CHFI Computer Forensics Fundamentals and Process Practice Test 5 — 15 Questions

Question 1

A security analyst notices that a log file on a Linux server shows repeated failed SSH login attempts from an external IP address, but no successful login from that IP. However, the /var/log/auth.log file has been recently truncated. Which type of evidence is the truncated log file?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Circumstantial evidence. The truncated log file is circumstantial evidence. While the truncation itself is a directly observable fact, the conclusion that someone intentionally altered or destroyed the log to conceal failed SSH attempts requires inference. Other explanations (e.g., log rotation, system error) are possible. Direct evidence proves a fact without inference, such as an eyewitness testimony or a video recording of the tampering. Therefore, the truncated log file is circumstantial evidence.

Answer

Hearsay evidence

Answer

Best evidence

Answer

Direct evidence

Question 2

During an e-discovery process, a legal hold is issued. What is the PRIMARY purpose of a legal hold?

Accepted Answer

To prevent the destruction or alteration of potentially relevant evidence. The primary purpose of a legal hold is to preserve all forms of potentially relevant evidence by suspending normal data retention and deletion policies. This ensures that data, including emails, documents, and logs, is not altered or destroyed during the e-discovery process, which is critical for maintaining the integrity of evidence for litigation.

Answer

To authorize forensic examiners to image all company devices

Answer

To encrypt all data to prevent unauthorized access during litigation

Answer

To notify the opposing party of the intent to use electronic evidence

Question 3

A forensic investigator uses FTK Imager to create a forensic image of a suspect's laptop. The acquisition generates both an E01 file and a corresponding hash file. Which statement accurately describes the integrity verification process in FTK Imager?

Accepted Answer

The image file includes embedded hash values that can be verified later to ensure data integrity. FTK Imager embeds hash values (MD5 and SHA1) directly into the E01 file during acquisition. These embedded hashes can be verified later by FTK Imager or compatible tools to confirm that the image has not been altered, ensuring data integrity without relying on an external hash file.

Answer

The hash is computed only when the image is mounted for analysis, not during acquisition

Answer

FTK Imager does not support hash verification; a separate tool must be used

Answer

The hash is compared to a known-good hash from the manufacturer's database

Question 4

According to Locard's exchange principle, which of the following is MOST relevant to digital forensics?

Accepted Answer

When a person interacts with a digital device, they leave digital traces that can be recovered. Locard's exchange principle states that every contact leaves a trace. In digital forensics, this translates to the fact that when a person interacts with a digital device (e.g., opening a file, browsing a website, or typing a command), they leave digital traces such as log entries, metadata, temporary files, or registry artifacts. These traces can be recovered and analyzed to reconstruct user activity, making option B the most relevant application of the principle in this context.

Answer

The chain of custody must be maintained for all evidence

Answer

Every crime scene contains at least one latent fingerprint

Answer

Digital evidence is always stored in non-volatile memory

Question 5

An investigator creates a forensic image using dcfldd with the following command: dcfldd if=/dev/sdb of=image.dd hash=sha256 hashwindow=10M hashlog=hash.txt. What is the effect of the 'hashwindow=10M' parameter?

Accepted Answer

It divides the output into 10 MB chunks and hashes each chunk, logging the results. The `hashwindow=10M` parameter in dcfldd instructs the tool to compute a SHA-256 hash for every 10 MB segment (window) of the input data as it is being copied, and then log each segment's hash to the specified hashlog file. This allows the investigator to verify the integrity of individual chunks of the forensic image, which is useful for detecting corruption or tampering in specific regions of the image without rehashing the entire file.

Answer

It sets the input buffer size to 10 MB for performance

Answer

It verifies the hash of the input device in 10 MB windows before copying

Answer

It causes the tool to hash the entire image only after completion

Question 6

Which of the following is a key requirement for digital evidence to be considered admissible in court?

Accepted Answer

The evidence must be authentic and its integrity must be verifiable. Digital evidence must be authentic and its integrity verifiable to meet the legal standard of admissibility, as established by rules such as the Federal Rules of Evidence (FRE 901) and the Daubert standard. Authentication requires proving that the evidence is what it claims to be, typically through a hash value (e.g., MD5, SHA-1, or SHA-256) computed before and after analysis to ensure no tampering occurred. Without verifiable integrity, the evidence could be challenged as altered, making it inadmissible regardless of how it was collected.

Answer

The evidence must have been collected by a law enforcement officer

Answer

The evidence must be stored on a write-blocked device

Answer

The evidence must be encrypted to ensure confidentiality

Question 7

Which THREE of the following correctly describe the rules of evidence as applied to digital forensics? (Select three.)

Accepted Answer

Evidence must be relevant to the case and obtained through lawful means. Option A is correct because the fundamental rules of evidence require that any item, including digital artifacts, be both relevant to the matter at hand and collected through lawful means (e.g., valid warrants, consent, or legal exceptions), otherwise it can be excluded. Option D is correct because the evidence must be complete and not misleading — partial or selectively presented data (such as a truncated log or an edited image) can create a false impression and is therefore inadmissible or subject to challenge. Option E is correct because digital evidence must be authentic (shown to be what it purports to be) and its integrity must be verifiable, typically through hash values (e.g., MD5, SHA-256) and a documented chain of custody. Option B is incorrect because circumstantial evidence is generally admissible in both criminal and civil cases, including digital forensics, and is often used to infer facts when direct evidence is unavailable. Option C is incorrect because hearsay is not always inadmissible; numerous exceptions and exemptions exist (e.g., business records, excited utterances, and machine-generated records), and digital evidence frequently falls under such exceptions.

Answer

Circumstantial evidence is not allowed in digital forensics cases

Answer

Hearsay evidence is always inadmissible in court

Question 8

Which TWO of the following are valid reasons for using a hardware write blocker over a software write blocker? (Select two.)

Accepted Answer

Hardware write blockers operate at the physical layer and are OS-independent. Option C is correct because hardware write blockers sit inline on the storage interface (e.g., SATA, SAS, USB, or IDE) and enforce write protection at the physical/electrical layer, so they function independently of the operating system and require no drivers or host OS support. Option D is correct because this inline hardware design provides a true physical barrier: write commands are intercepted and blocked before they reach the suspect drive, ensuring the evidence disk cannot be altered. Option A is not a valid reason, since hardware blockers generally do not offer faster transfer speeds than software blockers and speed is not their purpose. Option B is incorrect because a hardware blocker cannot be bypassed by malware on the forensic workstation; that risk applies to software write blockers running on a compromised OS. Option E is incorrect because hardware write blockers are typically more expensive than software write blockers, not cheaper.

Answer

Hardware write blockers support faster transfer speeds than software blockers

Answer

Hardware write blockers can be bypassed by malware on the forensic workstation

Answer

Hardware write blockers are cheaper than software solutions

Question 9

A first responder arrives at a suspected intrusion scene. A desktop computer is powered on and logged in. The user claims they saw suspicious files being copied to a USB drive. Which of the following should the first responder do FIRST?

Accepted Answer

Capture volatile data such as memory and running processes.. In a live intrusion where a USB transfer is in progress, volatile data (memory, running processes, network connections) is the most ephemeral and will be lost if the system is powered down. Capturing this data first preserves evidence of the malicious activity, such as the process that initiated the copy and any network connections, which is critical for reconstructing the attack. This follows the order of volatility (RFC 3227), which mandates capturing volatile data before non-volatile data.

Answer

Power off the computer immediately to prevent further data loss.

Answer

Photograph the scene and document everything in a notebook.

Answer

Create a forensic image of the hard drive using a write blocker.

Question 10

Which of the following is the BEST definition of computer forensics?

Accepted Answer

The application of investigative and analytical techniques to gather and preserve evidence from digital devices suitable for presentation in a court of law.. Computer forensics is fundamentally the application of investigative and analytical techniques to collect, preserve, and analyze digital evidence in a manner that maintains its integrity and admissibility in a court of law. This definition encompasses the entire forensic process, from acquisition through chain of custody to presentation, aligning with the CHFI framework's emphasis on legal and procedural rigor.

Answer

The use of software tools to scan for malware on a computer system.

Answer

The process of recovering deleted files from a hard drive.

Answer

The process of securing a computer network from unauthorized access.

Question 11

An analyst performs forensic imaging using the command: dcfldd if=/dev/sda of=image.dd hash=sha256 hashlog=hash.txt bs=4096 conv=noerror,sync. What is the PRIMARY purpose of the 'hash=sha256' and 'hashlog=hash.txt' parameters?

Accepted Answer

To ensure the image is an exact bit-for-bit copy and provide an integrity check.. The `hash=sha256` parameter instructs dcfldd to compute a SHA-256 hash of the input data as it is read, and `hashlog=hash.txt` writes that hash value to a separate file. This allows the analyst to later verify that the forensic image (`image.dd`) is an exact bit-for-bit copy of the source (`/dev/sda`) by recomputing the hash and comparing it to the stored value, ensuring data integrity and admissibility in court.

Answer

To encrypt the image file to prevent unauthorized access.

Answer

To compress the image to save disk space.

Answer

To split the image into smaller chunks for easier transport.

Question 12

During a forensic investigation, a lawyer objects to the admissibility of a log file on the grounds that it is hearsay. Which of the following is the BEST argument to overcome this objection?

Accepted Answer

The log file qualifies as a business record exception to the hearsay rule.. The log file is admissible under the business records exception to the hearsay rule (Federal Rule of Evidence 803(6)). This exception applies because logs are created automatically or by a person with knowledge, near the time of the event, in the regular course of business, and it is the regular practice to make such records. In digital forensics, system logs (e.g., Windows Event Logs, syslog) are routinely admitted under this exception, as they are generated by the system without the declarant's bias or memory issues.

Answer

The log file is circumstantial evidence, not hearsay.

Answer

The log file is direct evidence of the intrusion.

Answer

The log file is the best evidence because it is an original record.

Question 13

An investigator needs to acquire data from a suspect's hard drive without altering any data. Which tool is MOST appropriate to ensure write-blocking at the hardware level?

Accepted Answer

Tableau Forensic Bridge (hardware write-blocker). A hardware write-blocker like the Tableau Forensic Bridge sits between the suspect drive and the forensic workstation at the physical layer, intercepting and blocking any write commands (e.g., ATA WRITE DMA, SCSI WRITE) before they reach the drive. This ensures that no data—including metadata, timestamps, or file system artifacts—is altered during acquisition, which is critical for maintaining evidentiary integrity. Software-based blockers can be bypassed by the OS or a malicious driver, making hardware-level blocking the gold standard in forensic acquisition.

Answer

FTK Imager (software write-blocker)

Answer

dd command with 'iflag=noatime'

Answer

EnCase software acquisition module

Question 14

What is the PRIMARY purpose of a chain of custody document in a forensic investigation?

Accepted Answer

To provide a chronological record of who handled the evidence, when, and why.. The chain of custody document is the foundational record that ensures evidence integrity and admissibility in court. Its primary purpose is to create a chronological, unbroken log of every person who handled the evidence, the exact time and date of each transfer, and the reason for the transfer. This directly supports the legal requirement to prove that the evidence has not been tampered with or altered from the moment of seizure to its presentation in court.

Answer

To document the tools used during the investigation.

Answer

To list all the files found on the suspect's computer.

Answer

To authorize the search and seizure of digital evidence.

Question 15

A forensic investigator uses the 'dd' command to create a forensic image. The original drive has a SHA-256 hash of a1b2c3... and the image produces the same hash. Which rule of evidence does this satisfy?

Accepted Answer

Authenticity. The SHA-256 hash of the original drive matches the hash of the forensic image, proving that the image is an exact, unaltered copy of the original. This satisfies the rule of authenticity, which requires that evidence be shown to be the same as what was originally seized and not tampered with. The hash acts as a digital fingerprint, and matching hashes confirm the integrity and origin of the evidence.

Answer

Reliability

Answer

Completeness

Answer

Admissibility