CHFI Computer Forensics Fundamentals and Process Practice Test 7 — 15 Questions

Question 1

During a forensic investigation, the first responder arrives at a scene where a computer is powered on and a user is logged in. Which of the following is the MOST appropriate initial action?

Accepted Answer

Disconnect the computer from the network and take a photograph of the screen. Securing the scene and documenting everything is the first priority to preserve evidence and ensure chain of custody. Powering off or accessing the system without proper documentation can lead to evidence spoliation.

Answer

Immediately power off the computer to prevent data alteration

Answer

Begin collecting data by copying all files to an external drive

Answer

Ask the user to save their work and then shut down normally

Question 2

A forensic analyst is creating a forensic image of a suspect's hard drive using a write blocker. Which of the following BEST describes the purpose of using a hardware write blocker?

Accepted Answer

To ensure that no data is written to the source drive during imaging. A hardware write blocker is a device placed between the suspect drive and the forensic workstation that intercepts and blocks any write commands from the operating system or imaging software. Its primary purpose is to guarantee that the source drive remains completely unaltered during acquisition, preserving the integrity of the evidence for legal and forensic purposes. This is achieved by allowing only read commands to pass through, while all write commands are physically or logically blocked at the hardware level.

Answer

To increase the speed of data acquisition

Answer

To encrypt the forensic image for secure storage

Answer

To allow the suspect drive to be booted without altering data

Question 3

Which of the following is the BEST example of direct evidence in a computer forensics investigation?

Accepted Answer

A server log showing the suspect's IP address accessed a restricted file at the time of the incident. Direct evidence directly proves a fact without requiring inference. A server log showing the suspect's IP address accessing a restricted file at the time of the incident is direct evidence because it directly links the suspect's system to the specific action (accessing the file) at the relevant time, without needing additional reasoning or assumptions. This is based on the principle that logs capture actual system events, making them direct proof of the occurrence of that event.

Answer

A document found on the suspect's computer with content about the crime

Answer

Expert testimony that the suspect's computer contained malware

Answer

A witness testifying that the suspect was the only person who knew the password

Question 4

A forensic examiner is presented with evidence that a suspect's computer was used to commit a fraud. The defense argues that the evidence was obtained without a warrant. Which US Constitutional Amendment is MOST relevant to this argument?

Accepted Answer

Fourth Amendment. The Fourth Amendment protects against unreasonable searches and seizures and requires warrants supported by probable cause.

Answer

First Amendment

Answer

Sixth Amendment

Answer

Fifth Amendment

Question 5

Which of the following tools is specifically designed for forensic imaging and can create compressed, segmented, or E01 format images?

Accepted Answer

FTK Imager. FTK Imager is specifically designed for forensic imaging and supports creating compressed, segmented, and E01 (Expert Witness Format) images. Unlike generic tools, it provides a GUI and built-in validation (e.g., MD5/SHA1 hashing) tailored for forensic acquisition, making it the correct choice for this question.

Answer

dd

Answer

Nmap

Answer

Wireshark

Question 6

Locard's exchange principle in digital forensics states that:

Accepted Answer

Every contact leaves a trace, and digital evidence is no exception. Locard's exchange principle, originally from forensic science, asserts that whenever two objects come into contact, a transfer of material occurs. In digital forensics, this translates to the fact that digital devices and systems inevitably leave traces of their interactions—such as log entries, metadata, file artifacts, or network packets—making it possible to reconstruct events. Option D correctly captures this core idea that every contact leaves a trace, and digital evidence is no exception.

Answer

The chain of custody must be documented for all evidence

Answer

Digital evidence is always stored in the cloud

Answer

Only the forensic examiner can handle evidence

Question 7

In the context of the UK Police and Criminal Evidence Act (PACE), which of the following is a key requirement for the admissibility of digital evidence?

Accepted Answer

The evidence must be obtained lawfully and without oppression. PACE requires that evidence is not obtained through oppression or in violation of legal procedures, ensuring reliability and fairness.

Answer

The evidence must be stored on a write-protected medium

Answer

The evidence must be reviewed by an independent third party

Answer

The evidence must be encrypted at all times

Question 8

Which TWO of the following are essential components of a proper chain of custody documentation? (Select TWO.)

Accepted Answer

Date and time of each evidence transfer. The chain of custody documentation must record the date and time of each evidence transfer (Option B) to establish a clear chronological timeline of custody. Additionally, it must include the signature of each person who handled the evidence (Option C) to provide accountability and verify the chain of custody. While technical details like OS version or IP address may be relevant to the investigation, they are not part of the chain of custody documentation, which focuses solely on tracking the evidence's handling and transfer.

Answer

The name of the suspect

Answer

The operating system version of the suspect's computer

Answer

The IP address of the forensic workstation

Question 9

Which THREE of the following are rules of evidence that must be satisfied for digital evidence to be admissible in court? (Select THREE.)

Accepted Answer

Admissibility. Admissibility is a core rule of evidence requiring that digital evidence must be legally obtained and relevant to the case. For evidence to be admitted in court, it must meet the legal standards set by rules such as the Federal Rules of Evidence (FRE) or similar jurisdictional codes. Without admissibility, even the most compelling evidence cannot be presented to the trier of fact.

Answer

Simplicity

Answer

Encryption

Question 10

Which TWO of the following are considered best practices for a first responder at a digital crime scene? (Select TWO.)

Accepted Answer

Photograph the scene including screen contents and connections. First responders should not power off the system (to preserve volatile data) and should photograph the scene to document the state.

Answer

Power off the computer immediately to secure data

Answer

Boot the system into safe mode to examine logs

Answer

Disconnect all cables to isolate the device

Question 11

A first responder arrives at a suspected data breach scene. The system is powered on and a user is logged in. Which of the following actions should the responder take FIRST to preserve volatile data?

Accepted Answer

Collect volatile data such as RAM, network connections, and running processes using appropriate tools.. Volatile data (RAM, network connections, running processes) is lost when power is removed. The first responder must capture this data using tools like FTK Imager, WinPmem, or netstat before any shutdown or disconnection. This aligns with the order of volatility (RFC 3227), which prioritizes memory and network state over disk imaging.

Answer

Document the scene and take photographs, then proceed to interview witnesses.

Answer

Immediately disconnect the network cable and power off the computer.

Answer

Use a hardware write-blocker to create a forensic image of the hard drive.

Question 12

Which of the following is the PRIMARY purpose of using a write blocker in computer forensics?

Accepted Answer

To prevent any modification to the original evidence drive during acquisition.. A write blocker ensures that no data is written to the original evidence drive during acquisition, maintaining its integrity.

Answer

To speed up the imaging process by caching writes.

Answer

To convert the hard drive interface from SATA to USB.

Answer

To encrypt the forensic image for secure transport.

Question 13

An organization receives a litigation hold notice regarding an ongoing lawsuit. The IT department is instructed to preserve all relevant electronic data. Which of the following actions should be taken FIRST to comply with the legal hold?

Accepted Answer

Immediately preserve all potentially relevant data, including backups and archives, and suspend automatic deletion policies.. The first step in responding to a litigation hold is to immediately preserve all potentially relevant data, including backups and archives, and suspend any automatic deletion or rotation policies. This ensures that no spoliation of evidence occurs, which could lead to legal sanctions. The preservation order must be broad to cover all data that might be relevant, as determining exact relevance comes later in the e-discovery process.

Answer

Delete all data that is not relevant to the lawsuit to reduce storage.

Answer

Notify all employees to ignore the hold and continue normal operations.

Answer

Conduct a forensic analysis of the data to determine relevance before preservation.

Question 14

Which of the following BEST describes Locard's exchange principle as applied to digital forensics?

Accepted Answer

Every contact leaves a trace; an attacker will leave digital evidence on the compromised system.. Locard's exchange principle states that every contact leaves a trace. In digital forensics, this means that when an attacker interacts with a compromised system, they inevitably leave behind digital artifacts such as log entries, modified files, registry changes, or network connection records. Option D correctly captures this core concept as applied to digital forensics.

Answer

Digital evidence must be collected using a write blocker.

Answer

The chain of custody must be documented for evidence to be admissible.

Answer

Volatile data must be collected before powering off a system.

Question 15

A forensic analyst needs to create a forensic image of a suspect's hard drive using FTK Imager. Which of the following image formats is MOST appropriate for maintaining evidence integrity and allowing compression?

Accepted Answer

EnCase image format (.E01). FTK Imager natively supports the EnCase image format (.E01), which is the most appropriate choice because it maintains evidence integrity through embedded CRC32 and MD5/SHA-1 hash verification while also supporting optional compression. Unlike raw/DD images, .E01 files can be segmented and compressed without losing forensic integrity, making them ideal for both storage efficiency and court-admissible evidence.

Answer

ISO image format (.iso)

Answer

Advanced Forensic Format (AFF)

Answer

Raw/DD image (.dd)