CHFI Computer Forensics Fundamentals and Process Practice Test 7 — 15 Questions

Question 1

A first responder arrives at a scene where a computer is suspected to contain evidence of fraud. The computer is turned on and a file is open. Which of the following actions should the responder AVOID?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Double-clicking the open file to fully view its contents.. Double-clicking the open file alters its last accessed timestamp and may modify file metadata (e.g., NTFS $STANDARD_INFORMATION or $FILE_NAME attributes), potentially destroying volatile evidence. It also risks executing malicious code or changing the file's content if the application auto-saves. The first responder must preserve the current state and capture a forensic image before any interaction with active data.

Answer

Photographing the screen and documenting open windows.

Answer

Noting the time and date from the system clock.

Answer

Using a hardware write blocker to image the hard drive after shutdown.

Question 2

Which TWO of the following hashing algorithms are commonly used to verify the integrity of forensic images? (Choose two.)

Accepted Answer

SHA-1. SHA-1 and MD5 are the two hashing algorithms most commonly used in forensic practice to verify the integrity of forensic images. They produce a fixed-size hash value (160-bit for SHA-1, 128-bit for MD5) that acts as a digital fingerprint; if the hash of the original image matches the hash of a copy, the data is considered unchanged. Despite known collision weaknesses, they remain the de facto standards in tools like FTK Imager, EnCase, and dd due to their speed and widespread tool support.

Answer

SHA-3

Answer

RSA

Answer

AES

Question 3

A first responder arrives at a scene where a computer is turned on and a user is logged in. What is the FIRST action the responder should take to preserve volatile evidence?

Accepted Answer

Collect volatile data such as RAM contents and running processes. Volatile data (e.g., RAM contents, running processes, network connections) is lost when power is removed. The first responder must collect this data before any shutdown or hardware removal, following the order of volatility (RFC 3227). This preserves critical evidence that cannot be recovered later.

Answer

Photograph the screen and then shut down the system normally

Answer

Immediately unplug the power cord to prevent data alteration

Answer

Remove the hard drive immediately for forensic imaging

Question 4

During a forensic investigation, an analyst uses a tool to create a bit-for-bit copy of a hard drive while ensuring the original is not modified. Which of the following is a hardware write blocker that can be used for this purpose?

Accepted Answer

Tableau. A hardware write blocker physically prevents any write commands from reaching the original drive at the SATA/IDE bus level, ensuring the drive remains unaltered during acquisition. Tableau is a well-known manufacturer of forensic hardware write blockers that operate transparently to the imaging software, making it the correct choice for a hardware-based solution.

Answer

FTK Imager

Answer

dd

Answer

EnCase

Question 5

A security analyst responds to a suspected data breach. The analyst documents the scene, photographs the computer, and labels the cables. Which phase of the forensic investigation process is being performed?

Accepted Answer

First response. The actions described—documenting the scene, photographing the computer, and labeling cables—are part of the First Response phase. This phase occurs immediately after an incident is detected and focuses on preserving the integrity of the scene and evidence before any collection or analysis begins. In the CHFI methodology, First Response includes securing the area, creating a detailed log of the initial state, and ensuring no unauthorized changes occur.

Answer

Collection

Answer

Examination

Answer

Reporting

Question 6

During a forensic examination, an analyst uses the command 'dcfldd if=/dev/sda of=image.dd hash=sha256 hashlog=hash.txt'. What is the primary purpose of including 'hash=sha256' in this command?

Accepted Answer

To compute a SHA-256 hash of the input drive and log it to a file for integrity verification. The `hash=sha256` parameter in `dcfldd` instructs the tool to compute a SHA-256 hash of the input device (`/dev/sda`) during the acquisition process. This hash is then logged to the file specified by `hashlog=hash.txt`, providing a verifiable integrity check that the forensic image matches the original source. This is a standard forensic practice to ensure the image has not been altered or corrupted.

Answer

To split the image into multiple files named with SHA-256 checksums

Answer

To encrypt the output image file using SHA-256

Answer

To compress the image using SHA-256 compression algorithm

Question 7

What is the primary purpose of maintaining a chain of custody during a forensic investigation?

Accepted Answer

To document the handling of evidence from collection to presentation in court. The primary purpose of maintaining a chain of custody is to create a documented, unbroken record of every person who handled the evidence, from the moment it is collected until it is presented in court. This documentation is critical to establish the authenticity and integrity of the evidence, ensuring it has not been tampered with or altered, which is a foundational requirement for admissibility under legal standards like the Federal Rules of Evidence (FRE) 901. Without a proper chain of custody, the evidence can be challenged as inadmissible due to lack of trustworthiness.

Answer

To reduce the size of evidence for easier storage

Answer

To analyze the evidence for hidden data

Answer

To encrypt the evidence to prevent unauthorized access

Question 8

A forensic analyst is preparing to acquire an image from a suspect's hard drive. The analyst connects the drive to a write blocker, then uses FTK Imager to create a forensic image. Which hashing algorithm is commonly used by FTK Imager to verify image integrity?

Accepted Answer

MD5. FTK Imager uses MD5 (Message Digest 5) as its default hashing algorithm to verify the integrity of forensic images. MD5 produces a 128-bit hash value that uniquely represents the data, allowing the analyst to confirm that the acquired image is an exact bit-for-bit copy of the original drive. While SHA-1 is also supported, MD5 is the algorithm most commonly associated with FTK Imager's verification process.

Answer

AES

Answer

RSA

Answer

Blowfish

Question 9

An investigator seizes a computer that was involved in a crime. The suspect claims that the evidence was planted. Which forensic principle best helps to refute this claim by demonstrating that the evidence could only have been left by the suspect?

Accepted Answer

Locard's exchange principle. Locard's exchange principle states that every contact leaves a trace. In digital forensics, this means the suspect's interaction with the computer—such as typing, accessing files, or connecting peripherals—will leave unique digital artifacts (e.g., registry keys, prefetch files, USB device serial numbers, or browser history). By demonstrating that these artifacts could only have been created by the suspect's specific actions or device, the investigator refutes the claim of planting.

Answer

Hearsay rule

Answer

Best evidence rule

Answer

Chain of custody

Question 10

Under the US Fourth Amendment, when is a warrant generally NOT required for a computer search and seizure?

Accepted Answer

When the suspect has given consent. Under the Fourth Amendment, a warrant is generally required for searches and seizures, but one well-established exception is voluntary consent. When a suspect freely and knowingly agrees to a search of their computer or digital device, law enforcement may proceed without a warrant, provided the consent is not coerced and the scope of the search is not exceeded. This principle applies regardless of whether the data is stored locally or remotely, as long as the consenting party has actual or apparent authority over the device or data.

Answer

When the evidence is stored in the cloud

Answer

When the computer is owned by a corporation

Answer

When the investigation involves a civil case

Question 11

An expert witness is preparing to testify in a computer forensics case. Which of the following is a key requirement for the expert's testimony to be admissible under the Daubert standard?

Accepted Answer

The expert's techniques must be based on reliable principles and methods. Under the Daubert standard, the admissibility of expert testimony hinges on whether the expert's techniques are based on reliable principles and methods, not merely on general acceptance. This standard, established in Daubert v. Merrell Dow Pharmaceuticals, requires the trial judge to act as a gatekeeper, evaluating the scientific validity and reliability of the methodology used. In computer forensics, this means the expert must demonstrate that their acquisition, preservation, and analysis methods (e.g., using write-blockers, cryptographic hashing like SHA-256, and chain-of-custody documentation) are scientifically sound and consistently applied.

Answer

The expert's methods must be generally accepted in the scientific community

Answer

The expert must have personally examined all evidence

Answer

The expert must have a law degree

Question 12

A company receives a legal hold notice regarding a lawsuit. What immediate action should the company take to comply?

Accepted Answer

Preserve all potentially relevant electronic documents and data. A legal hold notice triggers a duty to preserve all potentially relevant electronically stored information (ESI). Under the Federal Rules of Civil Procedure (FRCP) Rule 37(e), failure to preserve can lead to spoliation sanctions. The immediate action is to issue a litigation hold notice and suspend routine data deletion policies, ensuring that all relevant emails, documents, and logs are preserved in their current state.

Answer

Delete all emails older than 30 days to free up storage

Answer

Immediately format the hard drives of all employees involved

Answer

Ignore the notice because it is not a court order

Question 13

Which THREE of the following are best practices for a first responder when arriving at a computer crime scene?

Accepted Answer

Photograph the entire scene, including the computer screen and connections. Option A is correct because photographing the entire scene—including the screen contents, cable connections, and peripheral devices—creates an accurate, tamper-evident visual record of the original state before anything is touched, which is essential for later legal admissibility. Option B is correct because disconnecting the computer from the network (e.g., unplugging the Ethernet cable or disabling Wi-Fi) prevents remote tampering, malware propagation, or remote wipe commands while preserving the local system state. Option E is correct because volatile data such as RAM contents, running processes, network connections, and open files are lost on shutdown, so a first responder should capture this evidence first using accepted order-of-volatility principles. Option C is not appropriate because powering off the machine destroys volatile evidence and can trigger encryption or anti-forensic routines, and it contradicts the need to preserve RAM. Option D is not appropriate for a first responder because booting from a forensic CD alters the system state and is a later laboratory or examiner step, not an initial scene-response action.

Answer

Turn off the computer immediately to prevent remote access

Answer

Boot the computer from a forensic CD to preview the hard drive

Question 14

During the first response to a computer incident, which of the following actions is MOST critical for preserving evidence?

Accepted Answer

Photograph the scene including all visible cables and connections. Photographing the scene, including all visible cables and connections, is the most critical first step in preserving the chain of custody and documenting the exact physical state of the system before any changes occur. This visual record captures port assignments, device connections, and cable orientations that could be altered by subsequent actions, ensuring that the original configuration is preserved for forensic analysis. Without this documentation, later evidence of network topology or peripheral involvement may be lost or disputed.

Answer

Run antivirus software to remove any malware

Answer

Disconnect the power to prevent data alteration

Answer

Immediately boot the system to verify it is operational

Question 15

Which type of evidence is based on information that is not directly from an eyewitness but is reported by someone else?

Accepted Answer

Hearsay evidence. Hearsay evidence is defined as a statement made outside of court that is presented to prove the truth of the matter asserted. In digital forensics, this applies when a witness testifies about what another person said regarding an event, rather than recounting their own direct observation. The CHFI exam categorizes this under evidence types because it is not based on the witness's firsthand knowledge, making it generally inadmissible unless an exception applies.

Answer

Direct evidence

Answer

Circumstantial evidence

Answer

Best evidence