CHFI Computer Forensics Fundamentals and Process Practice Test 2 — 15 Questions

Question 1

During a forensic investigation, an analyst creates a bit-for-bit copy of a suspect's hard drive using the 'dd' command with the following parameters: dd if=/dev/sda of=/evidence/image.dd bs=4k conv=noerror,sync. What is the purpose of 'conv=noerror,sync'?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

To ignore read errors and pad with zeros. 'conv=noerror,sync' tells dd to continue reading even when encountering read errors (noerror) and to pad the output with zeros (sync) to maintain the same total size as the original drive. This ensures a complete forensic image is created despite bad sectors, preserving the integrity of the acquisition for analysis.

Answer

To hash the output image

Answer

To ensure the command runs with superuser privileges

Answer

To compress the output image

Question 2

A forensic analyst needs to collect evidence from a running Windows system without altering the system state. Which tool should they use to acquire volatile memory?

Accepted Answer

DumpIt. DumpIt is a lightweight memory acquisition tool designed specifically for capturing the contents of volatile memory (RAM) on a running Windows system. It minimizes interaction with the system to avoid altering the memory state, making it ideal for forensic collection of live evidence.

Answer

Wireshark

Answer

dd

Answer

Tableau write blocker

Question 3

During an investigation, an analyst creates a forensic image of a hard drive using FTK Imager and computes the MD5 hash of the image. Later, the hash is re-computed and found to match. What does this confirm?

Accepted Answer

The image is an exact copy and has not been altered. A matching MD5 hash confirms that the forensic image is bit-for-bit identical to the original drive at the time of acquisition and has not been modified since. MD5 is a cryptographic hash function that produces a 128-bit digest; any change to the image, even a single bit, would produce a completely different hash. This integrity verification is a foundational step in the forensic process to ensure the evidence is admissible and untampered.

Answer

FTK Imager is a valid forensic tool

Answer

The original hard drive is free of malware

Answer

The image was acquired without using a write blocker

Question 4

A security analyst discovers unauthorized access to a server. The incident response team decides to preserve evidence. Which of the following actions is MOST critical to ensure the admissibility of evidence in court?

Accepted Answer

Documenting the chain of custody. Chain of custody documentation is the most critical action for evidence admissibility because it establishes a verifiable record of who handled the evidence, when, and under what conditions, ensuring the evidence has not been tampered with. Without a proper chain of custody, even technically sound evidence can be ruled inadmissible under rules like Federal Rule of Evidence 901. In forensic practice, this involves logging every access with timestamps, digital signatures, and hash values (e.g., SHA-256) to maintain integrity.

Answer

Disconnecting the server from the network

Answer

Running a full antivirus scan on the server

Answer

Taking screenshots of the server's screen

Question 5

In a UK-based investigation, the police seize a computer without a warrant. The suspect's lawyer argues that the evidence is inadmissible because it violates which law?

Accepted Answer

Police and Criminal Evidence Act (PACE). The Police and Criminal Evidence Act (PACE) 1984 governs the powers of police in England and Wales to search, seize, and retain evidence. Without a warrant, the seizure of a computer likely violates PACE's requirements for lawful entry and seizure, making the evidence inadmissible under UK law.

Answer

Fourth Amendment to the US Constitution

Answer

General Data Protection Regulation (GDPR)

Answer

Computer Misuse Act

Question 6

An analyst runs 'dcfldd if=/dev/sdb of=/evidence/disk.dd hash=sha256 hashlog=/evidence/hash.log' on a Linux system. What is the primary advantage of using dcfldd over plain dd for forensic imaging?

Accepted Answer

It can compute hashes on-the-fly and log them. D is correct because dcfldd is a specialized forensic version of dd that can compute cryptographic hashes (e.g., SHA-256) on-the-fly while writing the image, and log those hashes to a separate file (hashlog). This ensures data integrity verification without requiring a separate post-imaging hashing pass, which is a critical requirement in forensic imaging to prove the acquired image is an exact bit-for-bit copy of the source.

Answer

It can acquire memory dumps from live systems

Answer

It supports compression of the output image

Answer

It automatically creates a write-blocked connection

Question 7

Which of the following BEST describes the purpose of a legal hold in e-discovery?

Accepted Answer

To suspend the deletion of data that may be relevant to upcoming litigation. A legal hold (also known as a litigation hold) is a directive that suspends the normal deletion or destruction of data that may be relevant to pending or reasonably anticipated litigation. In e-discovery, this ensures that potentially relevant electronically stored information (ESI) is preserved and not altered or destroyed, thereby preventing spoliation of evidence. The purpose is to maintain the integrity and availability of data for discovery obligations under rules such as FRCP Rule 37(e).

Answer

To encrypt data for secure storage

Answer

To obtain a search warrant for digital evidence

Answer

To permanently delete irrelevant data

Question 8

A forensic examiner uses a hardware write blocker when imaging a suspect's hard drive. What is the primary function of a hardware write blocker?

Accepted Answer

To prevent any data from being written to the suspect drive. A hardware write blocker is a device placed between the suspect drive and the forensic workstation that intercepts and blocks any write commands from the host system. Its primary function is to ensure that no data—such as file system metadata, temporary files, or operating system writes—can be written to the suspect drive, thereby preserving the original evidence in a forensically sound manner. This is critical for maintaining the integrity of the evidence and ensuring it is admissible in court.

Answer

To encrypt the data on the suspect drive

Answer

To connect the suspect drive via USB

Answer

To increase the speed of data acquisition

Question 9

Which TWO of the following are requirements for evidence to be admissible in court? (Select two.)

Accepted Answer

Evidence must be reliable. The rules of evidence require that evidence be admissible, reliable, complete, and authentic. In many jurisdictions, evidence must be relevant and reliable to be admissible. Completeness and authenticity are also key.

Answer

Evidence must be encrypted

Answer

Evidence must be stored on a write-blocked drive

Answer

Evidence must be obtained by the police

Question 10

Which THREE of the following are steps in the forensic investigation process? (Select three.)

Accepted Answer

Analysis. Analysis is a core phase in the forensic investigation process where collected data is examined to identify evidence, reconstruct events, and draw conclusions. This step involves techniques such as file carving, hash verification, and timeline analysis to uncover relevant artifacts from acquired images.

Answer

Sentencing

Answer

Deletion of irrelevant data

Question 11

Which TWO of the following are types of write blockers used in forensic imaging? (Select two.)

Accepted Answer

Hardware write blocker. Hardware write blockers (Option D) are physical devices that sit between the suspect drive and the forensic workstation, intercepting and blocking any write commands at the SATA/IDE/USB bus level. They ensure that no data is altered on the source drive during imaging by electrically or mechanically preventing write signals from reaching the drive.

Answer

Encryption write blocker

Answer

Network write blocker

Answer

Hash write blocker

Question 12

A first responder arrives at a scene where a computer is powered on and the user is present. According to standard forensic first responder procedures, what should the responder do FIRST?

Accepted Answer

Photograph the scene and document the system state. The first priority at a live scene is to preserve volatile evidence and establish a chain of custody. Photographing the scene and documenting the system state (e.g., running processes, open network connections, logged-in users) captures critical volatile data before any action is taken. This aligns with the order of volatility (RFC 3227), which mandates capturing memory and system state before altering the system.

Answer

Boot the system from a forensic USB to create a memory dump

Answer

Immediately disconnect the power cord to preserve the hard drive

Answer

Ask the user to log out so the system can be powered off safely

Question 13

A forensic analyst creates a forensic image of a hard drive using the dd command: dd if=/dev/sda of=/evidence/image.dd bs=4096 conv=noerror,sync. What is the purpose of the 'conv=noerror,sync' option?

Accepted Answer

It continues on read errors and pads the output with zeros to maintain the same size. The `conv=noerror,sync` option in the `dd` command instructs the tool to continue processing when a read error is encountered (`noerror`) and to pad the output block with zeros (`sync`) to maintain the same total size as the original drive. This ensures that the forensic image remains a bit-for-bit copy in terms of size, even if physical sectors are unreadable, preserving the integrity of the acquisition process for analysis.

Answer

It verifies the hash of the image after creation

Answer

It synchronizes the output with the input to ensure data integrity

Answer

It enables direct memory access for faster imaging

Question 14

In a UK-based investigation under the Police and Criminal Evidence Act (PACE), a forensic examiner is asked to seize computers from a business premises. Which of the following actions is MOST compliant with PACE requirements?

Accepted Answer

Seize only items that are specified in the search warrant and provide a receipt. PACE requires that during a search under warrant, only items specified in the warrant may be seized, and a receipt must be provided to the occupier. This ensures legal compliance, chain of custody, and respect for property rights, which are fundamental to admissible digital evidence.

Answer

Conduct a forensic analysis at the scene to determine relevance before seizure

Answer

Copy all data on-site and delete the originals to avoid leaving evidence behind

Answer

Enter the premises without a warrant because evidence may be destroyed

Question 15

A security analyst notices that a log file on a Linux server shows repeated failed SSH login attempts from an external IP address, but no successful login from that IP. However, the /var/log/auth.log file has been recently truncated. Which type of evidence is the truncated log file?

Accepted Answer

Circumstantial evidence. The truncated log file is circumstantial evidence. While the truncation itself is a directly observable fact, the conclusion that someone intentionally altered or destroyed the log to conceal failed SSH attempts requires inference. Other explanations (e.g., log rotation, system error) are possible. Direct evidence proves a fact without inference, such as an eyewitness testimony or a video recording of the tampering. Therefore, the truncated log file is circumstantial evidence.

Answer

Hearsay evidence

Answer

Best evidence

Answer

Direct evidence