CHFI Computer Forensics Fundamentals and Process Practice Test 10 — 15 Questions

Question 1

A legal hold is issued by an organization's legal department. What is the primary purpose of a legal hold?

Accepted Answer

To preserve all relevant data that may be needed for a legal case. A legal hold is a directive issued by an organization's legal department to suspend the routine deletion or alteration of data that may be relevant to pending or reasonably anticipated litigation. Its primary purpose is to preserve all potentially relevant electronically stored information (ESI) and physical records in their current state, ensuring spoliation does not occur. This obligation arises under the Federal Rules of Civil Procedure (FRCP) Rule 37(e) and similar e-discovery regulations, which require organizations to take reasonable steps to preserve data once litigation is reasonably anticipated.

Answer

To notify employees that litigation is pending

Answer

To authorize law enforcement to seize computers

Answer

To encrypt all company data for security

Question 2

During a forensic investigation, the analyst needs to verify the integrity of a forensic image. The analyst originally computed MD5 and SHA-1 hashes of the source drive. Which action BEST ensures the image has not been altered?

Accepted Answer

Recompute MD5 and SHA-1 hashes of the image and compare with the original. Recomputing the MD5 and SHA-1 hashes of the forensic image and comparing them to the original values is the definitive method to verify integrity. Hash functions produce a fixed-size digest that changes completely if even a single bit of the image is altered, providing cryptographic assurance that the image is an exact bit-for-bit copy of the source drive. This process directly validates data integrity, which is a core requirement in forensic acquisition.

Answer

Check that the image was created using a write blocker

Answer

Compare the file size of the image with the original drive's capacity

Answer

Open the image in FTK Imager and browse a few files

Question 3

In the context of the UK Police and Criminal Evidence Act (PACE), which of the following is a key requirement for the admissibility of digital evidence?

Accepted Answer

The evidence must be obtained lawfully and without oppression. PACE requires that evidence is not obtained through oppression or in violation of legal procedures, ensuring reliability and fairness.

Answer

The evidence must be stored on a write-protected medium

Answer

The evidence must be reviewed by an independent third party

Answer

The evidence must be encrypted at all times

Question 4

Which TWO of the following are essential components of a proper chain of custody documentation? (Select TWO.)

Accepted Answer

Date and time of each evidence transfer. Option B is correct because chain of custody documentation must record the date and time of every transfer of evidence, establishing an auditable timeline that proves the evidence was continuously accounted for from seizure to presentation. Option C is correct because each person who handled or transferred the evidence must sign for it, creating individual accountability and showing an unbroken sequence of custody. Together, these entries let investigators demonstrate that the evidence was not tampered with or substituted. Option A is not essential to the chain of custody itself, since the suspect's identity does not establish who controlled the evidence. Option D is irrelevant because the OS version of the suspect's computer is a technical artifact detail, not a custody record. Option E is likewise irrelevant, as the forensic workstation's IP address does not document the handling or transfer of evidence.

Answer

The name of the suspect

Answer

The operating system version of the suspect's computer

Answer

The IP address of the forensic workstation

Question 5

A first responder arrives at a suspected data breach scene. The system is powered on and a user is logged in. Which of the following actions should the responder take FIRST to preserve volatile data?

Accepted Answer

Collect volatile data such as RAM, network connections, and running processes using appropriate tools.. Volatile data (RAM, network connections, running processes) is lost when power is removed. The first responder must capture this data using tools like FTK Imager, WinPmem, or netstat before any shutdown or disconnection. This aligns with the order of volatility (RFC 3227), which prioritizes memory and network state over disk imaging.

Answer

Document the scene and take photographs, then proceed to interview witnesses.

Answer

Immediately disconnect the network cable and power off the computer.

Answer

Use a hardware write-blocker to create a forensic image of the hard drive.

Question 6

Which of the following is the PRIMARY purpose of using a write blocker in computer forensics?

Accepted Answer

To prevent any modification to the original evidence drive during acquisition.. A write blocker ensures that no data is written to the original evidence drive during acquisition, maintaining its integrity.

Answer

To speed up the imaging process by caching writes.

Answer

To convert the hard drive interface from SATA to USB.

Answer

To encrypt the forensic image for secure transport.

Question 7

During a forensic examination, an analyst runs the following command: 'dd if=/dev/sda of=/mnt/evidence/image.dd bs=4k conv=noerror,sync'. The source drive has bad sectors. What is the effect of the 'conv=noerror,sync' option?

Accepted Answer

It fills the bad sectors with zeros in the output image, allowing the imaging to complete without errors.. The 'conv=noerror,sync' option in dd instructs the tool to continue reading even when encountering read errors (noerror) and to pad the output with zeros (sync) to maintain the original block size alignment. This ensures the forensic image is a complete bit-for-bit copy of the source drive, with bad sectors replaced by zeros, allowing the imaging process to finish without halting on errors.

Answer

It stops the imaging process when an error is encountered.

Answer

It skips the bad sectors and compresses the output.

Answer

It retries reading the bad sector multiple times before giving up.

Question 8

An organization receives a litigation hold notice regarding an ongoing lawsuit. The IT department is instructed to preserve all relevant electronic data. Which of the following actions should be taken FIRST to comply with the legal hold?

Accepted Answer

Immediately preserve all potentially relevant data, including backups and archives, and suspend automatic deletion policies.. The first step in responding to a litigation hold is to immediately preserve all potentially relevant data, including backups and archives, and suspend any automatic deletion or rotation policies. This ensures that no spoliation of evidence occurs, which could lead to legal sanctions. The preservation order must be broad to cover all data that might be relevant, as determining exact relevance comes later in the e-discovery process.

Answer

Delete all data that is not relevant to the lawsuit to reduce storage.

Answer

Notify all employees to ignore the hold and continue normal operations.

Answer

Conduct a forensic analysis of the data to determine relevance before preservation.

Question 9

Which of the following BEST describes Locard's exchange principle as applied to digital forensics?

Accepted Answer

Every contact leaves a trace; an attacker will leave digital evidence on the compromised system.. Locard's exchange principle states that every contact leaves a trace. In digital forensics, this means that when an attacker interacts with a compromised system, they inevitably leave behind digital artifacts such as log entries, modified files, registry changes, or network connection records. Option D correctly captures this core concept as applied to digital forensics.

Answer

Digital evidence must be collected using a write blocker.

Answer

The chain of custody must be documented for evidence to be admissible.

Answer

Volatile data must be collected before powering off a system.

Question 10

A forensic analyst needs to create a forensic image of a suspect's hard drive using FTK Imager. Which of the following image formats is MOST appropriate for maintaining evidence integrity and allowing compression?

Accepted Answer

EnCase image format (.E01). FTK Imager natively supports the EnCase image format (.E01), which is the most appropriate choice because it maintains evidence integrity through embedded CRC32 and MD5/SHA-1 hash verification while also supporting optional compression. Unlike raw/DD images, .E01 files can be segmented and compressed without losing forensic integrity, making them ideal for both storage efficiency and court-admissible evidence.

Answer

ISO image format (.iso)

Answer

Advanced Forensic Format (AFF)

Answer

Raw/DD image (.dd)

Question 11

During an internal investigation, an employee is suspected of leaking sensitive data. The security team finds that the employee's computer has been turned off. Which of the following evidence types would be LOST due to the system being powered off?

Accepted Answer

Contents of RAM and network connections. When a system is powered off, the contents of volatile memory (RAM) are immediately lost because RAM requires constant electrical power to retain data. Similarly, active network connections are terminated and their state is lost, as they are maintained in kernel memory structures that are not persisted to disk. Therefore, any evidence residing only in RAM (e.g., encryption keys, running processes, unencrypted data) or transient network session details (e.g., active TCP/UDP connections, IP addresses) is permanently lost upon shutdown.

Answer

System logs stored in the Event Viewer

Answer

Files stored on the hard drive

Answer

Registry hives

Question 12

A forensic examiner needs to verify the integrity of a forensic image after acquisition. Which of the following methods is the MOST reliable for ensuring the image has not been altered?

Accepted Answer

Calculating and comparing hash values (e.g., MD5 or SHA-1) of the original and the image.. Cryptographic hash functions like MD5 or SHA-1 produce a fixed-size digest that is uniquely tied to the data content. By comparing the hash of the original drive (or its bit-for-bit copy) with the hash of the forensic image, any single bit change in the image will result in a completely different hash value, providing mathematically strong integrity verification. This is the standard method recommended in forensic best practices (e.g., NIST SP 800-86) and is far more reliable than any metadata or size comparison.

Answer

Opening the image in a hex editor and visually inspecting the first few bytes.

Answer

Using the 'dir' command to list files and compare timestamps.

Answer

Comparing file sizes of the original drive and the image.

Question 13

According to the US Fourth Amendment, which of the following THREE conditions generally allow law enforcement to search and seize digital evidence without a warrant? (Select THREE)

Accepted Answer

Consent given voluntarily by the owner of the device. Option A is correct because voluntary consent from a person with authority over the device (owner or someone with common authority) is a well-established exception to the Fourth Amendment warrant requirement, provided the consent is freely and voluntarily given. Option C is correct because exigent circumstances, such as the imminent destruction of digital evidence (e.g., a suspect wiping a drive or remote-wiping a phone), permit warrantless seizure or search when obtaining a warrant would be impracticable and the officers did not create the exigency. Option E is correct because the plain view doctrine allows warrantless seizure of evidence when an officer is lawfully present, the incriminating character of the item is immediately apparent, and the officer has a lawful right of access to the item. Option B is incorrect because being a minor does not by itself create a warrant exception; juveniles retain Fourth Amendment protections and typically require a warrant, parental consent, or another recognized exception. Option D is incorrect because encryption and refusal to provide a key do not authorize a warrantless search; instead, they may trigger compelled decryption litigation or other legal process, and the Fifth Amendment may even protect against self-incrimination.

Answer

The suspect is a minor

Answer

The data is encrypted and the key is not provided

Question 14

Which TWO of the following are examples of circumstantial evidence in a digital forensics investigation? (Select TWO)

Accepted Answer

Metadata showing a file was created on the suspect's computer during the incident timeframe. Option C is correct because file metadata (such as MAC times — Modified, Accessed, Created/Changed timestamps) is generated automatically by the file system and does not directly prove the suspect performed the criminal act; it only supports an inference that the file was created on the suspect's machine during the incident window, which is the essence of circumstantial evidence. Option E is correct because server logs recording the suspect's IP address at the time of the incident are system-generated artifacts that, by themselves, only suggest a connection between the suspect's address and the event; they require inference (and corroboration, since IP addresses can be spoofed or shared via NAT) to link the suspect to the crime, making them circumstantial. Option A is not circumstantial but direct testimonial evidence, since the witness claims firsthand observation of the crime. Option B is direct evidence because the recording itself shows the suspect performing the incriminating act of typing the password. Option D is direct evidence as a signed confession is an admission by the suspect of the act itself, not an inferential link.

Answer

A witness testifying they saw the suspect commit the crime

Answer

A video recording of the suspect typing a password

Answer

A signed confession from the suspect

Question 15

A forensic examiner is preparing to testify as an expert witness. Which THREE of the following qualities are essential for the examiner's testimony to be admissible under the Daubert standard? (Select THREE)

Accepted Answer

The methods used have been tested and are subject to peer review. Under Daubert v. Merrell Dow Pharmaceuticals, the trial judge acts as gatekeeper and assesses scientific testimony using several factors, three of which are reflected here. Option A is correct because Daubert explicitly considers whether the theory or technique can be (and has been) tested and whether it has been subjected to peer review and publication. Option B is correct because general acceptance in the relevant scientific or forensic community, though originally the Frye test, remains a Daubert factor the court may weigh. Option E is correct because Daubert requires consideration of the known or potential error rate of the methodology, along with the existence and maintenance of standards controlling its operation. Option C is not required, since Daubert focuses on the reliability of the methodology rather than a specific academic degree, and Option D is not required because prior testimony experience is not one of the Daubert reliability factors.

Answer

The examiner holds a degree in computer science

Answer

The examiner has testified in at least ten previous cases