CHFI Computer Forensics Fundamentals and Process Practice Test 4 — 15 Questions

Question 1

A first responder arrives at a crime scene where a computer is turned on. What should the responder do FIRST?

Accepted Answer

Photograph the scene and document everything. The first priority at a live crime scene is to preserve the state of the evidence through proper documentation and photography. This ensures an accurate record of the computer's condition, including screen contents, peripheral connections, and environmental context, before any volatile data is lost or altered. The CHFI methodology emphasizes that documentation precedes any seizure or data acquisition steps to maintain chain of custody and evidentiary integrity.

Answer

Run antivirus software to check for malware

Answer

Immediately disconnect the power cord

Answer

Copy all files from the hard drive

Question 2

During a forensic investigation, an analyst creates a bit-for-bit copy of a suspect's hard drive using the 'dd' command with the following parameters: dd if=/dev/sda of=/evidence/image.dd bs=4k conv=noerror,sync. What is the purpose of 'conv=noerror,sync'?

Accepted Answer

To ignore read errors and pad with zeros. 'conv=noerror,sync' tells dd to continue reading even when encountering read errors (noerror) and to pad the output with zeros (sync) to maintain the same total size as the original drive. This ensures a complete forensic image is created despite bad sectors, preserving the integrity of the acquisition for analysis.

Answer

To hash the output image

Answer

To ensure the command runs with superuser privileges

Answer

To compress the output image

Question 3

Which type of evidence is a witness's statement that they saw someone log into a computer?

Accepted Answer

Direct evidence. Direct evidence is testimony or other proof that directly proves a fact without requiring any inference. A witness's statement that they saw someone log into a computer is direct evidence because it is based on the witness's firsthand observation of the act itself, not on any deduction or assumption. In digital forensics, direct evidence can include eyewitness accounts of specific actions on a system, such as entering credentials or accessing files.

Answer

Hearsay evidence

Answer

Best evidence

Answer

Circumstantial evidence

Question 4

A forensic analyst needs to collect evidence from a running Windows system without altering the system state. Which tool should they use to acquire volatile memory?

Accepted Answer

DumpIt. DumpIt is a lightweight memory acquisition tool designed specifically for capturing the contents of volatile memory (RAM) on a running Windows system. It minimizes interaction with the system to avoid altering the memory state, making it ideal for forensic collection of live evidence.

Answer

Wireshark

Answer

dd

Answer

Tableau write blocker

Question 5

A security analyst discovers unauthorized access to a server. The incident response team decides to preserve evidence. Which of the following actions is MOST critical to ensure the admissibility of evidence in court?

Accepted Answer

Documenting the chain of custody. Chain of custody documentation is the most critical action for evidence admissibility because it establishes a verifiable record of who handled the evidence, when, and under what conditions, ensuring the evidence has not been tampered with. Without a proper chain of custody, even technically sound evidence can be ruled inadmissible under rules like Federal Rule of Evidence 901. In forensic practice, this involves logging every access with timestamps, digital signatures, and hash values (e.g., SHA-256) to maintain integrity.

Answer

Disconnecting the server from the network

Answer

Running a full antivirus scan on the server

Answer

Taking screenshots of the server's screen

Question 6

In a UK-based investigation, the police seize a computer without a warrant. The suspect's lawyer argues that the evidence is inadmissible because it violates which law?

Accepted Answer

Police and Criminal Evidence Act (PACE). The Police and Criminal Evidence Act (PACE) 1984 governs the powers of police in England and Wales to search, seize, and retain evidence. Without a warrant, the seizure of a computer likely violates PACE's requirements for lawful entry and seizure, making the evidence inadmissible under UK law.

Answer

Fourth Amendment to the US Constitution

Answer

General Data Protection Regulation (GDPR)

Answer

Computer Misuse Act

Question 7

An analyst runs 'dcfldd if=/dev/sdb of=/evidence/disk.dd hash=sha256 hashlog=/evidence/hash.log' on a Linux system. What is the primary advantage of using dcfldd over plain dd for forensic imaging?

Accepted Answer

It can compute hashes on-the-fly and log them. D is correct because dcfldd is a specialized forensic version of dd that can compute cryptographic hashes (e.g., SHA-256) on-the-fly while writing the image, and log those hashes to a separate file (hashlog). This ensures data integrity verification without requiring a separate post-imaging hashing pass, which is a critical requirement in forensic imaging to prove the acquired image is an exact bit-for-bit copy of the source.

Answer

It can acquire memory dumps from live systems

Answer

It supports compression of the output image

Answer

It automatically creates a write-blocked connection

Question 8

Which of the following BEST describes the purpose of a legal hold in e-discovery?

Accepted Answer

To suspend the deletion of data that may be relevant to upcoming litigation. A legal hold (also known as a litigation hold) is a directive that suspends the normal deletion or destruction of data that may be relevant to pending or reasonably anticipated litigation. In e-discovery, this ensures that potentially relevant electronically stored information (ESI) is preserved and not altered or destroyed, thereby preventing spoliation of evidence. The purpose is to maintain the integrity and availability of data for discovery obligations under rules such as FRCP Rule 37(e).

Answer

To encrypt data for secure storage

Answer

To obtain a search warrant for digital evidence

Answer

To permanently delete irrelevant data

Question 9

A forensic examiner uses a hardware write blocker when imaging a suspect's hard drive. What is the primary function of a hardware write blocker?

Accepted Answer

To prevent any data from being written to the suspect drive. A hardware write blocker is a device placed between the suspect drive and the forensic workstation that intercepts and blocks any write commands from the host system. Its primary function is to ensure that no data—such as file system metadata, temporary files, or operating system writes—can be written to the suspect drive, thereby preserving the original evidence in a forensically sound manner. This is critical for maintaining the integrity of the evidence and ensuring it is admissible in court.

Answer

To encrypt the data on the suspect drive

Answer

To connect the suspect drive via USB

Answer

To increase the speed of data acquisition

Question 10

Which TWO of the following are requirements for evidence to be admissible in court? (Select two.)

Accepted Answer

Evidence must be reliable. The rules of evidence require that evidence be admissible, reliable, complete, and authentic. In many jurisdictions, evidence must be relevant and reliable to be admissible. Completeness and authenticity are also key.

Answer

Evidence must be encrypted

Answer

Evidence must be stored on a write-blocked drive

Answer

Evidence must be obtained by the police

Question 11

Which THREE of the following are steps in the forensic investigation process? (Select three.)

Accepted Answer

Analysis. In the forensic investigation process, First response (D) is the initial step where the investigator secures the scene, preserves volatile evidence, and documents the state of systems to prevent contamination. Analysis (A) follows, where the collected data is examined using validated tools and techniques to reconstruct events and identify artifacts relevant to the incident. Reporting (C) is the final phase, where findings, methods, and conclusions are documented in a clear, defensible manner suitable for legal or administrative proceedings. Sentencing (B) is a judicial action that occurs after a trial, not part of the forensic investigation itself, and Deletion of irrelevant data (E) is not a recognized step—forensic examiners preserve all potential evidence and may filter for relevance during analysis, but never delete data as part of the process.

Answer

Sentencing

Answer

Deletion of irrelevant data

Question 12

Which TWO of the following are types of write blockers used in forensic imaging? (Select two.)

Accepted Answer

Hardware write blocker. Hardware write blockers (D) are physical devices that sit between the suspect drive and the forensic workstation, intercepting the ATA/SCSI/NVMe command set and permitting only read commands to pass through, which prevents any modification of the evidence drive. Software write blockers (E) are drivers or kernel modules (for example, on Linux, mounting with the read-only option or using tools like the 'blockdev --setro' command) that intercept I/O requests at the OS level and block write operations to the protected device. These two are the recognized categories of write blockers in forensic imaging because they operate at the hardware and software layers respectively. Encryption write blockers (A) are not a write-blocking type — encryption is a data protection mechanism, not a means of preventing writes during acquisition. Network write blockers (B) do not exist as a forensic write-blocker category, since network interfaces are not the medium being protected during imaging. Hash write blockers (C) are also not a real category; hashing (e.g., MD5/SHA-256) is used to verify integrity after imaging, not to block writes.

Answer

Encryption write blocker

Answer

Network write blocker

Answer

Hash write blocker

Question 13

During a forensic investigation, an analyst uses a hardware write blocker to connect a suspect hard drive to a forensic workstation. Which of the following is the PRIMARY reason for using a write blocker?

Accepted Answer

To prevent any modification to the suspect drive during acquisition. The primary reason for using a hardware write blocker is to ensure that the suspect drive is connected in a read-only manner, preventing any write operations from the forensic workstation from reaching the drive. This preserves the integrity of the evidence by guaranteeing that no data is altered, added, or deleted during the acquisition process, which is a fundamental requirement for admissibility in legal proceedings.

Answer

To allow the suspect drive to be mounted as read-write for analysis

Answer

To decrypt the drive automatically without the key

Answer

To speed up the imaging process by caching writes

Question 14

A forensic analyst creates a forensic image of a hard drive using the dd command: dd if=/dev/sda of=/evidence/image.dd bs=4096 conv=noerror,sync. What is the purpose of the 'conv=noerror,sync' option?

Accepted Answer

It continues on read errors and pads the output with zeros to maintain the same size. The `conv=noerror,sync` option in the `dd` command instructs the tool to continue processing when a read error is encountered (`noerror`) and to pad the output block with zeros (`sync`) to maintain the same total size as the original drive. This ensures that the forensic image remains a bit-for-bit copy in terms of size, even if physical sectors are unreadable, preserving the integrity of the acquisition process for analysis.

Answer

It verifies the hash of the image after creation

Answer

It synchronizes the output with the input to ensure data integrity

Answer

It enables direct memory access for faster imaging

Question 15

Which of the following BEST defines the chain of custody in digital forensics?

Accepted Answer

The chronological documentation of evidence handling, transfer, and analysis. The chain of custody is a formal, chronological record that documents every instance of evidence handling, transfer, and analysis from the moment of seizure through its entire lifecycle. This documentation is critical to prove that evidence has not been tampered with, altered, or corrupted, thereby maintaining its admissibility in legal proceedings under rules such as Federal Rule of Evidence 901.

Answer

The legal authority required to seize evidence

Answer

The order in which forensic tools are applied to evidence

Answer

The physical security measures used to store evidence