CHFI Computer Forensics Fundamentals and Process Practice Test 4 — 15 Questions

Question 1

A first responder arrives at a suspected intrusion scene. A desktop computer is powered on and logged in. The user claims they saw suspicious files being copied to a USB drive. Which of the following should the first responder do FIRST?

Accepted Answer

Capture volatile data such as memory and running processes.. The first priority is to preserve volatile data (e.g., memory, running processes) which may be lost if the system is powered off. Photographing the scene and documenting are important but come after securing volatile data.

Answer

Power off the computer immediately to prevent further data loss.

Answer

Photograph the scene and document everything in a notebook.

Answer

Create a forensic image of the hard drive using a write blocker.

Question 2

Which of the following is the BEST definition of computer forensics?

Accepted Answer

The application of investigative and analytical techniques to gather and preserve evidence from digital devices suitable for presentation in a court of law.. Option A is correct because computer forensics is fundamentally the application of investigative and analytical techniques to collect, preserve, and analyze digital evidence in a manner that maintains its integrity and admissibility in a court of law. This definition encompasses the entire forensic process, from acquisition through chain of custody to presentation, aligning with the CHFI framework's emphasis on legal and procedural rigor.

Answer

The use of software tools to scan for malware on a computer system.

Answer

The process of recovering deleted files from a hard drive.

Answer

The process of securing a computer network from unauthorized access.

Question 3

An analyst performs forensic imaging using the command: dcfldd if=/dev/sda of=image.dd hash=sha256 hashlog=hash.txt bs=4096 conv=noerror,sync. What is the PRIMARY purpose of the 'hash=sha256' and 'hashlog=hash.txt' parameters?

Accepted Answer

To ensure the image is an exact bit-for-bit copy and provide an integrity check.. The `hash=sha256` parameter instructs dcfldd to compute a SHA-256 hash of the input data as it is read, and `hashlog=hash.txt` writes that hash value to a separate file. This allows the analyst to later verify that the forensic image (`image.dd`) is an exact bit-for-bit copy of the source (`/dev/sda`) by recomputing the hash and comparing it to the stored value, ensuring data integrity and admissibility in court.

Answer

To encrypt the image file to prevent unauthorized access.

Answer

To compress the image to save disk space.

Answer

To split the image into smaller chunks for easier transport.

Question 4

During a forensic investigation, a lawyer objects to the admissibility of a log file on the grounds that it is hearsay. Which of the following is the BEST argument to overcome this objection?

Accepted Answer

The log file qualifies as a business record exception to the hearsay rule.. The log file is admissible under the business records exception to the hearsay rule (Federal Rule of Evidence 803(6)). This exception applies because logs are created automatically or by a person with knowledge, near the time of the event, in the regular course of business, and it is the regular practice to make such records. In digital forensics, system logs (e.g., Windows Event Logs, syslog) are routinely admitted under this exception, as they are generated by the system without the declarant's bias or memory issues.

Answer

The log file is circumstantial evidence, not hearsay.

Answer

The log file is direct evidence of the intrusion.

Answer

The log file is the best evidence because it is an original record.

Question 5

An investigator needs to acquire data from a suspect's hard drive without altering any data. Which tool is MOST appropriate to ensure write-blocking at the hardware level?

Accepted Answer

Tableau Forensic Bridge (hardware write-blocker). A hardware write-blocker like the Tableau Forensic Bridge sits between the suspect drive and the forensic workstation at the physical layer, intercepting and blocking any write commands (e.g., ATA WRITE DMA, SCSI WRITE) before they reach the drive. This ensures that no data—including metadata, timestamps, or file system artifacts—is altered during acquisition, which is critical for maintaining evidentiary integrity. Software-based blockers can be bypassed by the OS or a malicious driver, making hardware-level blocking the gold standard in forensic acquisition.

Answer

FTK Imager (software write-blocker)

Answer

dd command with 'iflag=noatime'

Answer

EnCase software acquisition module

Question 6

What is the PRIMARY purpose of a chain of custody document in a forensic investigation?

Accepted Answer

To provide a chronological record of who handled the evidence, when, and why.. The chain of custody document is the foundational record that ensures evidence integrity and admissibility in court. Its primary purpose is to create a chronological, unbroken log of every person who handled the evidence, the exact time and date of each transfer, and the reason for the transfer. This directly supports the legal requirement to prove that the evidence has not been tampered with or altered from the moment of seizure to its presentation in court.

Answer

To document the tools used during the investigation.

Answer

To list all the files found on the suspect's computer.

Answer

To authorize the search and seizure of digital evidence.

Question 7

An organization receives a legal hold notice for a civil lawsuit. An employee later deletes relevant emails from their mailbox. Which legal principle is MOST likely violated?

Accepted Answer

Spoilation of evidence. The legal hold notice imposes a duty to preserve relevant evidence. Deleting emails after receiving such notice constitutes intentional destruction of evidence, which is spoliation. This violates the legal principle of spoliation of evidence, as the organization had a duty to preserve the emails for the pending litigation.

Answer

Best evidence rule

Answer

Locard's exchange principle

Answer

Probable cause

Question 8

A forensic investigator uses the 'dd' command to create a forensic image. The original drive has a SHA-256 hash of a1b2c3... and the image produces the same hash. Which rule of evidence does this satisfy?

Accepted Answer

Authenticity. Authenticity means evidence is what it purports to be. Matching hashes confirms the image is an exact copy, thus authentic.

Answer

Reliability

Answer

Completeness

Answer

Admissibility

Question 9

According to Locard's exchange principle, which of the following is TRUE in a digital forensic context?

Accepted Answer

A suspect will always leave traces of their activity on a computer system.. Locard's principle states that every contact leaves a trace. In digital forensics, this means that when a suspect interacts with a system, digital traces (e.g., logs, files) are left behind.

Answer

Only physical evidence, not digital evidence, is subject to exchange.

Answer

Digital evidence is always volatile and cannot be preserved.

Answer

The absence of evidence proves the suspect is innocent.

Question 10

During a forensic examination of a Windows system, the investigator finds a file named 'notes.txt' that contains a list of passwords. The file's last modified timestamp is before the incident date, but its last accessed timestamp is during the incident. Which type of evidence is this file considered?

Accepted Answer

Circumstantial evidence. The file 'notes.txt' has a last modified timestamp before the incident but a last accessed timestamp during the incident. This indicates the file was opened or read during the incident, but not modified. Such indirect evidence suggests the attacker may have viewed the passwords, but does not directly prove the act of using them. Therefore, it is circumstantial evidence because it requires inference to connect the file access to the incident.

Answer

Best evidence

Answer

Hearsay evidence

Answer

Direct evidence

Question 11

An organization in the UK suspects an employee of data theft. The IT manager wants to search the employee's company-issued laptop without consent. Which law primarily governs this action?

Accepted Answer

Police and Criminal Evidence Act 1984 (PACE). The Police and Criminal Evidence Act (PACE) 1984 governs search and seizure powers in the UK, including digital evidence.

Answer

Computer Misuse Act 1990

Answer

GDPR (General Data Protection Regulation)

Answer

Human Rights Act 1998

Question 12

An investigator needs to testify in court as an expert witness. Which of the following qualifications is MOST important for the court to accept their testimony?

Accepted Answer

They can demonstrate knowledge, skill, experience, training, or education that will assist the trier of fact.. Under the Federal Rules of Evidence (FRE) Rule 702, a witness qualified as an expert by knowledge, skill, experience, training, or education may testify if their specialized knowledge will assist the trier of fact. Option C directly mirrors this legal standard, making it the most critical qualification for admissibility. Certifications, publications, or years of service are supporting factors but not independently sufficient under the Daubert or Frye standards.

Answer

They have a certification in computer forensics.

Answer

They have published articles in peer-reviewed journals on digital forensics.

Answer

They have been employed as a forensic analyst for over 10 years.

Question 13

Which TWO of the following are essential components of the forensic investigation process? (Select two.)

Accepted Answer

Analysis. Analysis (D) is an essential component because it is the phase where the investigator examines the acquired data to identify evidence, reconstruct events, and draw conclusions. Preservation (E) is equally essential as it ensures the integrity of digital evidence from the moment of collection through the entire investigation, typically by creating a bit-for-bit forensic image (e.g., using dd or FTK Imager) and storing it on write-protected media. Without analysis, no actionable findings emerge; without preservation, evidence is inadmissible due to tampering or spoliation.

Answer

Reporting

Answer

First response

Answer

Chain of custody

Question 14

Which THREE of the following are valid rules of evidence that digital evidence must satisfy to be admissible in court? (Select three.)

Accepted Answer

Admissibility. Option B (Admissibility) is correct because digital evidence must be legally permissible in court, meaning it must be obtained lawfully and not violate constitutional rights. Admissibility is a foundational rule that ensures evidence meets legal standards for consideration by the court, often tied to the Federal Rules of Evidence (FRE) or similar jurisdictional rules. Without admissibility, even the most compelling digital evidence cannot be presented to the jury.

Answer

Best evidence rule

Answer

Chain of custody

Question 15

Which TWO of the following are types of evidence recognized in legal proceedings? (Select two.)

Accepted Answer

Direct evidence. Direct evidence (B) is recognized because it directly proves a fact without requiring any inference, such as a witness testifying they saw the defendant commit the crime. Circumstantial evidence (D) is also recognized as it relies on inference to connect a fact to a conclusion, like a log file showing a user logged in at the time of an incident. Both are admissible in legal proceedings under the Federal Rules of Evidence (FRE) and similar frameworks.

Answer

Corroborative evidence

Answer

Demonstrative evidence

Answer

Primary evidence