted Answer

Place a hold on relevant data and suspend routine deletion policies. The primary action is to place a legal hold on relevant data and suspend routine deletion policies. This ensures that all potentially relevant electronically stored information (ESI) is preserved in its current state, preventing spoliation and compliance with the legal hold notice. Suspending deletion policies stops automated processes like email purge jobs or document retention schedules from destroying evidence, which is a foundational step in the e-discovery process.

Answer

Ignore the notice and continue normal operations

Answer

Create a forensic image of all servers immediately

Answer

Permanently delete all emails older than 30 days to reduce storage

Question 10

A forensic analyst is examining a hard drive that was imaged using a software write blocker. Which of the following is a potential disadvantage of using a software write blocker compared to a hardware write blocker?

Accepted Answer

It may be susceptible to operating system or driver vulnerabilities. A software write blocker operates at the operating system level, intercepting write commands before they reach the storage device. Because it relies on the OS and its drivers, any vulnerability in the OS kernel, storage driver stack, or the blocker's own filter driver could be exploited, potentially allowing unintended writes to the evidence. In contrast, a hardware write blocker physically prevents write signals from reaching the drive at the bus level, offering a more robust isolation that is independent of the host OS's security state.

Answer

It cannot be used with USB drives

Answer

It does not support hashing algorithms for integrity

Answer

It is more expensive than hardware write blockers

Question 11

Which of the following is an example of Locard's Exchange Principle as applied to digital forensics?

Accepted Answer

A suspect's computer contains log files showing they accessed a server. Locard's Exchange Principle states that every contact leaves a trace. In digital forensics, this translates to the idea that when a system interacts with another, digital artifacts (such as log entries, registry keys, or network connection records) are created. Option A is correct because the log files on the suspect's computer are a direct trace of the contact between the suspect's system and the server, demonstrating the principle in a digital context.

Answer

A hard drive is encrypted and cannot be read

Answer

A firewall blocks all incoming traffic from a specific IP address

Answer

A write blocker prevents data from being written to a drive

Question 12

In the context of the US Fourth Amendment, what is typically required for law enforcement to seize a computer for forensic examination?

Accepted Answer

Consent of the owner, a warrant, or exigent circumstances. Option C is correct because the Fourth Amendment requires law enforcement to obtain a warrant based on probable cause, obtain the owner's consent, or demonstrate exigent circumstances before seizing a computer for forensic examination. This protects against unreasonable searches and seizures, and a computer's storage capacity means it can contain vast amounts of personal data, so the same constitutional protections apply as to a physical home or vehicle.

Answer

A subpoena duces tecum

Answer

No legal authorization is needed if the computer is in plain view

Answer

Only a warrant issued by a judge

Question 13

Which TWO of the following are essential steps that a first responder should take when arriving at a digital crime scene? (Select TWO)

Accepted Answer

Capture volatile data from running systems. A is correct because volatile data (e.g., RAM contents, running processes, network connections) is lost when power is removed. A first responder must capture this data using tools like `dd` or `memdump` before shutting down the system, as it may contain encryption keys, active malware, or evidence of ongoing network activity.

Answer

Immediately start the forensic imaging process

Answer

Install forensic software on the suspect's computer

Answer

Interview all witnesses without documentation

Question 14

Which THREE of the following are considered rules of evidence that digital evidence must satisfy to be admissible in court? (Select THREE)

Accepted Answer

Authenticity. Authenticity (B) is a core rule of evidence because the court must be assured that the digital evidence is exactly what it purports to be and has not been tampered with. This is typically established through cryptographic hash verification (e.g., SHA-256) and a documented chain of custody. Without authenticity, the evidence could be challenged as fabricated or altered, rendering it inadmissible.

Answer

Best evidence

Answer

Hearsay

Question 15

Which TWO of the following are valid justifications for a first responder to power off a computer at a crime scene? (Select TWO)

Accepted Answer

The computer is destroying evidence (e.g., running a data wiping program). Option C is correct because if a computer is actively running a data wiping program (e.g., a tool that overwrites storage sectors with zeros or random data), leaving it powered on will cause the irreversible destruction of potential evidence. A first responder must immediately cut power to halt the wiping process and preserve the remaining data, as volatile memory (RAM) is not the primary concern in this scenario—the non-volatile storage is being actively sanitized.

Answer

To prevent the computer from overheating

Answer

To save time during the investigation

Answer

The computer is actively being used to commit a crime

Question 16

What is the primary goal of computer forensics?

Accepted Answer

To preserve and analyze digital evidence in a legally admissible manner. The primary goal of computer forensics is to preserve and analyze digital evidence in a manner that is legally admissible in court.

Answer

To prevent future cyber attacks

Answer

To identify and prosecute cybercriminals

Answer

To recover deleted files from a hard drive

Question 17

Which principle states that every contact leaves a trace?

Accepted Answer

Locard's exchange principle. Locard's exchange principle is the foundational forensic concept stating that whenever two objects come into contact, there is a transfer of material between them. In computer forensics, this means that digital activity—such as accessing a file, sending a packet, or connecting to a network—inevitably leaves traces in logs, memory, registry entries, or file metadata. This principle underpins the entire discipline of digital evidence recovery.

Answer

Chain of custody

Answer

Best evidence rule

Answer

Hearsay rule

Question 18

A first responder arrives at a crime scene where a computer is turned on. What should the responder do FIRST?

Accepted Answer

Photograph the scene and document everything. Option D is correct because the first priority at a live crime scene is to preserve the state of the evidence through proper documentation and photography. This ensures an accurate record of the computer's condition, including screen contents, peripheral connections, and environmental context, before any volatile data is lost or altered. The CHFI methodology emphasizes that documentation precedes any seizure or data acquisition steps to maintain chain of custody and evidentiary integrity.

Answer

Run antivirus software to check for malware

Answer

Immediately disconnect the power cord

Answer

Copy all files from the hard drive

Question 19

During a forensic investigation, an analyst creates a bit-for-bit copy of a suspect's hard drive using the 'dd' command with the following parameters: dd if=/dev/sda of=/evidence/image.dd bs=4k conv=noerror,sync. What is the purpose of 'conv=noerror,sync'?

Accepted Answer

To ignore read errors and pad with zeros. Option C is correct because 'conv=noerror,sync' tells dd to continue reading even when encountering read errors (noerror) and to pad the output with zeros (sync) to maintain the same total size as the original drive. This ensures a complete forensic image is created despite bad sectors, preserving the integrity of the acquisition for analysis.

Answer

To hash the output image

Answer

To ensure the command runs with superuser privileges

Answer

To compress the output image

Question 20

Which type of evidence is a witness's statement that they saw someone log into a computer?

Accepted Answer

Direct evidence. Direct evidence is testimony or other proof that directly proves a fact without requiring any inference. A witness's statement that they saw someone log into a computer is direct evidence because it is based on the witness's firsthand observation of the act itself, not on any deduction or assumption. In digital forensics, direct evidence can include eyewitness accounts of specific actions on a system, such as entering credentials or accessing files.

Answer

Hearsay evidence

Answer

Best evidence

Answer

Circumstantial evidence