CHFI Computer Forensics Fundamentals and Process Practice Test 6 — 15 Questions

Question 1

According to Locard's exchange principle, which of the following is TRUE in a digital forensic context?

Accepted Answer

A suspect will always leave traces of their activity on a computer system.. In a digital forensic context, Locard's exchange principle holds that whenever a suspect interacts with a computer system, they will inevitably leave traces of that activity. This can include artifacts such as registry entries, log files, prefetch files, browser history, or metadata, even if the user attempts to delete or obfuscate their actions. The principle underpins the entire field of digital forensics, asserting that digital interaction always produces residual data.

Answer

Only physical evidence, not digital evidence, is subject to exchange.

Answer

Digital evidence is always volatile and cannot be preserved.

Answer

The absence of evidence proves the suspect is innocent.

Question 2

During a forensic examination of a Windows system, the investigator finds a file named 'notes.txt' that contains a list of passwords. The file's last modified timestamp is before the incident date, but its last accessed timestamp is during the incident. Which type of evidence is this file considered?

Accepted Answer

Circumstantial evidence. The file 'notes.txt' has a last modified timestamp before the incident but a last accessed timestamp during the incident. This indicates the file was opened or read during the incident, but not modified. Such indirect evidence suggests the attacker may have viewed the passwords, but does not directly prove the act of using them. Therefore, it is circumstantial evidence because it requires inference to connect the file access to the incident.

Answer

Best evidence

Answer

Hearsay evidence

Answer

Direct evidence

Question 3

An organization in the UK suspects an employee of data theft. The IT manager wants to search the employee's company-issued laptop without consent. Which law primarily governs this action?

Accepted Answer

GDPR (General Data Protection Regulation). The primary law governing an employer's search of an employee's company-issued laptop without consent is the GDPR/UK Data Protection Act, as the search involves processing the employee's personal data and workplace privacy. The Computer Misuse Act 1990 primarily addresses unauthorized access to computer systems; it is not the most applicable law when the IT manager is acting with the employer's authority on company-owned equipment. PACE 1984 applies to police searches, and the Human Rights Act 1998 sets out broader privacy principles but is not the primary law for this internal employer action.

Answer

Police and Criminal Evidence Act 1984 (PACE)

Answer

Computer Misuse Act 1990

Answer

Human Rights Act 1998

Question 4

An investigator needs to testify in court as an expert witness. Which of the following qualifications is MOST important for the court to accept their testimony?

Accepted Answer

They can demonstrate knowledge, skill, experience, training, or education that will assist the trier of fact.. Under the Federal Rules of Evidence (FRE) Rule 702, a witness qualified as an expert by knowledge, skill, experience, training, or education may testify if their specialized knowledge will assist the trier of fact. Option C directly mirrors this legal standard, making it the most critical qualification for admissibility. Certifications, publications, or years of service are supporting factors but not independently sufficient under the Daubert or Frye standards.

Answer

They have a certification in computer forensics.

Answer

They have published articles in peer-reviewed journals on digital forensics.

Answer

They have been employed as a forensic analyst for over 10 years.

Question 5

A security analyst arrives at a crime scene where a computer is turned on and the screen shows a document. What is the FIRST action the analyst should take according to forensic best practices?

Accepted Answer

Photograph the screen and surroundings, then proceed to document the scene.. The first priority at a live crime scene is to preserve the state of the system and its environment through documentation. Photographing the screen and surroundings captures volatile data (e.g., open documents, running processes, network connections) before any interaction alters the system. This aligns with the order of volatility and the principle of minimizing changes to the evidence.

Answer

Create a forensic image of the hard drive using a write blocker.

Answer

Open the Task Manager to check for suspicious processes.

Answer

Immediately unplug the power cord to preserve volatile data.

Question 6

During a forensic investigation, a junior analyst suggests using a software write blocker to image a suspect's hard drive. Which of the following is the PRIMARY concern with relying solely on a software write blocker in a high-stakes legal case?

Accepted Answer

Software write blockers may be circumvented if the operating system is compromised.. Software write blockers are not as reliable as hardware ones because they rely on the operating system, which can be compromised; hardware write blockers provide physical write protection.

Answer

Software write blockers require additional licensing fees.

Answer

Software write blockers are not compatible with all operating systems.

Answer

Software write blockers are too slow for large drives.

Question 7

A forensic investigator is documenting evidence for a case. What is the PRIMARY purpose of maintaining an unbroken chain of custody for digital evidence?

Accepted Answer

To prove that the evidence has not been altered or tampered with.. The primary purpose of maintaining an unbroken chain of custody is to establish the integrity and authenticity of digital evidence by documenting every person who handled it, every transfer, and every access event. This documentation allows the court to verify that the evidence has not been altered, tampered with, or corrupted from the moment of seizure through analysis and presentation. Without a provable chain of custody, the evidence may be deemed inadmissible under rules like Federal Rule of Evidence 901 or similar standards in other jurisdictions.

Answer

To track the storage location of the evidence.

Answer

To speed up the investigation process.

Answer

To assign responsibility for the evidence to a single individual.

Question 8

During a forensic examination, an analyst runs `dcfldd if=/dev/sda of=image.dd hash=sha256 hashwindow=1G` on a suspect drive. What is the PRIMARY advantage of using `hashwindow=1G` over a single hash at the end?

Accepted Answer

It allows verification of the image in 1GB segments, so errors can be pinpointed.. The `hashwindow=1G` option in `dcfldd` computes a SHA-256 hash for every 1 GB segment of the input data, rather than a single hash for the entire image. This allows the analyst to verify the integrity of each segment independently, so if a hash mismatch occurs during later verification, the exact 1 GB block containing the error can be identified and reacquired without reimaging the entire drive.

Answer

It enables the image to be mounted as a loop device.

Answer

It encrypts the image file for security.

Answer

It reduces the total time to create the image.

Question 9

In a corporate investigation, legal counsel issues a litigation hold to preserve electronically stored information (ESI) relevant to a lawsuit. Which of the following is the BEST description of a litigation hold?

Accepted Answer

A notice to employees to preserve all relevant ESI and cease routine deletion.. A litigation hold is a legal notice issued to employees and data custodians instructing them to preserve all relevant electronically stored information (ESI) and to suspend any routine deletion, archiving, or destruction policies. This ensures that potentially discoverable data remains intact and unaltered for the duration of the legal proceeding, directly supporting the duty to preserve evidence under the Federal Rules of Civil Procedure (FRCP Rule 37(e)).

Answer

A form of encryption used to protect evidence during transport.

Answer

A technique used to acquire forensic images without altering the source.

Answer

A court order authorizing law enforcement to seize computers.

Question 10

Locard's exchange principle is fundamental to forensic science. How does this principle apply to computer forensics?

Accepted Answer

Every action on a digital device leaves some trace of evidence.. Locard's principle states that every contact leaves a trace; in digital forensics, this translates to digital traces left behind when a system is accessed.

Answer

Digital evidence is always volatile and must be preserved immediately.

Answer

Evidence must be collected within 24 hours.

Answer

Only physical evidence, such as fingerprints, can be left at a crime scene.

Question 11

A forensic examiner needs to acquire an image of a suspect's laptop hard drive. The laptop is running, and the examiner wants to capture volatile data first. According to best practices, which order of steps should the examiner follow?

Accepted Answer

Capture volatile data, then shut down normally, remove the drive, and image with a write blocker.. Forensic best practices mandate capturing volatile data (e.g., RAM, network connections, running processes) first, as this data is lost on power loss. After capturing volatile data, the examiner should perform a graceful shutdown to preserve file system integrity, then remove the drive and acquire a forensic image using a write blocker to prevent any modification to the original evidence.

Answer

Unplug the laptop, remove the drive, and boot the drive in a forensic workstation.

Answer

Immediately remove the hard drive, then capture RAM from the drive.

Answer

Create a full disk image over the network while the laptop is running.

Question 12

During an investigation, an analyst uses `dd if=/dev/sdb of=evidence.img bs=4k conv=noerror,sync`. What is the purpose of the `conv=noerror,sync` option?

Accepted Answer

It skips read errors and pads the output with zeros to maintain block alignment.. The `conv=noerror,sync` option in `dd` instructs the tool to continue processing even when a read error is encountered (`noerror`) and to pad the output block with zeros (`sync`) to maintain the original block alignment. This ensures that the resulting image file remains the same size as the source device, preserving the forensic integrity of the data layout despite hardware-level read failures.

Answer

It hashes each block to verify integrity.

Answer

It enables synchronous writing to ensure data integrity.

Answer

It compresses the output image to save space.

Question 13

Which US Constitutional amendment primarily governs the legality of searching and seizing digital devices?

Accepted Answer

Fourth Amendment. The Fourth Amendment protects against unreasonable searches and seizures, requiring law enforcement to obtain a warrant based on probable cause before searching or seizing digital devices. This directly governs the legality of accessing data on computers, smartphones, and storage media in forensic investigations.

Answer

Fifth Amendment

Answer

Fourteenth Amendment

Answer

First Amendment

Question 14

A forensic analyst is testifying in court as an expert witness. What is the PRIMARY role of an expert witness in digital forensics?

Accepted Answer

To offer an opinion on the technical facts and assist the trier of fact.. The primary role of an expert witness in digital forensics is to provide an impartial opinion on technical facts, helping the trier of fact (judge or jury) understand complex digital evidence. Unlike a lay witness, an expert is permitted to offer interpretations and conclusions based on their specialized knowledge, as defined under Federal Rule of Evidence 702. This opinion must be based on sufficient facts or data, reliable principles and methods, and a reliable application of those methods to the case.

Answer

To represent the interests of the party that hired them.

Answer

To determine the guilt or innocence of the defendant.

Answer

To present factual findings only, without interpretation.

Question 15

In the context of e-discovery, what does the 'best evidence rule' require regarding digital documents?

Accepted Answer

That the original electronic file or a reliable duplicate be produced.. The best evidence rule, codified in Federal Rule of Evidence 1002, requires the original writing, recording, or photograph to prove its content unless otherwise provided. In e-discovery, an original electronic file or a reliable duplicate (e.g., a bit-for-bit forensic image verified by a hash such as MD5 or SHA-1) satisfies this rule because the duplicate is functionally equivalent to the original for evidentiary purposes.

Answer

That all evidence be authenticated by a witness.

Answer

That only paper copies of digital documents are admissible.

Answer

That metadata is preserved in all copies.