CHFI Computer Forensics Fundamentals and Process Practice Test 10 — 15 Questions

Question 1

A first responder arrives at a suspected data breach scene. The system is powered on and a user is logged in. Which of the following actions should the responder take FIRST to preserve volatile data?

Accepted Answer

Collect volatile data such as RAM, network connections, and running processes using appropriate tools.. The first responder should capture volatile data (RAM, network connections, running processes) before powering off. Using a write-blocker to image the hard drive is done after capturing volatile data.

Answer

Document the scene and take photographs, then proceed to interview witnesses.

Answer

Immediately disconnect the network cable and power off the computer.

Answer

Use a hardware write-blocker to create a forensic image of the hard drive.

Question 2

Which of the following is the PRIMARY purpose of using a write blocker in computer forensics?

Accepted Answer

To prevent any modification to the original evidence drive during acquisition.. A write blocker ensures that no data is written to the original evidence drive during acquisition, maintaining its integrity.

Answer

To speed up the imaging process by caching writes.

Answer

To convert the hard drive interface from SATA to USB.

Answer

To encrypt the forensic image for secure transport.

Question 3

During a forensic examination, an analyst runs the following command: 'dd if=/dev/sda of=/mnt/evidence/image.dd bs=4k conv=noerror,sync'. The source drive has bad sectors. What is the effect of the 'conv=noerror,sync' option?

Accepted Answer

It fills the bad sectors with zeros in the output image, allowing the imaging to complete without errors.. The 'noerror' option tells dd to continue reading after errors, and 'sync' pads the bad sectors with zeros to maintain the correct size.

Answer

It stops the imaging process when an error is encountered.

Answer

It skips the bad sectors and compresses the output.

Answer

It retries reading the bad sector multiple times before giving up.

Question 4

An organization receives a litigation hold notice regarding an ongoing lawsuit. The IT department is instructed to preserve all relevant electronic data. Which of the following actions should be taken FIRST to comply with the legal hold?

Accepted Answer

Immediately preserve all potentially relevant data, including backups and archives, and suspend automatic deletion policies.. Option B is correct because the first step in responding to a litigation hold is to immediately preserve all potentially relevant data, including backups and archives, and suspend any automatic deletion or rotation policies. This ensures that no spoliation of evidence occurs, which could lead to legal sanctions. The preservation order must be broad to cover all data that might be relevant, as determining exact relevance comes later in the e-discovery process.

Answer

Delete all data that is not relevant to the lawsuit to reduce storage.

Answer

Notify all employees to ignore the hold and continue normal operations.

Answer

Conduct a forensic analysis of the data to determine relevance before preservation.

Question 5

Which of the following BEST describes Locard's exchange principle as applied to digital forensics?

Accepted Answer

Every contact leaves a trace; an attacker will leave digital evidence on the compromised system.. Locard's exchange principle states that every contact leaves a trace. In digital forensics, this means that when an attacker interacts with a compromised system, they inevitably leave behind digital artifacts such as log entries, modified files, registry changes, or network connection records. Option D correctly captures this core concept as applied to digital forensics.

Answer

Digital evidence must be collected using a write blocker.

Answer

The chain of custody must be documented for evidence to be admissible.

Answer

Volatile data must be collected before powering off a system.

Question 6

A forensic analyst needs to create a forensic image of a suspect's hard drive using FTK Imager. Which of the following image formats is MOST appropriate for maintaining evidence integrity and allowing compression?

Accepted Answer

EnCase image format (.E01). FTK Imager natively supports the EnCase image format (.E01), which is the most appropriate choice because it maintains evidence integrity through embedded CRC32 and MD5/SHA-1 hash verification while also supporting optional compression. Unlike raw/DD images, .E01 files can be segmented and compressed without losing forensic integrity, making them ideal for both storage efficiency and court-admissible evidence.

Answer

ISO image format (.iso)

Answer

Advanced Forensic Format (AFF)

Answer

Raw/DD image (.dd)

Question 7

During an internal investigation, an employee is suspected of leaking sensitive data. The security team finds that the employee's computer has been turned off. Which of the following evidence types would be LOST due to the system being powered off?

Accepted Answer

Contents of RAM and network connections. Volatile data such as RAM contents, network connections, and running processes are lost when the system is powered off. Non-volatile data on the hard drive remains.

Answer

System logs stored in the Event Viewer

Answer

Files stored on the hard drive

Answer

Registry hives

Question 8

A forensic examiner needs to verify the integrity of a forensic image after acquisition. Which of the following methods is the MOST reliable for ensuring the image has not been altered?

Accepted Answer

Calculating and comparing hash values (e.g., MD5 or SHA-1) of the original and the image.. Option C is correct because cryptographic hash functions like MD5 or SHA-1 produce a fixed-size digest that is uniquely tied to the data content. By comparing the hash of the original drive (or its bit-for-bit copy) with the hash of the forensic image, any single bit change in the image will result in a completely different hash value, providing mathematically strong integrity verification. This is the standard method recommended in forensic best practices (e.g., NIST SP 800-86) and is far more reliable than any metadata or size comparison.

Answer

Opening the image in a hex editor and visually inspecting the first few bytes.

Answer

Using the 'dir' command to list files and compare timestamps.

Answer

Comparing file sizes of the original drive and the image.

Question 9

Which TWO of the following are essential components of a proper chain of custody documentation? (Select TWO)

Accepted Answer

Date and time of each transfer of custody along with the names of individuals involved. Option C is correct because the chain of custody documentation must record the date, time, and identity of each individual who handles the evidence to ensure a complete, unbroken record of custody. This allows the court to verify that evidence was not tampered with or altered between collection and presentation. Without these timestamps and names, the chain of custody is legally insufficient.

Answer

The forensic tools used to analyze the evidence

Answer

The hash value of the evidence at the time of acquisition

Answer

Digital signatures of all individuals who handled the evidence

Question 10

According to the US Fourth Amendment, which of the following THREE conditions generally allow law enforcement to search and seize digital evidence without a warrant? (Select THREE)

Accepted Answer

Consent given voluntarily by the owner of the device. Option A is correct because the Fourth Amendment generally requires a warrant for searches, but an exception exists when the owner of the device voluntarily consents to the search. In digital forensics, consent must be knowing, intelligent, and voluntary, and it can be revoked at any time. This exception is commonly applied when a suspect agrees to a forensic examination of their computer or mobile device without a court order.

Answer

The suspect is a minor

Answer

The data is encrypted and the key is not provided

Question 11

Which TWO of the following are examples of circumstantial evidence in a digital forensics investigation? (Select TWO)

Accepted Answer

Metadata showing a file was created on the suspect's computer during the incident timeframe. Option C is correct because metadata, such as file system timestamps (e.g., $STANDARD_INFORMATION and $FILE_NAME attributes in NTFS), provides indirect evidence that a file was created during the incident timeframe. This does not directly prove the suspect's actions but supports an inference of involvement, which is the hallmark of circumstantial evidence.

Answer

A witness testifying they saw the suspect commit the crime

Answer

A video recording of the suspect typing a password

Answer

A signed confession from the suspect

Question 12

A forensic examiner is preparing to testify as an expert witness. Which THREE of the following qualities are essential for the examiner's testimony to be admissible under the Daubert standard? (Select THREE)

Accepted Answer

The methods used have been tested and are subject to peer review. The Daubert standard requires that expert testimony be based on scientific methods that are testable, peer-reviewed, and have known error rates.

Answer

The examiner holds a degree in computer science

Answer

The examiner has testified in at least ten previous cases

Question 13

Which TWO of the following are BEST practices when using a hardware write blocker during forensic acquisition? (Select TWO)

Accepted Answer

Test the write blocker on a non-evidence drive before connecting it to the suspect drive. Option A is correct because testing the write blocker on a non-evidence drive verifies that the device is functioning correctly and will not inadvertently allow writes to the suspect drive. This step ensures the integrity of the forensic acquisition by confirming the write blocker's hardware-level protection is operational before it is connected to evidence.

Answer

Use the write blocker to write data to the suspect drive to verify functionality

Answer

Use the same write blocker for both source and destination drives

Answer

Bypass the write blocker if the imaging tool supports software write protection

Question 14

In the context of e-discovery, which THREE of the following are key steps in the Electronic Discovery Reference Model (EDRM)? (Select THREE)

Accepted Answer

Preservation. The EDRM includes Information Governance, Identification, Preservation, Collection, Processing, Review, Analysis, and Production. Key steps include Preservation, Collection, and Production.

Answer

Prosecution

Answer

Investigation

Question 15

Which TWO of the following are valid reasons for a first responder to power off a computer system at a crime scene? (Select TWO)

Accepted Answer

When the system is actively destroying evidence (e.g., a data wiping program is running). Option C is correct because if a system is actively running a data wiping program (e.g., a tool that overwrites sectors with zeros or random data per the Gutmann method or DoD 5220.22-M standard), immediate power-off is the only way to halt the destruction of evidence before it becomes unrecoverable. Pulling the power cord (hard shutdown) stops the wiping process in its tracks, preserving any data that has not yet been overwritten.

Answer

To save time during the investigation

Answer

To make it easier to transport the system

Answer

To prevent the destruction of volatile data by allowing it to be captured before shutdown