CHFI Computer Forensics Fundamentals and Process Practice Test 2 — 15 Questions

Question 1

During a forensic investigation, an examiner finds a log entry: 'User JohnDoe accessed file contract.pdf at 10:32:45 AM'. This log is considered which type of evidence?

Accepted Answer

Direct evidence. The log entry directly states that User JohnDoe accessed contract.pdf at a specific time, which is a firsthand account of the event without requiring inference. In digital forensics, direct evidence is evidence that, if believed, proves a fact without any additional reasoning or presumption. This log is a direct record of the user's action, making it direct evidence.

Answer

Circumstantial evidence

Answer

Hearsay

Answer

Best evidence

Question 2

Which TWO of the following are legal frameworks or regulations that govern search and seizure of digital evidence in the United Kingdom?

Accepted Answer

PACE (Police and Criminal Evidence Act). PACE (Police and Criminal Evidence Act) is correct because it is the core UK statutory framework setting out police powers of search, seizure, arrest, and detention in England and Wales, including provisions for obtaining search warrants and seizing digital evidence. GDPR is correct because, as retained in UK law via the Data Protection Act 2018 (UK GDPR), it governs the lawful processing, handling, and transfer of personal data encountered during digital evidence seizure, imposing requirements on law enforcement and forensic examiners. The Computer Fraud and Abuse Act (CFAA) is a US federal statute criminalizing unauthorized computer access, so it does not govern UK search and seizure. The Fourth Amendment to the US Constitution protects against unreasonable searches and seizures but applies only to US government action, not UK proceedings. The Sarbanes-Oxley Act (SOX) is US corporate financial reporting and accounting legislation and has no bearing on UK digital evidence seizure.

Answer

Computer Fraud and Abuse Act (CFAA)

Answer

Fourth Amendment to the US Constitution

Answer

Sarbanes-Oxley Act (SOX)

Question 3

Which TWO of the following are considered types of evidence under the rules of evidence?

Accepted Answer

Direct evidence. Direct evidence (Option B) is a type of evidence under the rules of evidence because it directly proves a fact without requiring any inference or presumption. In computer forensics, this could include a log entry showing an unauthorized login from a specific IP address at a specific time, which directly proves the fact of access. The rules of evidence recognize direct evidence as primary proof that stands on its own.

Answer

Best evidence rule

Answer

Hearsay evidence

Answer

Exculpatory evidence

Question 4

What is the primary goal of computer forensics?

Accepted Answer

To identify, preserve, analyze, and present digital evidence in a legally acceptable manner. The primary goal of computer forensics is to identify, preserve, analyze, and present digital evidence in a legally acceptable manner. This ensures that evidence is admissible in court, following strict chain-of-custody and forensic soundness principles. While prosecution may be an outcome, the core objective is the lawful handling of evidence, not conviction itself.

Answer

To prosecute cybercriminals

Answer

To recover deleted files for data recovery

Answer

To secure the network from future attacks

Question 5

A first responder arrives at a scene where a computer is on and logged in. There is a suspicion that the system contains volatile data that may be crucial to the investigation. According to best practices, what should the first responder do?

Accepted Answer

Collect volatile data using tools like FTK Imager or dd. Volatile data (e.g., RAM contents, network connections, running processes) is lost when the system loses power. FTK Imager or dd can capture a bit-for-bit image of memory and live system state while the computer remains on, preserving evidence that would otherwise vanish. This aligns with the order of volatility (RFC 3227), which prioritizes capturing volatile data before any other action.

Answer

Immediately pull the power cord to preserve the hard drive

Answer

Place the system in a Faraday bag and transport to lab

Answer

Take photos and then shut down normally

Question 6

During an e-discovery process, a forensic examiner encounters a hard drive that is encrypted using BitLocker. The examiner has a valid password to unlock the drive. Which of the following is the MOST appropriate action to acquire the data while maintaining the chain of custody?

Accepted Answer

Use a hardware write blocker to image the encrypted drive directly, then decrypt the image in a lab. Imaging an encrypted drive directly with a hardware write blocker preserves the original encrypted state, ensuring data integrity and chain of custody. Decrypting the image later in a controlled lab environment avoids altering the source drive and complies with forensic best practices. This approach prevents any write operations to the evidence drive, which a direct decryption attempt could inadvertently trigger.

Answer

Remove the hard drive and connect it to a forensic workstation without a write blocker

Answer

Ask the IT administrator to decrypt the drive and then image

Answer

Boot the system and unlock the drive using the password, then create a forensic image

Question 7

Which TWO of the following are hardware write blockers commonly used in forensic acquisitions?

Accepted Answer

FastBloc. FastBloc (B) is correct because it is a dedicated hardware write blocker, historically a Tableau/ICS product line, that sits between the suspect drive and the forensic workstation and enforces a read-only ATA/SATA interface so no write commands reach the evidence drive. Tableau (D) is correct because Tableau hardware write blockers (e.g., the Tableau T35u, T3u, and TX1 forensic bridges) are among the most widely used physical write-blocking devices in forensic acquisitions, providing hardware-level read-only access over SATA/IDE/USB. The remaining options are software, not hardware: EnCase (A) is a forensic suite that can perform software write-blocking via its FastBloc SE driver, dd (C) is a command-line imaging utility that relies on OS-level or external write protection, and FTK Imager (E) is an imaging/analysis application that likewise uses software-based write blocking rather than a physical blocker.

Answer

EnCase

Answer

dd

Answer

FTK Imager

Question 8

An investigator is examining a Windows system and needs to capture volatile data without altering the system. Which of the following tools would be MOST appropriate for acquiring the contents of RAM?

Accepted Answer

FTK Imager. FTK Imager is the most appropriate tool because it can acquire the contents of RAM (volatile memory) from a live Windows system without writing data back to the system drive, preserving the integrity of the evidence. It uses a memory acquisition driver that reads physical memory directly, and it can output a raw memory dump (.mem) file, which is essential for capturing volatile data like running processes, network connections, and encryption keys.

Answer

dd

Answer

EnCase

Answer

Tableau write blocker

Question 9

Which TWO of the following are considered forms of evidence under the rules of evidence? (Select two.)

Accepted Answer

Circumstantial evidence. Circumstantial evidence is a recognized form of evidence under the rules of evidence because it allows a fact-finder to infer a fact from other established facts, even without direct witness testimony. In digital forensics, this is critical when reconstructing user activity from log files, file metadata, or network traffic patterns that indirectly prove an action occurred.

Answer

Illegally obtained evidence

Answer

Hearsay evidence

Answer

Opinion evidence

Question 10

Which of the following is the BEST example of direct evidence in a computer forensics investigation?

Accepted Answer

A server log showing the suspect's IP address accessed a restricted file at the time of the incident. Direct evidence directly proves a fact without requiring inference. A server log showing the suspect's IP address accessing a restricted file at the time of the incident is direct evidence because it directly links the suspect's system to the specific action (accessing the file) at the relevant time, without needing additional reasoning or assumptions. This is based on the principle that logs capture actual system events, making them direct proof of the occurrence of that event.

Answer

A document found on the suspect's computer with content about the crime

Answer

Expert testimony that the suspect's computer contained malware

Answer

A witness testifying that the suspect was the only person who knew the password

Question 11

Which THREE of the following are rules of evidence that must be satisfied for digital evidence to be admissible in court? (Select THREE.)

Accepted Answer

Admissibility. Option B (Admissibility) is correct because digital evidence must be relevant, legally obtained, and not excluded by rules such as hearsay or illegal search, so it can be presented in court. Option C (Authenticity) is correct because the evidence must be shown to be what it purports to be, typically through hash values, chain of custody, and witness testimony. Option E (Completeness) is correct because the "best evidence" or completeness rule requires that the whole relevant record or context be presented so the evidence is not misleading. Option A (Simplicity) is not a legal rule of evidence; it is a general forensic principle about explaining findings clearly. Option D (Encryption) is not a rule of evidence; encryption is a protective technique that may affect access to evidence but does not determine admissibility.

Answer

Simplicity

Answer

Encryption

Question 12

Which TWO of the following are considered best practices for a first responder at a digital crime scene? (Select TWO.)

Accepted Answer

Photograph the scene including screen contents and connections. First responders should not power off the system (to preserve volatile data) and should photograph the scene to document the state.

Answer

Power off the computer immediately to secure data

Answer

Boot the system into safe mode to examine logs

Answer

Disconnect all cables to isolate the device

Question 13

Which TWO of the following are essential components of a proper chain of custody documentation? (Select TWO)

Accepted Answer

Date and time of each transfer of custody along with the names of individuals involved. Option C is correct because chain of custody documentation must record every transfer of the evidence, capturing the date and time of each handoff and the names (and typically signatures) of the individuals involved, so the evidence's whereabouts and accountability are unbroken and auditable. Option D is correct because a precise description of the evidence — including serial numbers, model numbers, and other unique identifiers — is essential to uniquely identify the item and distinguish it from similar items throughout its lifecycle. Option A is not essential to chain of custody itself; the forensic tools used for analysis belong in the examination/analysis report, not the custody record. Option B is not a required chain-of-custody element, though hash values are important for integrity verification and are usually recorded in the acquisition documentation. Option E is not required; while signatures are commonly used, digital signatures from every handler are not a mandatory component of chain of custody documentation.

Answer

The forensic tools used to analyze the evidence

Answer

The hash value of the evidence at the time of acquisition

Answer

Digital signatures of all individuals who handled the evidence

Question 14

Which TWO of the following are BEST practices when using a hardware write blocker during forensic acquisition? (Select TWO)

Accepted Answer

Test the write blocker on a non-evidence drive before connecting it to the suspect drive. Option A is correct because validating the hardware write blocker on a non-evidence drive first confirms it is functioning and actually blocking writes before any suspect media is touched, preserving evidence integrity. Option D is correct because the write blocker must sit inline between the suspect drive and the forensic workstation so that all host-side access passes through the blocking device, preventing any writes from reaching the evidence drive. Option B is wrong because intentionally writing to the suspect drive would modify evidence and defeat the purpose of the blocker. Option C is wrong because the same blocker should not be used for both source and destination; the destination drive must be writable for the image to be created, and mixing roles risks confusion or accidental writes to evidence. Option E is wrong because software write protection is not a substitute for a hardware write blocker in forensic acquisition, and bypassing the hardware blocker undermines the defensibility of the process.

Answer

Use the write blocker to write data to the suspect drive to verify functionality

Answer

Use the same write blocker for both source and destination drives

Answer

Bypass the write blocker if the imaging tool supports software write protection

Question 15

Which TWO of the following are essential components of a proper chain of custody documentation? (Select TWO)

Accepted Answer

Date and time of evidence collection. The date and time of evidence collection is a fundamental element of chain of custody documentation, establishing a precise chronological record of when the evidence was acquired. This timestamp is critical for proving the integrity and continuity of the evidence from the moment of seizure, and it must be recorded with accuracy (often to the second) and in a consistent time zone (e.g., UTC) to avoid disputes. Without this, the chain of custody cannot demonstrate that the evidence was not tampered with between collection and analysis.

Answer

The IP address of the forensic workstation

Answer

Backup location of the evidence

Answer

The forensic tool used to analyze the evidence