CHFI Computer Forensics Fundamentals and Process Practice Test 6 — 15 Questions

Question 1

A first responder arrives at a scene where a computer is turned on and a user is logged in. What is the FIRST action the responder should take to preserve volatile evidence?

Accepted Answer

Collect volatile data such as RAM contents and running processes. Option D is correct because volatile data (e.g., RAM contents, running processes, network connections) is lost when power is removed. The first responder must collect this data before any shutdown or hardware removal, following the order of volatility (RFC 3227). This preserves critical evidence that cannot be recovered later.

Answer

Photograph the screen and then shut down the system normally

Answer

Immediately unplug the power cord to prevent data alteration

Answer

Remove the hard drive immediately for forensic imaging

Question 2

During a forensic investigation, an analyst uses a tool to create a bit-for-bit copy of a hard drive while ensuring the original is not modified. Which of the following is a hardware write blocker that can be used for this purpose?

Accepted Answer

Tableau. A hardware write blocker physically prevents any write commands from reaching the original drive at the SATA/IDE bus level, ensuring the drive remains unaltered during acquisition. Tableau is a well-known manufacturer of forensic hardware write blockers that operate transparently to the imaging software, making it the correct choice for a hardware-based solution.

Answer

FTK Imager

Answer

dd

Answer

EnCase

Question 3

A security analyst responds to a suspected data breach. The analyst documents the scene, photographs the computer, and labels the cables. Which phase of the forensic investigation process is being performed?

Accepted Answer

First response. The actions described—documenting the scene, photographing the computer, and labeling cables—are part of the First Response phase. This phase occurs immediately after an incident is detected and focuses on preserving the integrity of the scene and evidence before any collection or analysis begins. In the CHFI methodology, First Response includes securing the area, creating a detailed log of the initial state, and ensuring no unauthorized changes occur.

Answer

Collection

Answer

Examination

Answer

Reporting

Question 4

During a forensic examination, an analyst uses the command 'dcfldd if=/dev/sda of=image.dd hash=sha256 hashlog=hash.txt'. What is the primary purpose of including 'hash=sha256' in this command?

Accepted Answer

To compute a SHA-256 hash of the input drive and log it to a file for integrity verification. Option B is correct because the `hash=sha256` parameter in `dcfldd` instructs the tool to compute a SHA-256 hash of the input device (`/dev/sda`) during the acquisition process. This hash is then logged to the file specified by `hashlog=hash.txt`, providing a verifiable integrity check that the forensic image matches the original source. This is a standard forensic practice to ensure the image has not been altered or corrupted.

Answer

To split the image into multiple files named with SHA-256 checksums

Answer

To encrypt the output image file using SHA-256

Answer

To compress the image using SHA-256 compression algorithm

Question 5

In a legal context, which rule of evidence requires that the evidence presented be sufficient to prove a fact and not be misleading?

Accepted Answer

Reliability. Reliability, under rules of evidence such as Federal Rule of Evidence 403, requires that the probative value of evidence is not substantially outweighed by the danger of unfair prejudice, confusing the issues, or misleading the jury. In computer forensics, this means the evidence must be sufficiently trustworthy and accurate to prove a fact without creating a misleading impression. For example, a log file with inconsistent timestamps or incomplete data would fail the reliability test because it could mislead the trier of fact.

Answer

Admissibility

Answer

Authenticity

Answer

Completeness

Question 6

What is the primary purpose of maintaining a chain of custody during a forensic investigation?

Accepted Answer

To document the handling of evidence from collection to presentation in court. The primary purpose of maintaining a chain of custody is to create a documented, unbroken record of every person who handled the evidence, from the moment it is collected until it is presented in court. This documentation is critical to establish the authenticity and integrity of the evidence, ensuring it has not been tampered with or altered, which is a foundational requirement for admissibility under legal standards like the Federal Rules of Evidence (FRE) 901. Without a proper chain of custody, the evidence can be challenged as inadmissible due to lack of trustworthiness.

Answer

To reduce the size of evidence for easier storage

Answer

To analyze the evidence for hidden data

Answer

To encrypt the evidence to prevent unauthorized access

Question 7

A forensic analyst is preparing to acquire an image from a suspect's hard drive. The analyst connects the drive to a write blocker, then uses FTK Imager to create a forensic image. Which hashing algorithm is commonly used by FTK Imager to verify image integrity?

Accepted Answer

MD5. FTK Imager commonly uses MD5 and SHA-1 to verify integrity; MD5 is a standard option.

Answer

AES

Answer

RSA

Answer

Blowfish

Question 8

An investigator seizes a computer that was involved in a crime. The suspect claims that the evidence was planted. Which forensic principle best helps to refute this claim by demonstrating that the evidence could only have been left by the suspect?

Accepted Answer

Locard's exchange principle. Locard's exchange principle states that every contact leaves a trace. In digital forensics, this means the suspect's interaction with the computer—such as typing, accessing files, or connecting peripherals—will leave unique digital artifacts (e.g., registry keys, prefetch files, USB device serial numbers, or browser history). By demonstrating that these artifacts could only have been created by the suspect's specific actions or device, the investigator refutes the claim of planting.

Answer

Hearsay rule

Answer

Best evidence rule

Answer

Chain of custody

Question 9

Under the US Fourth Amendment, when is a warrant generally NOT required for a computer search and seizure?

Accepted Answer

When the suspect has given consent. Under the Fourth Amendment, a warrant is generally required for searches and seizures, but one well-established exception is voluntary consent. When a suspect freely and knowingly agrees to a search of their computer or digital device, law enforcement may proceed without a warrant, provided the consent is not coerced and the scope of the search is not exceeded. This principle applies regardless of whether the data is stored locally or remotely, as long as the consenting party has actual or apparent authority over the device or data.

Answer

When the evidence is stored in the cloud

Answer

When the computer is owned by a corporation

Answer

When the investigation involves a civil case

Question 10

An expert witness is preparing to testify in a computer forensics case. Which of the following is a key requirement for the expert's testimony to be admissible under the Daubert standard?

Accepted Answer

The expert's techniques must be based on reliable principles and methods. Under the Daubert standard, the admissibility of expert testimony hinges on whether the expert's techniques are based on reliable principles and methods, not merely on general acceptance. This standard, established in Daubert v. Merrell Dow Pharmaceuticals, requires the trial judge to act as a gatekeeper, evaluating the scientific validity and reliability of the methodology used. In computer forensics, this means the expert must demonstrate that their acquisition, preservation, and analysis methods (e.g., using write-blockers, cryptographic hashing like SHA-256, and chain-of-custody documentation) are scientifically sound and consistently applied.

Answer

The expert's methods must be generally accepted in the scientific community

Answer

The expert must have personally examined all evidence

Answer

The expert must have a law degree

Question 11

A company receives a legal hold notice regarding a lawsuit. What immediate action should the company take to comply?

Accepted Answer

Preserve all potentially relevant electronic documents and data. Option C is correct because a legal hold notice triggers a duty to preserve all potentially relevant electronically stored information (ESI). Under the Federal Rules of Civil Procedure (FRCP) Rule 37(e), failure to preserve can lead to spoliation sanctions. The immediate action is to issue a litigation hold notice and suspend routine data deletion policies, ensuring that all relevant emails, documents, and logs are preserved in their current state.

Answer

Delete all emails older than 30 days to free up storage

Answer

Immediately format the hard drives of all employees involved

Answer

Ignore the notice because it is not a court order

Question 12

During a forensic investigation, an examiner finds a log entry: 'User JohnDoe accessed file contract.pdf at 10:32:45 AM'. This log is considered which type of evidence?

Accepted Answer

Direct evidence. The log entry directly states that User JohnDoe accessed contract.pdf at a specific time, which is a firsthand account of the event without requiring inference. In digital forensics, direct evidence is evidence that, if believed, proves a fact without any additional reasoning or presumption. This log is a direct record of the user's action, making it direct evidence.

Answer

Circumstantial evidence

Answer

Hearsay

Answer

Best evidence

Question 13

Which TWO of the following are legal frameworks or regulations that govern search and seizure of digital evidence in the United Kingdom?

Accepted Answer

PACE (Police and Criminal Evidence Act). PACE and GDPR are relevant legal frameworks. PACE governs police powers, and GDPR regulates data protection and processing of personal data.

Answer

Computer Fraud and Abuse Act (CFAA)

Answer

Fourth Amendment to the US Constitution

Answer

Sarbanes-Oxley Act (SOX)

Question 14

Which THREE of the following are best practices for a first responder when arriving at a computer crime scene?

Accepted Answer

Photograph the entire scene, including the computer screen and connections. Option A is correct because photographing the entire scene, including the computer screen and connections, preserves a visual record of the state of the evidence before any changes are made. This documentation is critical for establishing the chain of custody and proving that the evidence was not tampered with. It also captures the exact configuration of cables and peripherals, which can be vital for later analysis.

Answer

Turn off the computer immediately to prevent remote access

Answer

Boot the computer from a forensic CD to preview the hard drive

Question 15

Which TWO of the following are considered types of evidence under the rules of evidence?

Accepted Answer

Direct evidence. Direct and circumstantial evidence are two main categories. Hearsay and best evidence are rules, not types.

Answer

Best evidence rule

Answer

Hearsay evidence

Answer

Exculpatory evidence