CHFI Computer Forensics Fundamentals and Process Practice Test 3 — 15 Questions

Question 1

A first responder arrives at a scene where a computer is powered on and the user is present. According to standard forensic first responder procedures, what should the responder do FIRST?

Accepted Answer

Photograph the scene and document the system state. Option A is correct because the first priority at a live scene is to preserve volatile evidence and establish a chain of custody. Photographing the scene and documenting the system state (e.g., running processes, open network connections, logged-in users) captures critical volatile data before any action is taken. This aligns with the order of volatility (RFC 3227), which mandates capturing memory and system state before altering the system.

Answer

Boot the system from a forensic USB to create a memory dump

Answer

Immediately disconnect the power cord to preserve the hard drive

Answer

Ask the user to log out so the system can be powered off safely

Question 2

During a forensic investigation, an analyst uses a hardware write blocker to connect a suspect hard drive to a forensic workstation. Which of the following is the PRIMARY reason for using a write blocker?

Accepted Answer

To prevent any modification to the suspect drive during acquisition. The primary reason for using a hardware write blocker is to ensure that the suspect drive is connected in a read-only manner, preventing any write operations from the forensic workstation from reaching the drive. This preserves the integrity of the evidence by guaranteeing that no data is altered, added, or deleted during the acquisition process, which is a fundamental requirement for admissibility in legal proceedings.

Answer

To allow the suspect drive to be mounted as read-write for analysis

Answer

To decrypt the drive automatically without the key

Answer

To speed up the imaging process by caching writes

Question 3

A forensic analyst creates a forensic image of a hard drive using the dd command: dd if=/dev/sda of=/evidence/image.dd bs=4096 conv=noerror,sync. What is the purpose of the 'conv=noerror,sync' option?

Accepted Answer

It continues on read errors and pads the output with zeros to maintain the same size. The `conv=noerror,sync` option in the `dd` command instructs the tool to continue processing when a read error is encountered (`noerror`) and to pad the output block with zeros (`sync`) to maintain the same total size as the original drive. This ensures that the forensic image remains a bit-for-bit copy in terms of size, even if physical sectors are unreadable, preserving the integrity of the acquisition process for analysis.

Answer

It verifies the hash of the image after creation

Answer

It synchronizes the output with the input to ensure data integrity

Answer

It enables direct memory access for faster imaging

Question 4

In a UK-based investigation under the Police and Criminal Evidence Act (PACE), a forensic examiner is asked to seize computers from a business premises. Which of the following actions is MOST compliant with PACE requirements?

Accepted Answer

Seize only items that are specified in the search warrant and provide a receipt. Option D is correct because PACE requires that during a search under warrant, only items specified in the warrant may be seized, and a receipt must be provided to the occupier. This ensures legal compliance, chain of custody, and respect for property rights, which are fundamental to admissible digital evidence.

Answer

Conduct a forensic analysis at the scene to determine relevance before seizure

Answer

Copy all data on-site and delete the originals to avoid leaving evidence behind

Answer

Enter the premises without a warrant because evidence may be destroyed

Question 5

Which of the following BEST defines the chain of custody in digital forensics?

Accepted Answer

The chronological documentation of evidence handling, transfer, and analysis. The chain of custody is a formal, chronological record that documents every instance of evidence handling, transfer, and analysis from the moment of seizure through its entire lifecycle. This documentation is critical to prove that evidence has not been tampered with, altered, or corrupted, thereby maintaining its admissibility in legal proceedings under rules such as Federal Rule of Evidence 901.

Answer

The legal authority required to seize evidence

Answer

The order in which forensic tools are applied to evidence

Answer

The physical security measures used to store evidence

Question 6

A security analyst notices that a log file on a Linux server shows repeated failed SSH login attempts from an external IP address, but no successful login from that IP. However, the /var/log/auth.log file has been recently truncated. Which type of evidence is the truncated log file?

Accepted Answer

Direct evidence. The truncated log file is direct evidence because it is a tangible, physical artifact that, by its very state (having been truncated), directly indicates that an action was taken to alter or destroy log data. In computer forensics, direct evidence is evidence that, if believed, proves a fact without any inference or presumption. The truncation itself is a fact that can be observed and analyzed, and it directly supports the conclusion that someone tampered with the log file to conceal the failed SSH login attempts.

Answer

Hearsay evidence

Answer

Best evidence

Answer

Circumstantial evidence

Question 7

During an e-discovery process, a legal hold is issued. What is the PRIMARY purpose of a legal hold?

Accepted Answer

To prevent the destruction or alteration of potentially relevant evidence. The primary purpose of a legal hold is to preserve all forms of potentially relevant evidence by suspending normal data retention and deletion policies. This ensures that data, including emails, documents, and logs, is not altered or destroyed during the e-discovery process, which is critical for maintaining the integrity of evidence for litigation.

Answer

To authorize forensic examiners to image all company devices

Answer

To encrypt all data to prevent unauthorized access during litigation

Answer

To notify the opposing party of the intent to use electronic evidence

Question 8

A forensic investigator uses FTK Imager to create a forensic image of a suspect's laptop. The acquisition generates both an E01 file and a corresponding hash file. Which statement accurately describes the integrity verification process in FTK Imager?

Accepted Answer

The image file includes embedded hash values that can be verified later to ensure data integrity. Option D is correct because FTK Imager embeds hash values (MD5 and SHA1) directly into the E01 file during acquisition. These embedded hashes can be verified later by FTK Imager or compatible tools to confirm that the image has not been altered, ensuring data integrity without relying on an external hash file.

Answer

The hash is computed only when the image is mounted for analysis, not during acquisition

Answer

FTK Imager does not support hash verification; a separate tool must be used

Answer

The hash is compared to a known-good hash from the manufacturer's database

Question 9

According to Locard's exchange principle, which of the following is MOST relevant to digital forensics?

Accepted Answer

When a person interacts with a digital device, they leave digital traces that can be recovered. Locard's principle states that every contact leaves a trace. In digital forensics, this translates to the concept that digital devices leave traces of their activities and interactions, such as logs, metadata, and artifacts.

Answer

The chain of custody must be maintained for all evidence

Answer

Every crime scene contains at least one latent fingerprint

Answer

Digital evidence is always stored in non-volatile memory

Question 10

In the context of US Fourth Amendment protections, which of the following scenarios would likely require a search warrant for a forensic examiner to legally seize and analyze a computer?

Accepted Answer

The computer is located in a private residence and there is no exigent circumstance. The Fourth Amendment protects against unreasonable searches and seizures, and a computer located in a private residence generally falls under a heightened expectation of privacy. Without exigent circumstances (e.g., imminent destruction of evidence, hot pursuit), a forensic examiner must obtain a search warrant based on probable cause before seizing and analyzing the device. This ensures that the digital evidence is admissible under the exclusionary rule.

Answer

The computer is in plain view in a public area and is suspected to contain evidence of a crime

Answer

The computer's owner gives voluntary consent to search the device

Answer

The computer is seized from a business during a regulatory inspection with statutory authority

Question 11

An investigator creates a forensic image using dcfldd with the following command: dcfldd if=/dev/sdb of=image.dd hash=sha256 hashwindow=10M hashlog=hash.txt. What is the effect of the 'hashwindow=10M' parameter?

Accepted Answer

It divides the output into 10 MB chunks and hashes each chunk, logging the results. Option A is correct because the `hashwindow=10M` parameter in dcfldd instructs the tool to compute a SHA-256 hash for every 10 MB segment (window) of the input data as it is being copied, and then log each segment's hash to the specified hashlog file. This allows the investigator to verify the integrity of individual chunks of the forensic image, which is useful for detecting corruption or tampering in specific regions of the image without rehashing the entire file.

Answer

It sets the input buffer size to 10 MB for performance

Answer

It verifies the hash of the input device in 10 MB windows before copying

Answer

It causes the tool to hash the entire image only after completion

Question 12

Which of the following is a key requirement for digital evidence to be considered admissible in court?

Accepted Answer

The evidence must be authentic and its integrity must be verifiable. Digital evidence must be authentic and its integrity verifiable to meet the legal standard of admissibility, as established by rules such as the Federal Rules of Evidence (FRE 901) and the Daubert standard. Authentication requires proving that the evidence is what it claims to be, typically through a hash value (e.g., MD5, SHA-1, or SHA-256) computed before and after analysis to ensure no tampering occurred. Without verifiable integrity, the evidence could be challenged as altered, making it inadmissible regardless of how it was collected.

Answer

The evidence must have been collected by a law enforcement officer

Answer

The evidence must be stored on a write-blocked device

Answer

The evidence must be encrypted to ensure confidentiality

Question 13

Which TWO of the following are essential duties of a first responder at a digital crime scene? (Select two.)

Accepted Answer

Photograph the scene including the screen, connections, and surrounding area. First responders must secure the scene, document everything, preserve evidence, and avoid altering the system state. Photographing the scene and using a write blocker to image are correct; collecting volatile memory is a specialized task, not a first responder's primary duty, and powering off without capturing RAM is generally avoided.

Answer

Attempt to recover deleted files using forensic software on the live system

Answer

Power off the computer immediately to prevent data modification

Answer

Disconnect the computer from the network to stop remote access

Question 14

Which THREE of the following correctly describe the rules of evidence as applied to digital forensics? (Select three.)

Accepted Answer

Evidence must be relevant to the case and obtained through lawful means. Option A is correct because evidence must be relevant to the case and obtained through lawful means. In digital forensics, this aligns with the legal principle of relevance under the Federal Rules of Evidence (FRE 401) and the requirement that evidence be obtained via a lawful search warrant or consent, otherwise it may be suppressed under the exclusionary rule (e.g., Fourth Amendment violations).

Answer

Circumstantial evidence is not allowed in digital forensics cases

Answer

Hearsay evidence is always inadmissible in court

Question 15

Which TWO of the following are valid reasons for using a hardware write blocker over a software write blocker? (Select two.)

Accepted Answer

Hardware write blockers operate at the physical layer and are OS-independent. Option C is correct because hardware write blockers operate at the physical layer of the OSI model, intercepting SATA/IDE/PATA commands before they reach the operating system. This makes them completely OS-independent, so they work identically on Windows, Linux, or macOS without requiring any kernel-mode drivers or OS-specific configurations. In contrast, software write blockers rely on the OS storage stack and can be affected by OS-level bugs or driver conflicts.

Answer

Hardware write blockers support faster transfer speeds than software blockers

Answer

Hardware write blockers can be bypassed by malware on the forensic workstation

Answer

Hardware write blockers are cheaper than software solutions