CHFI Computer Forensics Fundamentals and Process Practice Test 6 — 15 Questions

Question 1

A first responder arrives at a crime scene where a computer is running. Which THREE actions should the first responder take to preserve volatile evidence?

Accepted Answer

Collect contents of RAM using a tool like FTK Imager or dd. RAM contains volatile data that is lost when power is removed. FTK Imager or dd can capture the exact contents of memory, preserving running processes, open network connections, encryption keys, and other transient evidence critical to the investigation.

Answer

Unplug the power cord immediately

Answer

Run a full antivirus scan on the system

Question 2

Which TWO of the following are hardware write blockers commonly used in forensic acquisitions?

Accepted Answer

FastBloc. FastBloc (Option B) is a hardware write blocker produced by Guidance Software that operates at the physical layer, intercepting ATA/ATAPI commands to prevent any write operations from reaching the suspect drive. It ensures bit-for-bit forensic acquisition without altering the source data, which is essential for maintaining evidentiary integrity.

Answer

EnCase

Answer

dd

Answer

FTK Imager

Question 3

A first responder arrives at a crime scene where a computer is powered on and displaying a desktop. According to best practices, which of the following actions should the responder take FIRST?

Accepted Answer

Photograph the scene and the computer screen.. The first priority at a live crime scene is to document the state of the system before any interaction. Photographing the screen captures volatile data (e.g., open windows, running processes, time) that would be lost upon any keystroke or power change. This aligns with the order of volatility (RFC 3227) and ensures a legally defensible chain of custody from the outset.

Answer

Press Ctrl+Alt+Del to check for active user sessions.

Answer

Connect a write blocker and begin imaging the hard drive.

Answer

Unplug the power cord immediately to preserve volatile data.

Question 4

During a forensic investigation, an analyst acquires a hard drive using a hardware write blocker. Which of the following is the PRIMARY reason for using a hardware write blocker?

Accepted Answer

To ensure that the operating system does not mount the drive as writable.. The primary reason for using a hardware write blocker is to physically intercept the SATA/IDE bus between the suspect drive and the forensic workstation, ensuring that only read commands (e.g., ATA READ DMA) are passed through while blocking any write commands (e.g., ATA WRITE DMA). This prevents the operating system from mounting the drive as writable, which would otherwise cause automatic writes (e.g., timestamp updates, journaling, or prefetch creation) that alter evidence and break the chain of custody.

Answer

To increase the transfer speed of the imaging process.

Answer

To bypass the drive's password protection.

Answer

To compress the data during imaging.

Question 5

After collecting digital evidence from a suspect's computer, the forensic examiner creates a forensic image using FTK Imager. The examiner then computes the MD5 hash of the original drive and the image file. Which of the following BEST describes the purpose of this hashing?

Accepted Answer

To verify that the image is an exact bit-for-bit copy of the original.. Hashing with MD5 (or SHA-1/SHA-256) produces a unique fixed-size digest of the data. By comparing the hash of the original drive to the hash of the forensic image, the examiner can confirm that the image is an exact bit-for-bit copy, ensuring the integrity of the evidence and that no data has been altered during acquisition.

Answer

To encrypt the data for secure storage.

Answer

To index the files for faster searching.

Answer

To reduce the storage size of the image.

Question 6

An organization receives a litigation hold notice regarding an ongoing lawsuit. The IT administrator is instructed to preserve all relevant electronic records. Which of the following actions is MOST consistent with proper legal hold implementation?

Accepted Answer

Place a hold on all data that may be relevant by suspending routine deletion and notifying custodians.. A litigation hold (also known as a legal hold) requires suspending routine data deletion and preservation of potentially relevant electronically stored information (ESI). The IT administrator must notify custodians and implement a hold that prevents automated purging (e.g., via retention policies in Exchange or file servers) to comply with the duty to preserve evidence under FRCP Rule 37(e).

Answer

Reboot all servers to ensure they are running the latest patches.

Answer

Immediately delete all emails older than 90 days to reduce data volume.

Answer

Encrypt all data and change access passwords to prevent unauthorized access.

Question 7

Which of the following principles states that when two objects come into contact, there is a transfer of material between them?

Accepted Answer

Locard's exchange principle. Locard's exchange principle is a foundational concept in forensic science stating that whenever two objects come into contact, there is a transfer of material between them. In digital forensics, this principle applies to the transfer of digital artifacts (e.g., file fragments, metadata, network traces) when systems interact, such as when a suspect's device connects to a server or when data is copied between storage media.

Answer

The best evidence rule

Answer

The chain of custody

Answer

The hearsay rule

Question 8

During a forensic investigation, the analyst needs to create a forensic image of a hard drive that also hashes the data during acquisition. Which command-line tool would be MOST appropriate for this task?

Accepted Answer

dcfldd. dcfldd is a modified version of dd that includes built-in hashing (e.g., MD5, SHA-1, SHA-256) during the imaging process, allowing the analyst to verify data integrity in real time without a separate hashing step. This makes it the most appropriate tool for creating a forensic image that also hashes the data during acquisition.

Answer

dd

Answer

fdisk

Answer

memdump

Question 9

A forensic analyst is testifying as an expert witness in court. The opposing counsel challenges the analyst's testimony based on the Frye standard. What does the Frye standard require for scientific evidence to be admissible?

Accepted Answer

The evidence must be based on techniques generally accepted in the scientific community.. The Frye standard requires that scientific evidence be based on principles and methods that are generally accepted by the relevant scientific community.

Answer

The evidence must have been obtained with a warrant.

Answer

The evidence must be relevant and more probative than prejudicial.

Answer

The evidence must have been peer-reviewed and published.

Question 10

During a forensic examination, the analyst encounters a file that is not automatically readable by forensic tools. The analyst suspects the file contains contraband images. Which of the following is the BEST approach to handle this evidence in accordance with the rules of evidence?

Accepted Answer

Create a forensic copy and use a write blocker to access the copy with appropriate software.. Forensic best practices require creating a bit-for-bit forensic copy of the original evidence and using a write blocker to prevent any alteration to the original. The analyst can then use specialized software (e.g., a hex editor, file carving tools, or a viewer that supports the file's raw format) to access the copy and extract contraband images without violating the integrity of the evidence, which is essential for admissibility under rules of evidence such as the Federal Rules of Evidence (FRE) 901.

Answer

Delete the file to prevent accidental distribution.

Answer

Ignore the file because it cannot be easily read.

Answer

Open the file using the original application on the suspect's computer.

Question 11

Which of the following BEST describes the chain of custody in digital forensics?

Accepted Answer

A log of all personnel who have accessed the evidence, along with timestamps and reasons.. The chain of custody is a documented chronological record that tracks the seizure, custody, control, transfer, analysis, and disposition of digital evidence. It must include every person who handled the evidence, the date and time it was accessed, the purpose of access, and any changes made, ensuring the evidence's integrity and admissibility in court under rules like Federal Rule of Evidence 901.

Answer

The software tool used to image the hard drive.

Answer

The process of encrypting evidence to prevent unauthorized access.

Answer

The physical lock and key used to secure the evidence locker.

Question 12

A company's legal department issues a legal hold notice for electronically stored information (ESI) related to a pending lawsuit. The IT department is tasked with preserving data. Which of the following actions is MOST likely to violate the legal hold requirements?

Accepted Answer

Continuing to run a script that deletes temporary files older than 24 hours.. Continuing to run a script that deletes temporary files older than 24 hours directly destroys ESI that may be relevant to the lawsuit, violating the legal hold requirement to preserve all potentially relevant data. Legal hold mandates the suspension of any automated or manual processes that could alter or delete ESI, including temporary files that might contain fragments of relevant documents or metadata. Unlike suspending routine email deletion (Option B), which is a preservation action, the script actively purges data and thus breaches the hold.

Answer

Notifying all employees to preserve documents related to the lawsuit.

Answer

Suspending routine deletion of emails older than 30 days.

Answer

Taking a forensic image of the relevant servers.

Question 13

An investigator is examining a Windows system and needs to capture volatile data without altering the system. Which of the following tools would be MOST appropriate for acquiring the contents of RAM?

Accepted Answer

FTK Imager. FTK Imager is the most appropriate tool because it can acquire the contents of RAM (volatile memory) from a live Windows system without writing data back to the system drive, preserving the integrity of the evidence. It uses a memory acquisition driver that reads physical memory directly, and it can output a raw memory dump (.mem) file, which is essential for capturing volatile data like running processes, network connections, and encryption keys.

Answer

dd

Answer

EnCase

Answer

Tableau write blocker

Question 14

Which THREE of the following are essential steps in the digital forensics investigation process? (Select three.)

Accepted Answer

Examination. (Examination) is correct because it is a core phase in the digital forensics process where investigators identify and extract potential evidence from collected data without altering it. This step involves techniques such as hashing (e.g., SHA-256) to verify integrity and using tools like FTK Imager or EnCase to preview files, ensuring the evidence is preserved in a forensically sound manner. Without examination, the raw collected data cannot be systematically reviewed for relevant artifacts.

Answer

Encryption

Answer

Destruction

Question 15

Which TWO of the following are common hashing algorithms used to verify the integrity of forensic images? (Select two.)

Accepted Answer

SHA-1. SHA-1 (Secure Hash Algorithm 1) and MD5 (Message Digest 5) are both cryptographic hash functions commonly used in digital forensics to verify the integrity of forensic images. They produce a fixed-size hash value (160 bits for SHA-1, 128 bits for MD5) from the image data, allowing examiners to confirm that the image has not been altered since acquisition. While MD5 is now considered weak against collision attacks, it remains widely used in forensic tools like FTK Imager and EnCase for quick integrity checks.

Answer

AES

Answer

Blowfish

Answer

RSA