CHFI Computer Forensics Fundamentals and Process Practice Test 5 — 15 Questions

Question 1

A security analyst arrives at a crime scene where a computer is turned on and the screen shows a document. What is the FIRST action the analyst should take according to forensic best practices?

Accepted Answer

Photograph the screen and surroundings, then proceed to document the scene.. Option D is correct because the first priority at a live crime scene is to preserve the state of the system and its environment through documentation. Photographing the screen and surroundings captures volatile data (e.g., open documents, running processes, network connections) before any interaction alters the system. This aligns with the order of volatility and the principle of minimizing changes to the evidence.

Answer

Create a forensic image of the hard drive using a write blocker.

Answer

Open the Task Manager to check for suspicious processes.

Answer

Immediately unplug the power cord to preserve volatile data.

Question 2

During a forensic investigation, a junior analyst suggests using a software write blocker to image a suspect's hard drive. Which of the following is the PRIMARY concern with relying solely on a software write blocker in a high-stakes legal case?

Accepted Answer

Software write blockers may be circumvented if the operating system is compromised.. Software write blockers are not as reliable as hardware ones because they rely on the operating system, which can be compromised; hardware write blockers provide physical write protection.

Answer

Software write blockers require additional licensing fees.

Answer

Software write blockers are not compatible with all operating systems.

Answer

Software write blockers are too slow for large drives.

Question 3

A forensic investigator is documenting evidence for a case. What is the PRIMARY purpose of maintaining an unbroken chain of custody for digital evidence?

Accepted Answer

To prove that the evidence has not been altered or tampered with.. The primary purpose of maintaining an unbroken chain of custody is to establish the integrity and authenticity of digital evidence by documenting every person who handled it, every transfer, and every access event. This documentation allows the court to verify that the evidence has not been altered, tampered with, or corrupted from the moment of seizure through analysis and presentation. Without a provable chain of custody, the evidence may be deemed inadmissible under rules like Federal Rule of Evidence 901 or similar standards in other jurisdictions.

Answer

To track the storage location of the evidence.

Answer

To speed up the investigation process.

Answer

To assign responsibility for the evidence to a single individual.

Question 4

During a forensic examination, an analyst runs `dcfldd if=/dev/sda of=image.dd hash=sha256 hashwindow=1G` on a suspect drive. What is the PRIMARY advantage of using `hashwindow=1G` over a single hash at the end?

Accepted Answer

It allows verification of the image in 1GB segments, so errors can be pinpointed.. The `hashwindow=1G` option in `dcfldd` computes a SHA-256 hash for every 1 GB segment of the input data, rather than a single hash for the entire image. This allows the analyst to verify the integrity of each segment independently, so if a hash mismatch occurs during later verification, the exact 1 GB block containing the error can be identified and reacquired without reimaging the entire drive.

Answer

It enables the image to be mounted as a loop device.

Answer

It encrypts the image file for security.

Answer

It reduces the total time to create the image.

Question 5

In a corporate investigation, legal counsel issues a litigation hold to preserve electronically stored information (ESI) relevant to a lawsuit. Which of the following is the BEST description of a litigation hold?

Accepted Answer

A notice to employees to preserve all relevant ESI and cease routine deletion.. A litigation hold is a legal directive to prevent spoliation of evidence by suspending normal data retention and deletion policies.

Answer

A form of encryption used to protect evidence during transport.

Answer

A technique used to acquire forensic images without altering the source.

Answer

A court order authorizing law enforcement to seize computers.

Question 6

Locard's exchange principle is fundamental to forensic science. How does this principle apply to computer forensics?

Accepted Answer

Every action on a digital device leaves some trace of evidence.. Locard's principle states that every contact leaves a trace; in digital forensics, this translates to digital traces left behind when a system is accessed.

Answer

Digital evidence is always volatile and must be preserved immediately.

Answer

Evidence must be collected within 24 hours.

Answer

Only physical evidence, such as fingerprints, can be left at a crime scene.

Question 7

A forensic examiner needs to acquire an image of a suspect's laptop hard drive. The laptop is running, and the examiner wants to capture volatile data first. According to best practices, which order of steps should the examiner follow?

Accepted Answer

Capture volatile data, then shut down normally, remove the drive, and image with a write blocker.. Option D is correct because forensic best practices mandate capturing volatile data (e.g., RAM, network connections, running processes) first, as this data is lost on power loss. After capturing volatile data, the examiner should perform a graceful shutdown to preserve file system integrity, then remove the drive and acquire a forensic image using a write blocker to prevent any modification to the original evidence.

Answer

Unplug the laptop, remove the drive, and boot the drive in a forensic workstation.

Answer

Immediately remove the hard drive, then capture RAM from the drive.

Answer

Create a full disk image over the network while the laptop is running.

Question 8

During an investigation, an analyst uses `dd if=/dev/sdb of=evidence.img bs=4k conv=noerror,sync`. What is the purpose of the `conv=noerror,sync` option?

Accepted Answer

It skips read errors and pads the output with zeros to maintain block alignment.. The `conv=noerror,sync` option in `dd` instructs the tool to continue processing even when a read error is encountered (`noerror`) and to pad the output block with zeros (`sync`) to maintain the original block alignment. This ensures that the resulting image file remains the same size as the source device, preserving the forensic integrity of the data layout despite hardware-level read failures.

Answer

It hashes each block to verify integrity.

Answer

It enables synchronous writing to ensure data integrity.

Answer

It compresses the output image to save space.

Question 9

Which US Constitutional amendment primarily governs the legality of searching and seizing digital devices?

Accepted Answer

Fourth Amendment. The Fourth Amendment protects against unreasonable searches and seizures, requiring law enforcement to obtain a warrant based on probable cause before searching or seizing digital devices. This directly governs the legality of accessing data on computers, smartphones, and storage media in forensic investigations.

Answer

Fifth Amendment

Answer

Fourteenth Amendment

Answer

First Amendment

Question 10

A forensic analyst is testifying in court as an expert witness. What is the PRIMARY role of an expert witness in digital forensics?

Accepted Answer

To offer an opinion on the technical facts and assist the trier of fact.. Option C is correct because the primary role of an expert witness in digital forensics is to provide an impartial opinion on technical facts, helping the trier of fact (judge or jury) understand complex digital evidence. Unlike a lay witness, an expert is permitted to offer interpretations and conclusions based on their specialized knowledge, as defined under Federal Rule of Evidence 702. This opinion must be based on sufficient facts or data, reliable principles and methods, and a reliable application of those methods to the case.

Answer

To represent the interests of the party that hired them.

Answer

To determine the guilt or innocence of the defendant.

Answer

To present factual findings only, without interpretation.

Question 11

In the context of e-discovery, what does the 'best evidence rule' require regarding digital documents?

Accepted Answer

That the original electronic file or a reliable duplicate be produced.. The best evidence rule, codified in Federal Rule of Evidence 1002, requires the original writing, recording, or photograph to prove its content unless otherwise provided. In e-discovery, an original electronic file or a reliable duplicate (e.g., a bit-for-bit forensic image verified by a hash such as MD5 or SHA-1) satisfies this rule because the duplicate is functionally equivalent to the original for evidentiary purposes.

Answer

That all evidence be authenticated by a witness.

Answer

That only paper copies of digital documents are admissible.

Answer

That metadata is preserved in all copies.

Question 12

A first responder arrives at a scene where a computer is suspected to contain evidence of fraud. The computer is turned on and a file is open. Which of the following actions should the responder AVOID?

Accepted Answer

Double-clicking the open file to fully view its contents.. Double-clicking files changes file access times and may modify data, which should be avoided to preserve evidence integrity.

Answer

Photographing the screen and documenting open windows.

Answer

Noting the time and date from the system clock.

Answer

Using a hardware write blocker to image the hard drive after shutdown.

Question 13

Which TWO of the following are essential components of the rules of evidence for digital evidence to be admissible in court? (Choose two.)

Accepted Answer

Authenticity. Authenticity is a core component of the rules of evidence because it requires the proponent to show that the digital evidence is what it claims to be and has not been tampered with. For digital evidence, this is typically established through cryptographic hash verification (e.g., SHA-256) and a documented chain of custody. Without authenticity, the court cannot rely on the evidence's integrity, making it inadmissible.

Answer

Originality

Answer

Expediency

Answer

Complexity

Question 14

Which THREE of the following are considered types of evidence under the rules of evidence? (Choose three.)

Accepted Answer

Circumstantial evidence. Circumstantial evidence is a recognized type of evidence under the rules of evidence because it relies on an inference to connect a fact to a conclusion, rather than directly proving the fact. In digital forensics, circumstantial evidence might include log entries showing a user logged in at the time of an incident, which indirectly suggests involvement. It is admissible as long as the chain of inferences is reasonable and supported by other facts.

Answer

Corroborating evidence

Answer

Best evidence

Question 15

Which TWO of the following hashing algorithms are commonly used to verify the integrity of forensic images? (Choose two.)

Accepted Answer

SHA-1. SHA-1 and MD5 are the two hashing algorithms most commonly used in forensic practice to verify the integrity of forensic images. They produce a fixed-size hash value (160-bit for SHA-1, 128-bit for MD5) that acts as a digital fingerprint; if the hash of the original image matches the hash of a copy, the data is considered unchanged. Despite known collision weaknesses, they remain the de facto standards in tools like FTK Imager, EnCase, and dd due to their speed and widespread tool support.

Answer

SHA-3

Answer

RSA

Answer

AES