CHFI Computer Forensics Fundamentals and Process Practice Test 3 — 15 Questions

Question 1

A forensic analyst is preparing to testify in a U.S. federal court about a disk image acquired from a suspect's workstation. The defense attorney challenges the authenticity of the image, noting that the original drive was returned to the owner after imaging. Which legal principle allows the analyst to present the disk image as evidence instead of the original drive?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The Federal Rules of Evidence, specifically Rule 1003 (Admissibility of Duplicates). Federal Rule of Evidence 1003 permits duplicates to be admitted unless there is a genuine dispute about the original's authenticity or fairness concerns. The disk image, created with forensic tools and verified by hashing, qualifies as a duplicate. Because the original drive was returned and is unavailable, the image can serve as evidence, provided the analyst can authenticate it and demonstrate the imaging process was reliable.

Answer

The Chain of Custody Doctrine

Answer

The Hearsay Rule

Answer

The Best Evidence Rule

Question 2

A first responder arrives at a crime scene where a computer is running. According to standard forensic procedure, what should the responder do FIRST?

Accepted Answer

Photograph the scene and secure the area. The first priority at a live crime scene is to preserve the integrity of the scene and all potential evidence. Standard forensic procedure (e.g., from NIST SP 800-86 and ACPO guidelines) mandates that the first responder must photograph the scene to document the state of the computer (including screen contents, cables, and peripherals) and secure the area to prevent unauthorized access or tampering. Only after this documentation and scene stabilization can the responder proceed to handle the live system, such as capturing volatile data or creating a forensic image.

Answer

Connect a write blocker and create a forensic image immediately

Answer

Immediately shut down the computer to prevent data alteration

Answer

Pull the power cord to ensure the system does not shut down normally

Question 3

During a forensic investigation, an analyst uses a hardware write blocker to connect a suspect hard drive to a forensic workstation. What is the primary purpose of using a hardware write blocker?

Accepted Answer

To prevent the operating system from writing to the source drive. A hardware write blocker physically intercepts the write commands from the forensic workstation to the suspect drive, ensuring that no data can be altered on the source drive during acquisition. This preserves the evidentiary integrity of the original media, which is a foundational requirement in digital forensics to maintain a chain of custody and admissibility in court.

Answer

To speed up the data transfer rate during imaging

Answer

To compress the forensic image to save storage space

Answer

To automatically hash the drive contents for integrity verification

Question 4

During a forensic investigation, an analyst creates a forensic image using `dcfldd` with the command: `dcfldd if=/dev/sda of=image.dd hash=sha256 hashwindow=10M`. What is the purpose of the `hashwindow` parameter?

Accepted Answer

It creates a hash for every 10 MB block of data. The `hashwindow` parameter in `dcfldd` specifies the size of the data chunks for which individual hash values are computed. With `hashwindow=10M`, the tool generates a SHA-256 hash for every 10 MB block of the input data, allowing verification of integrity on a per-block basis rather than only a single hash for the entire image. This is useful for detecting corruption or tampering in specific segments of large forensic images.

Answer

It limits the total amount of data to hash to 10 MB

Answer

It sets the hash algorithm to SHA-256

Answer

It enables error correction for every 10 MB

Question 5

What is the primary goal of the chain of custody in a digital forensic investigation?

Accepted Answer

To maintain the integrity and admissibility of evidence. The chain of custody is a documented chronological record that tracks the seizure, custody, control, transfer, analysis, and disposition of digital evidence. Its primary goal is to maintain the integrity and admissibility of evidence by proving that the evidence has not been tampered with or altered from the moment it was collected until it is presented in court. This is critical because any break in the chain can lead to evidence being deemed inadmissible under rules like the Federal Rules of Evidence (FRE) or the Daubert standard.

Answer

To encrypt the evidence during transport

Answer

To speed up the forensic analysis process

Answer

To ensure that the forensic tools used are properly licensed

Question 6

A forensic analyst is examining a hard drive that was seized from a suspect's home. The analyst uses FTK Imager to create a forensic image. After imaging, the analyst computes the MD5 hash of the image and compares it to the hash computed at the scene. The hashes match. What does this confirm?

Accepted Answer

The image is an exact bit-for-bit copy of the original drive. B is correct because a matching MD5 hash between the image and the original drive confirms that the forensic image is an exact bit-for-bit copy. Hashing algorithms like MD5 produce a unique fixed-size hash value based on the binary content; if two hashes match, the data is identical with no alterations. This validates the integrity of the acquisition process, ensuring that the image is a perfect forensic duplicate.

Answer

The file system is intact and readable

Answer

The drive contains malware

Answer

The drive was not encrypted

Question 7

During a forensic investigation, a first responder notices that a computer is running and suspects that volatile data may be present. According to best practices, what should the responder do to preserve the most volatile data first?

Accepted Answer

Capture the contents of RAM using a forensic tool, then shut down. Volatile data, such as the contents of RAM, is lost when power is removed. The first responder must capture this data using a forensic tool (e.g., FTK Imager, WinPmem, or LiME) before performing a shutdown. This follows the Order of Volatility (RFC 3227), which prioritizes capturing registers, cache, and RAM before any persistent storage.

Answer

Perform a graceful shutdown to avoid data corruption

Answer

Remove the hard drive immediately while the system is running

Answer

Immediately unplug the power cord to freeze the system state

Question 8

An organization receives a legal hold notice regarding pending litigation. The IT department is instructed to preserve all relevant electronically stored information. What is the primary action the IT department should take?

Accepted Answer

Place a hold on relevant data and suspend routine deletion policies. The primary action is to place a legal hold on relevant data and suspend routine deletion policies. This ensures that all potentially relevant electronically stored information (ESI) is preserved in its current state, preventing spoliation and compliance with the legal hold notice. Suspending deletion policies stops automated processes like email purge jobs or document retention schedules from destroying evidence, which is a foundational step in the e-discovery process.

Answer

Ignore the notice and continue normal operations

Answer

Create a forensic image of all servers immediately

Answer

Permanently delete all emails older than 30 days to reduce storage

Question 9

A forensic analyst is examining a hard drive that was imaged using a software write blocker. Which of the following is a potential disadvantage of using a software write blocker compared to a hardware write blocker?

Accepted Answer

It may be susceptible to operating system or driver vulnerabilities. A software write blocker operates at the operating system level, intercepting write commands before they reach the storage device. Because it relies on the OS and its drivers, any vulnerability in the OS kernel, storage driver stack, or the blocker's own filter driver could be exploited, potentially allowing unintended writes to the evidence. In contrast, a hardware write blocker physically prevents write signals from reaching the drive at the bus level, offering a more robust isolation that is independent of the host OS's security state.

Answer

It cannot be used with USB drives

Answer

It does not support hashing algorithms for integrity

Answer

It is more expensive than hardware write blockers

Question 10

Which of the following is an example of Locard's Exchange Principle as applied to digital forensics?

Accepted Answer

A suspect's computer contains log files showing they accessed a server. Locard's Exchange Principle states that every contact leaves a trace. In digital forensics, this translates to the idea that when a system interacts with another, digital artifacts (such as log entries, registry keys, or network connection records) are created. Option A is correct because the log files on the suspect's computer are a direct trace of the contact between the suspect's system and the server, demonstrating the principle in a digital context.

Answer

A hard drive is encrypted and cannot be read

Answer

A firewall blocks all incoming traffic from a specific IP address

Answer

A write blocker prevents data from being written to a drive

Question 11

In the context of the US Fourth Amendment, what is typically required for law enforcement to seize a computer for forensic examination?

Accepted Answer

Consent of the owner, a warrant, or exigent circumstances. The Fourth Amendment requires law enforcement to obtain a warrant based on probable cause, obtain the owner's consent, or demonstrate exigent circumstances before seizing a computer for forensic examination. This protects against unreasonable searches and seizures, and a computer's storage capacity means it can contain vast amounts of personal data, so the same constitutional protections apply as to a physical home or vehicle.

Answer

A subpoena duces tecum

Answer

No legal authorization is needed if the computer is in plain view

Answer

Only a warrant issued by a judge

Question 12

Which TWO of the following are essential steps that a first responder should take when arriving at a digital crime scene? (Select TWO)

Accepted Answer

Capture volatile data from running systems. Option A is correct because volatile data such as RAM contents, running processes, network connections, and open files will be lost on shutdown or reboot, so a first responder must capture it using tools like memory dumps or live-response utilities before powering down the system. Option E is correct because photographing and documenting the scene preserves the original state and chain of custody, recording the physical layout, cable connections, and system status before any evidence is altered. Option B is not an essential first-responder step because forensic imaging is typically performed later by a forensic examiner after volatile data is secured and the scene is documented, and imaging a running system prematurely can destroy volatile evidence. Option C is wrong because installing software on the suspect's computer modifies the system and contaminates evidence, violating the principle of least intrusion. Option D is wrong because witness interviews must be documented to maintain an accurate and admissible record; undocumented interviews are unreliable and not an essential first-responder action.

Answer

Immediately start the forensic imaging process

Answer

Install forensic software on the suspect's computer

Answer

Interview all witnesses without documentation

Question 13

Which TWO of the following are valid justifications for a first responder to power off a computer at a crime scene? (Select TWO)

Accepted Answer

The computer is destroying evidence (e.g., running a data wiping program). Option C is correct because if a system is actively destroying evidence—such as running a data-wiping utility, secure-delete command, or encryption routine—the first responder must cut power immediately to preserve volatile and non-volatile data before it is irrecoverably lost. Option D is correct because a hazardous environment like flooding, fire, or electrical danger poses a risk to life and safety, and preserving human safety takes precedence over evidence collection, justifying powering off (or otherwise safely disconnecting) the machine. Option A is not a valid justification because modern computers have thermal protections and overheating is not a recognized forensic reason to power down, which would actually destroy volatile evidence. Option B is not valid because saving time is never an acceptable justification for altering a crime scene, as proper forensic procedure prioritizes evidence integrity over speed. Option E is not valid because a computer actively being used to commit a crime should typically be left running to capture live evidence (e.g., RAM, network connections, running processes), not powered off.

Answer

To prevent the computer from overheating

Answer

To save time during the investigation

Answer

The computer is actively being used to commit a crime

Question 14

What is the primary goal of computer forensics?

Accepted Answer

To preserve and analyze digital evidence in a legally admissible manner. The primary goal of computer forensics is to preserve and analyze digital evidence in a manner that is legally admissible in court.

Answer

To prevent future cyber attacks

Answer

To identify and prosecute cybercriminals

Answer

To recover deleted files from a hard drive

Question 15

Which principle states that every contact leaves a trace?

Accepted Answer

Locard's exchange principle. Locard's exchange principle is the foundational forensic concept stating that whenever two objects come into contact, there is a transfer of material between them. In computer forensics, this means that digital activity—such as accessing a file, sending a packet, or connecting to a network—inevitably leaves traces in logs, memory, registry entries, or file metadata. This principle underpins the entire discipline of digital evidence recovery.

Answer

Chain of custody

Answer

Best evidence rule

Answer

Hearsay rule