CHFI Computer Forensics Fundamentals and Process Practice Test 4 — 15 Questions

Question 1

Which TWO of the following are types of evidence recognized in legal proceedings? (Select two.)

Accepted Answer

Direct evidence. Direct evidence (B) is recognized because it directly proves a fact without requiring any inference, such as a witness testifying they saw the defendant commit the crime. Circumstantial evidence (D) is also recognized as it relies on inference to connect a fact to a conclusion, like a log file showing a user logged in at the time of an incident. Both are admissible in legal proceedings under the Federal Rules of Evidence (FRE) and similar frameworks.

Answer

Corroborative evidence

Answer

Demonstrative evidence

Answer

Primary evidence

Question 2

A security analyst arrives at a crime scene where a computer is turned on and the screen shows a document. What is the FIRST action the analyst should take according to forensic best practices?

Accepted Answer

Photograph the screen and surroundings, then proceed to document the scene.. The first priority at a live crime scene is to preserve the state of the system and its environment through documentation. Photographing the screen and surroundings captures volatile data (e.g., open documents, running processes, network connections) before any interaction alters the system. This aligns with the order of volatility and the principle of minimizing changes to the evidence.

Answer

Create a forensic image of the hard drive using a write blocker.

Answer

Open the Task Manager to check for suspicious processes.

Answer

Immediately unplug the power cord to preserve volatile data.

Question 3

During a forensic investigation, a junior analyst suggests using a software write blocker to image a suspect's hard drive. Which of the following is the PRIMARY concern with relying solely on a software write blocker in a high-stakes legal case?

Accepted Answer

Software write blockers may be circumvented if the operating system is compromised.. Software write blockers are not as reliable as hardware ones because they rely on the operating system, which can be compromised; hardware write blockers provide physical write protection.

Answer

Software write blockers require additional licensing fees.

Answer

Software write blockers are not compatible with all operating systems.

Answer

Software write blockers are too slow for large drives.

Question 4

During a forensic examination, an analyst runs `dcfldd if=/dev/sda of=image.dd hash=sha256 hashwindow=1G` on a suspect drive. What is the PRIMARY advantage of using `hashwindow=1G` over a single hash at the end?

Accepted Answer

It allows verification of the image in 1GB segments, so errors can be pinpointed.. The `hashwindow=1G` option in `dcfldd` computes a SHA-256 hash for every 1 GB segment of the input data, rather than a single hash for the entire image. This allows the analyst to verify the integrity of each segment independently, so if a hash mismatch occurs during later verification, the exact 1 GB block containing the error can be identified and reacquired without reimaging the entire drive.

Answer

It enables the image to be mounted as a loop device.

Answer

It encrypts the image file for security.

Answer

It reduces the total time to create the image.

Question 5

In a corporate investigation, legal counsel issues a litigation hold to preserve electronically stored information (ESI) relevant to a lawsuit. Which of the following is the BEST description of a litigation hold?

Accepted Answer

A notice to employees to preserve all relevant ESI and cease routine deletion.. A litigation hold is a legal notice issued to employees and data custodians instructing them to preserve all relevant electronically stored information (ESI) and to suspend any routine deletion, archiving, or destruction policies. This ensures that potentially discoverable data remains intact and unaltered for the duration of the legal proceeding, directly supporting the duty to preserve evidence under the Federal Rules of Civil Procedure (FRCP Rule 37(e)).

Answer

A form of encryption used to protect evidence during transport.

Answer

A technique used to acquire forensic images without altering the source.

Answer

A court order authorizing law enforcement to seize computers.

Question 6

Locard's exchange principle is fundamental to forensic science. How does this principle apply to computer forensics?

Accepted Answer

Every action on a digital device leaves some trace of evidence.. Locard's principle states that every contact leaves a trace; in digital forensics, this translates to digital traces left behind when a system is accessed.

Answer

Digital evidence is always volatile and must be preserved immediately.

Answer

Evidence must be collected within 24 hours.

Answer

Only physical evidence, such as fingerprints, can be left at a crime scene.

Question 7

A forensic examiner needs to acquire an image of a suspect's laptop hard drive. The laptop is running, and the examiner wants to capture volatile data first. According to best practices, which order of steps should the examiner follow?

Accepted Answer

Capture volatile data, then shut down normally, remove the drive, and image with a write blocker.. Forensic best practices mandate capturing volatile data (e.g., RAM, network connections, running processes) first, as this data is lost on power loss. After capturing volatile data, the examiner should perform a graceful shutdown to preserve file system integrity, then remove the drive and acquire a forensic image using a write blocker to prevent any modification to the original evidence.

Answer

Unplug the laptop, remove the drive, and boot the drive in a forensic workstation.

Answer

Immediately remove the hard drive, then capture RAM from the drive.

Answer

Create a full disk image over the network while the laptop is running.

Question 8

During an investigation, an analyst uses `dd if=/dev/sdb of=evidence.img bs=4k conv=noerror,sync`. What is the purpose of the `conv=noerror,sync` option?

Accepted Answer

It skips read errors and pads the output with zeros to maintain block alignment.. The `conv=noerror,sync` option in `dd` instructs the tool to continue processing even when a read error is encountered (`noerror`) and to pad the output block with zeros (`sync`) to maintain the original block alignment. This ensures that the resulting image file remains the same size as the source device, preserving the forensic integrity of the data layout despite hardware-level read failures.

Answer

It hashes each block to verify integrity.

Answer

It enables synchronous writing to ensure data integrity.

Answer

It compresses the output image to save space.

Question 9

Which US Constitutional amendment primarily governs the legality of searching and seizing digital devices?

Accepted Answer

Fourth Amendment. The Fourth Amendment protects against unreasonable searches and seizures, requiring law enforcement to obtain a warrant based on probable cause before searching or seizing digital devices. This directly governs the legality of accessing data on computers, smartphones, and storage media in forensic investigations.

Answer

Fifth Amendment

Answer

Fourteenth Amendment

Answer

First Amendment

Question 10

A forensic analyst is testifying in court as an expert witness. What is the PRIMARY role of an expert witness in digital forensics?

Accepted Answer

To offer an opinion on the technical facts and assist the trier of fact.. The primary role of an expert witness in digital forensics is to provide an impartial opinion on technical facts, helping the trier of fact (judge or jury) understand complex digital evidence. Unlike a lay witness, an expert is permitted to offer interpretations and conclusions based on their specialized knowledge, as defined under Federal Rule of Evidence 702. This opinion must be based on sufficient facts or data, reliable principles and methods, and a reliable application of those methods to the case.

Answer

To represent the interests of the party that hired them.

Answer

To determine the guilt or innocence of the defendant.

Answer

To present factual findings only, without interpretation.

Question 11

In the context of e-discovery, what does the 'best evidence rule' require regarding digital documents?

Accepted Answer

That the original electronic file or a reliable duplicate be produced.. The best evidence rule, codified in Federal Rule of Evidence 1002, requires the original writing, recording, or photograph to prove its content unless otherwise provided. In e-discovery, an original electronic file or a reliable duplicate (e.g., a bit-for-bit forensic image verified by a hash such as MD5 or SHA-1) satisfies this rule because the duplicate is functionally equivalent to the original for evidentiary purposes.

Answer

That all evidence be authenticated by a witness.

Answer

That only paper copies of digital documents are admissible.

Answer

That metadata is preserved in all copies.

Question 12

A first responder arrives at a scene where a computer is suspected to contain evidence of fraud. The computer is turned on and a file is open. Which of the following actions should the responder AVOID?

Accepted Answer

Double-clicking the open file to fully view its contents.. Double-clicking the open file alters its last accessed timestamp and may modify file metadata (e.g., NTFS $STANDARD_INFORMATION or $FILE_NAME attributes), potentially destroying volatile evidence. It also risks executing malicious code or changing the file's content if the application auto-saves. The first responder must preserve the current state and capture a forensic image before any interaction with active data.

Answer

Photographing the screen and documenting open windows.

Answer

Noting the time and date from the system clock.

Answer

Using a hardware write blocker to image the hard drive after shutdown.

Question 13

Which TWO of the following are essential components of the rules of evidence for digital evidence to be admissible in court? (Choose two.)

Accepted Answer

Authenticity. Authenticity is a core component of the rules of evidence because it requires the proponent to show that the digital evidence is what it claims to be and has not been tampered with. For digital evidence, this is typically established through cryptographic hash verification (e.g., SHA-256) and a documented chain of custody. Without authenticity, the court cannot rely on the evidence's integrity, making it inadmissible.

Answer

Originality

Answer

Expediency

Answer

Complexity

Question 14

Which THREE of the following are considered types of evidence under the rules of evidence? (Choose three.)

Accepted Answer

Circumstantial evidence. Circumstantial evidence is a recognized type of evidence under the rules of evidence because it relies on an inference to connect a fact to a conclusion, rather than directly proving the fact. In digital forensics, circumstantial evidence might include log entries showing a user logged in at the time of an incident, which indirectly suggests involvement. It is admissible as long as the chain of inferences is reasonable and supported by other facts.

Answer

Corroborating evidence

Answer

Best evidence

Question 15

A first responder arrives at a scene where a computer is turned on and a user is logged in. What is the FIRST action the responder should take to preserve volatile evidence?

Accepted Answer

Collect volatile data such as RAM contents and running processes. Volatile data (e.g., RAM contents, running processes, network connections) is lost when power is removed. The first responder must collect this data before any shutdown or hardware removal, following the order of volatility (RFC 3227). This preserves critical evidence that cannot be recovered later.

Answer

Photograph the screen and then shut down the system normally

Answer

Immediately unplug the power cord to prevent data alteration

Answer

Remove the hard drive immediately for forensic imaging