CHFI Computer Forensics Fundamentals and Process Practice Test 3 — 15 Questions

Question 1

During an e-discovery process, a legal hold is issued. What is the PRIMARY purpose of a legal hold?

Accepted Answer

To prevent the destruction or alteration of potentially relevant evidence. The primary purpose of a legal hold is to preserve all forms of potentially relevant evidence by suspending normal data retention and deletion policies. This ensures that data, including emails, documents, and logs, is not altered or destroyed during the e-discovery process, which is critical for maintaining the integrity of evidence for litigation.

Answer

To authorize forensic examiners to image all company devices

Answer

To encrypt all data to prevent unauthorized access during litigation

Answer

To notify the opposing party of the intent to use electronic evidence

Question 2

A forensic investigator uses FTK Imager to create a forensic image of a suspect's laptop. The acquisition generates both an E01 file and a corresponding hash file. Which statement accurately describes the integrity verification process in FTK Imager?

Accepted Answer

The image file includes embedded hash values that can be verified later to ensure data integrity. FTK Imager embeds hash values (MD5 and SHA1) directly into the E01 file during acquisition. These embedded hashes can be verified later by FTK Imager or compatible tools to confirm that the image has not been altered, ensuring data integrity without relying on an external hash file.

Answer

The hash is computed only when the image is mounted for analysis, not during acquisition

Answer

FTK Imager does not support hash verification; a separate tool must be used

Answer

The hash is compared to a known-good hash from the manufacturer's database

Question 3

According to Locard's exchange principle, which of the following is MOST relevant to digital forensics?

Accepted Answer

When a person interacts with a digital device, they leave digital traces that can be recovered. Locard's exchange principle states that every contact leaves a trace. In digital forensics, this translates to the fact that when a person interacts with a digital device (e.g., opening a file, browsing a website, or typing a command), they leave digital traces such as log entries, metadata, temporary files, or registry artifacts. These traces can be recovered and analyzed to reconstruct user activity, making option B the most relevant application of the principle in this context.

Answer

The chain of custody must be maintained for all evidence

Answer

Every crime scene contains at least one latent fingerprint

Answer

Digital evidence is always stored in non-volatile memory

Question 4

In the context of US Fourth Amendment protections, which of the following scenarios would likely require a search warrant for a forensic examiner to legally seize and analyze a computer?

Accepted Answer

The computer is located in a private residence and there is no exigent circumstance. The Fourth Amendment requires a warrant for searches and seizures unless an exception applies. A computer in a private residence with no exigent circumstances (Option A) clearly requires a warrant. For a computer in plain view in a public area (Option B), the seizure itself may be lawful under the plain view doctrine, but the subsequent forensic analysis constitutes a separate search of digital data with a reasonable expectation of privacy, and therefore requires a warrant or an applicable exception. Consent (C) and regulatory inspection (D) are exceptions that may not require a warrant.

Answer

The computer's owner gives voluntary consent to search the device

Answer

The computer is seized from a business during a regulatory inspection with statutory authority

Question 5

An investigator creates a forensic image using dcfldd with the following command: dcfldd if=/dev/sdb of=image.dd hash=sha256 hashwindow=10M hashlog=hash.txt. What is the effect of the 'hashwindow=10M' parameter?

Accepted Answer

It divides the output into 10 MB chunks and hashes each chunk, logging the results. The `hashwindow=10M` parameter in dcfldd instructs the tool to compute a SHA-256 hash for every 10 MB segment (window) of the input data as it is being copied, and then log each segment's hash to the specified hashlog file. This allows the investigator to verify the integrity of individual chunks of the forensic image, which is useful for detecting corruption or tampering in specific regions of the image without rehashing the entire file.

Answer

It sets the input buffer size to 10 MB for performance

Answer

It verifies the hash of the input device in 10 MB windows before copying

Answer

It causes the tool to hash the entire image only after completion

Question 6

Which TWO of the following are essential duties of a first responder at a digital crime scene? (Select two.)

Accepted Answer

Photograph the scene including the screen, connections, and surrounding area. First responders must secure the scene, document everything, preserve evidence, and avoid altering the system state. Photographing the scene and using a write blocker to image are correct; collecting volatile memory is a specialized task, not a first responder's primary duty, and powering off without capturing RAM is generally avoided.

Answer

Attempt to recover deleted files using forensic software on the live system

Answer

Power off the computer immediately to prevent data modification

Answer

Disconnect the computer from the network to stop remote access

Question 7

Which THREE of the following correctly describe the rules of evidence as applied to digital forensics? (Select three.)

Accepted Answer

Evidence must be relevant to the case and obtained through lawful means. Evidence must be relevant to the case and obtained through lawful means. In digital forensics, this aligns with the legal principle of relevance under the Federal Rules of Evidence (FRE 401) and the requirement that evidence be obtained via a lawful search warrant or consent, otherwise it may be suppressed under the exclusionary rule (e.g., Fourth Amendment violations).

Answer

Circumstantial evidence is not allowed in digital forensics cases

Answer

Hearsay evidence is always inadmissible in court

Question 8

Which TWO of the following are valid reasons for using a hardware write blocker over a software write blocker? (Select two.)

Accepted Answer

Hardware write blockers operate at the physical layer and are OS-independent. Hardware write blockers operate at the physical layer of the OSI model, intercepting SATA/IDE/PATA commands before they reach the operating system. This makes them completely OS-independent, so they work identically on Windows, Linux, or macOS without requiring any kernel-mode drivers or OS-specific configurations. In contrast, software write blockers rely on the OS storage stack and can be affected by OS-level bugs or driver conflicts.

Answer

Hardware write blockers support faster transfer speeds than software blockers

Answer

Hardware write blockers can be bypassed by malware on the forensic workstation

Answer

Hardware write blockers are cheaper than software solutions

Question 9

Which of the following is the BEST definition of computer forensics?

Accepted Answer

The application of investigative and analytical techniques to gather and preserve evidence from digital devices suitable for presentation in a court of law.. Computer forensics is fundamentally the application of investigative and analytical techniques to collect, preserve, and analyze digital evidence in a manner that maintains its integrity and admissibility in a court of law. This definition encompasses the entire forensic process, from acquisition through chain of custody to presentation, aligning with the CHFI framework's emphasis on legal and procedural rigor.

Answer

The use of software tools to scan for malware on a computer system.

Answer

The process of recovering deleted files from a hard drive.

Answer

The process of securing a computer network from unauthorized access.

Question 10

An analyst performs forensic imaging using the command: dcfldd if=/dev/sda of=image.dd hash=sha256 hashlog=hash.txt bs=4096 conv=noerror,sync. What is the PRIMARY purpose of the 'hash=sha256' and 'hashlog=hash.txt' parameters?

Accepted Answer

To ensure the image is an exact bit-for-bit copy and provide an integrity check.. The `hash=sha256` parameter instructs dcfldd to compute a SHA-256 hash of the input data as it is read, and `hashlog=hash.txt` writes that hash value to a separate file. This allows the analyst to later verify that the forensic image (`image.dd`) is an exact bit-for-bit copy of the source (`/dev/sda`) by recomputing the hash and comparing it to the stored value, ensuring data integrity and admissibility in court.

Answer

To encrypt the image file to prevent unauthorized access.

Answer

To compress the image to save disk space.

Answer

To split the image into smaller chunks for easier transport.

Question 11

An organization receives a legal hold notice for a civil lawsuit. An employee later deletes relevant emails from their mailbox. Which legal principle is MOST likely violated?

Accepted Answer

Spoilation of evidence. The legal hold notice imposes a duty to preserve relevant evidence. Deleting emails after receiving such notice constitutes intentional destruction of evidence, which is spoliation. This violates the legal principle of spoliation of evidence, as the organization had a duty to preserve the emails for the pending litigation.

Answer

Best evidence rule

Answer

Locard's exchange principle

Answer

Probable cause

Question 12

A forensic investigator uses the 'dd' command to create a forensic image. The original drive has a SHA-256 hash of a1b2c3... and the image produces the same hash. Which rule of evidence does this satisfy?

Accepted Answer

Authenticity. The SHA-256 hash of the original drive matches the hash of the forensic image, proving that the image is an exact, unaltered copy of the original. This satisfies the rule of authenticity, which requires that evidence be shown to be the same as what was originally seized and not tampered with. The hash acts as a digital fingerprint, and matching hashes confirm the integrity and origin of the evidence.

Answer

Reliability

Answer

Completeness

Answer

Admissibility

Question 13

An organization in the UK suspects an employee of data theft. The IT manager wants to search the employee's company-issued laptop without consent. Which law primarily governs this action?

Accepted Answer

Computer Misuse Act 1990. The Computer Misuse Act 1990 is the primary UK law governing unauthorized access to computer material. In this scenario, the IT manager searching the employee's company-issued laptop without consent may involve unauthorized access, making this Act the most directly applicable legal framework. The Police and Criminal Evidence Act (PACE) 1984 applies to police searches, not internal company investigations.

Answer

Police and Criminal Evidence Act 1984 (PACE)

Answer

GDPR (General Data Protection Regulation)

Answer

Human Rights Act 1998

Question 14

Which TWO of the following are essential components of the forensic investigation process? (Select two.)

Accepted Answer

Analysis. Analysis (D) is an essential component because it is the phase where the investigator examines the acquired data to identify evidence, reconstruct events, and draw conclusions. Preservation (E) is equally essential as it ensures the integrity of digital evidence from the moment of collection through the entire investigation, typically by creating a bit-for-bit forensic image (e.g., using dd or FTK Imager) and storing it on write-protected media. Without analysis, no actionable findings emerge; without preservation, evidence is inadmissible due to tampering or spoliation.

Answer

Reporting

Answer

First response

Answer

Chain of custody

Question 15

Which THREE of the following are valid rules of evidence that digital evidence must satisfy to be admissible in court? (Select three.)

Accepted Answer

Admissibility. (Admissibility) is correct because digital evidence must be legally permissible in court, meaning it must be obtained lawfully and not violate constitutional rights. Admissibility is a foundational rule that ensures evidence meets legal standards for consideration by the court, often tied to the Federal Rules of Evidence (FRE) or similar jurisdictional rules. Without admissibility, even the most compelling digital evidence cannot be presented to the jury.

Answer

Best evidence rule

Answer

Chain of custody