CHFI Computer Forensics Fundamentals and Process — 50 Questions

Question 1

A first responder arrives at a crime scene where a computer is running. According to standard forensic procedure, what should the responder do FIRST?

Accepted Answer

Photograph the scene and secure the area. The first priority at a live crime scene is to preserve the integrity of the scene and all potential evidence. Standard forensic procedure (e.g., from NIST SP 800-86 and ACPO guidelines) mandates that the first responder must photograph the scene to document the state of the computer (including screen contents, cables, and peripherals) and secure the area to prevent unauthorized access or tampering. Only after this documentation and scene stabilization can the responder proceed to handle the live system, such as capturing volatile data or creating a forensic image.

Answer

Connect a write blocker and create a forensic image immediately

Answer

Immediately shut down the computer to prevent data alteration

Answer

Pull the power cord to ensure the system does not shut down normally

Question 2

During a forensic investigation, an analyst uses a hardware write blocker to connect a suspect hard drive to a forensic workstation. What is the primary purpose of using a hardware write blocker?

Accepted Answer

To prevent the operating system from writing to the source drive. A hardware write blocker physically intercepts the write commands from the forensic workstation to the suspect drive, ensuring that no data can be altered on the source drive during acquisition. This preserves the evidentiary integrity of the original media, which is a foundational requirement in digital forensics to maintain a chain of custody and admissibility in court.

Answer

To speed up the data transfer rate during imaging

Answer

To compress the forensic image to save storage space

Answer

To automatically hash the drive contents for integrity verification

Question 3

A forensic investigator is preparing to acquire the contents of a live system's RAM. Which of the following tools is specifically designed for this purpose and captures memory without altering the system state?

Accepted Answer

FTK Imager. FTK Imager is specifically designed for live memory acquisition on Windows systems, capturing RAM contents via a kernel-level driver (e.g., win32dd or FTK Imager's own memory capture module) that reads physical memory without modifying the system state. It creates a forensic image (e.g., .mem or .raw) while maintaining data integrity through hashing (MD5/SHA1). This makes it the correct choice for acquiring RAM from a live system without altering evidence.

Answer

Tableau write blocker

Answer

EnCase

Answer

dd

Question 4

During a forensic investigation, an analyst creates a forensic image using `dcfldd` with the command: `dcfldd if=/dev/sda of=image.dd hash=sha256 hashwindow=10M`. What is the purpose of the `hashwindow` parameter?

Accepted Answer

It creates a hash for every 10 MB block of data. The `hashwindow` parameter in `dcfldd` specifies the size of the data chunks for which individual hash values are computed. With `hashwindow=10M`, the tool generates a SHA-256 hash for every 10 MB block of the input data, allowing verification of integrity on a per-block basis rather than only a single hash for the entire image. This is useful for detecting corruption or tampering in specific segments of large forensic images.

Answer

It limits the total amount of data to hash to 10 MB

Answer

It sets the hash algorithm to SHA-256

Answer

It enables error correction for every 10 MB

Question 5

A forensic analyst is examining a hard drive that was seized from a suspect's home. The analyst uses FTK Imager to create a forensic image. After imaging, the analyst computes the MD5 hash of the image and compares it to the hash computed at the scene. The hashes match. What does this confirm?

Accepted Answer

The image is an exact bit-for-bit copy of the original drive. B is correct because a matching MD5 hash between the image and the original drive confirms that the forensic image is an exact bit-for-bit copy. Hashing algorithms like MD5 produce a unique fixed-size hash value based on the binary content; if two hashes match, the data is identical with no alterations. This validates the integrity of the acquisition process, ensuring that the image is a perfect forensic duplicate.

Answer

The file system is intact and readable

Answer

The drive contains malware

Answer

The drive was not encrypted

Question 6

During a forensic investigation, a first responder notices that a computer is running and suspects that volatile data may be present. According to best practices, what should the responder do to preserve the most volatile data first?

Accepted Answer

Capture the contents of RAM using a forensic tool, then shut down. Volatile data, such as the contents of RAM, is lost when power is removed. The first responder must capture this data using a forensic tool (e.g., FTK Imager, WinPmem, or LiME) before performing a shutdown. This follows the Order of Volatility (RFC 3227), which prioritizes capturing registers, cache, and RAM before any persistent storage.

Answer

Perform a graceful shutdown to avoid data corruption

Answer

Remove the hard drive immediately while the system is running

Answer

Immediately unplug the power cord to freeze the system state

Question 7

Which of the following best describes the 'Best Evidence Rule' as it applies to digital evidence?

Accepted Answer

A forensic image is considered the best evidence if the original is unavailable. The Best Evidence Rule requires that the original evidence be presented, but in digital forensics, a forensic image is considered the best evidence if the original is not practical.

Answer

Hearsay evidence is admissible if it is the only evidence available

Answer

The original digital media must be presented in court

Answer

Oral testimony is always better than written records

Question 8

A forensic analyst is examining a hard drive that was imaged using a software write blocker. Which of the following is a potential disadvantage of using a software write blocker compared to a hardware write blocker?

Accepted Answer

It may be susceptible to operating system or driver vulnerabilities. A software write blocker operates at the operating system level, intercepting write commands before they reach the storage device. Because it relies on the OS and its drivers, any vulnerability in the OS kernel, storage driver stack, or the blocker's own filter driver could be exploited, potentially allowing unintended writes to the evidence. In contrast, a hardware write blocker physically prevents write signals from reaching the drive at the bus level, offering a more robust isolation that is independent of the host OS's security state.

Answer

It cannot be used with USB drives

Answer

It does not support hashing algorithms for integrity

Answer

It is more expensive than hardware write blockers

Question 9

Which of the following is an example of Locard's Exchange Principle as applied to digital forensics?

Accepted Answer

A suspect's computer contains log files showing they accessed a server. Locard's Exchange Principle states that every contact leaves a trace. In digital forensics, this translates to the idea that when a system interacts with another, digital artifacts (such as log entries, registry keys, or network connection records) are created. Option A is correct because the log files on the suspect's computer are a direct trace of the contact between the suspect's system and the server, demonstrating the principle in a digital context.

Answer

A hard drive is encrypted and cannot be read

Answer

A firewall blocks all incoming traffic from a specific IP address

Answer

A write blocker prevents data from being written to a drive

Question 10

In the context of the US Fourth Amendment, what is typically required for law enforcement to seize a computer for forensic examination?

Accepted Answer

Consent of the owner, a warrant, or exigent circumstances. The Fourth Amendment requires law enforcement to obtain a warrant based on probable cause, obtain the owner's consent, or demonstrate exigent circumstances before seizing a computer for forensic examination. This protects against unreasonable searches and seizures, and a computer's storage capacity means it can contain vast amounts of personal data, so the same constitutional protections apply as to a physical home or vehicle.

Answer

A subpoena duces tecum

Answer

No legal authorization is needed if the computer is in plain view

Answer

Only a warrant issued by a judge

Question 11

Which TWO of the following are essential steps that a first responder should take when arriving at a digital crime scene? (Select TWO)

Accepted Answer

Capture volatile data from running systems. A is correct because volatile data (e.g., RAM contents, running processes, network connections) is lost when power is removed. A first responder must capture this data using tools like `dd` or `memdump` before shutting down the system, as it may contain encryption keys, active malware, or evidence of ongoing network activity.

Answer

Immediately start the forensic imaging process

Answer

Install forensic software on the suspect's computer

Answer

Interview all witnesses without documentation

Question 12

Which THREE of the following are considered rules of evidence that digital evidence must satisfy to be admissible in court? (Select THREE)

Accepted Answer

Authenticity. Authenticity (B) is a core rule of evidence because the court must be assured that the digital evidence is exactly what it purports to be and has not been tampered with. This is typically established through cryptographic hash verification (e.g., SHA-256) and a documented chain of custody. Without authenticity, the evidence could be challenged as fabricated or altered, rendering it inadmissible.

Answer

Best evidence

Answer

Hearsay

Question 13

What is the primary goal of computer forensics?

Accepted Answer

To preserve and analyze digital evidence in a legally admissible manner. The primary goal of computer forensics is to preserve and analyze digital evidence in a manner that is legally admissible in court.

Answer

To prevent future cyber attacks

Answer

To identify and prosecute cybercriminals

Answer

To recover deleted files from a hard drive

Question 14

Which principle states that every contact leaves a trace?

Accepted Answer

Locard's exchange principle. Locard's exchange principle is the foundational forensic concept stating that whenever two objects come into contact, there is a transfer of material between them. In computer forensics, this means that digital activity—such as accessing a file, sending a packet, or connecting to a network—inevitably leaves traces in logs, memory, registry entries, or file metadata. This principle underpins the entire discipline of digital evidence recovery.

Answer

Chain of custody

Answer

Best evidence rule

Answer

Hearsay rule

Question 15

A first responder arrives at a crime scene where a computer is turned on. What should the responder do FIRST?

Accepted Answer

Photograph the scene and document everything. The first priority at a live crime scene is to preserve the state of the evidence through proper documentation and photography. This ensures an accurate record of the computer's condition, including screen contents, peripheral connections, and environmental context, before any volatile data is lost or altered. The CHFI methodology emphasizes that documentation precedes any seizure or data acquisition steps to maintain chain of custody and evidentiary integrity.

Answer

Run antivirus software to check for malware

Answer

Immediately disconnect the power cord

Answer

Copy all files from the hard drive

Question 16

During a forensic investigation, an analyst creates a bit-for-bit copy of a suspect's hard drive using the 'dd' command with the following parameters: dd if=/dev/sda of=/evidence/image.dd bs=4k conv=noerror,sync. What is the purpose of 'conv=noerror,sync'?

Accepted Answer

To ignore read errors and pad with zeros. 'conv=noerror,sync' tells dd to continue reading even when encountering read errors (noerror) and to pad the output with zeros (sync) to maintain the same total size as the original drive. This ensures a complete forensic image is created despite bad sectors, preserving the integrity of the acquisition for analysis.

Answer

To hash the output image

Answer

To ensure the command runs with superuser privileges

Answer

To compress the output image

Question 17

A forensic analyst needs to collect evidence from a running Windows system without altering the system state. Which tool should they use to acquire volatile memory?

Accepted Answer

DumpIt. DumpIt is a lightweight memory acquisition tool designed specifically for capturing the contents of volatile memory (RAM) on a running Windows system. It minimizes interaction with the system to avoid altering the memory state, making it ideal for forensic collection of live evidence.

Answer

Wireshark

Answer

dd

Answer

Tableau write blocker

Question 18

During an investigation, an analyst creates a forensic image of a hard drive using FTK Imager and computes the MD5 hash of the image. Later, the hash is re-computed and found to match. What does this confirm?

Accepted Answer

The image is an exact copy and has not been altered. A matching MD5 hash confirms that the forensic image is bit-for-bit identical to the original drive at the time of acquisition and has not been modified since. MD5 is a cryptographic hash function that produces a 128-bit digest; any change to the image, even a single bit, would produce a completely different hash. This integrity verification is a foundational step in the forensic process to ensure the evidence is admissible and untampered.

Answer

FTK Imager is a valid forensic tool

Answer

The original hard drive is free of malware

Answer

The image was acquired without using a write blocker

Question 19

A security analyst discovers unauthorized access to a server. The incident response team decides to preserve evidence. Which of the following actions is MOST critical to ensure the admissibility of evidence in court?

Accepted Answer

Documenting the chain of custody. Chain of custody documentation is the most critical action for evidence admissibility because it establishes a verifiable record of who handled the evidence, when, and under what conditions, ensuring the evidence has not been tampered with. Without a proper chain of custody, even technically sound evidence can be ruled inadmissible under rules like Federal Rule of Evidence 901. In forensic practice, this involves logging every access with timestamps, digital signatures, and hash values (e.g., SHA-256) to maintain integrity.

Answer

Disconnecting the server from the network

Answer

Running a full antivirus scan on the server

Answer

Taking screenshots of the server's screen

Question 20

In a UK-based investigation, the police seize a computer without a warrant. The suspect's lawyer argues that the evidence is inadmissible because it violates which law?

Accepted Answer

Police and Criminal Evidence Act (PACE). The Police and Criminal Evidence Act (PACE) 1984 governs the powers of police in England and Wales to search, seize, and retain evidence. Without a warrant, the seizure of a computer likely violates PACE's requirements for lawful entry and seizure, making the evidence inadmissible under UK law.

Answer

Fourth Amendment to the US Constitution

Answer

General Data Protection Regulation (GDPR)

Answer

Computer Misuse Act