CHFI Computer Forensics Fundamentals and Process Practice Test 8 — 15 Questions

Question 1

A first responder arrives at a crime scene where a computer is powered on and displaying a desktop. According to best practices, which of the following actions should the responder take FIRST?

Accepted Answer

Photograph the scene and the computer screen.. The first responder should photograph the scene and all visible evidence before any actions that might alter the state. This preserves a visual record of the original condition.

Answer

Press Ctrl+Alt+Del to check for active user sessions.

Answer

Connect a write blocker and begin imaging the hard drive.

Answer

Unplug the power cord immediately to preserve volatile data.

Question 2

During a forensic investigation, an analyst acquires a hard drive using a hardware write blocker. Which of the following is the PRIMARY reason for using a hardware write blocker?

Accepted Answer

To ensure that the operating system does not mount the drive as writable.. The primary reason for using a hardware write blocker is to physically intercept the SATA/IDE bus between the suspect drive and the forensic workstation, ensuring that only read commands (e.g., ATA READ DMA) are passed through while blocking any write commands (e.g., ATA WRITE DMA). This prevents the operating system from mounting the drive as writable, which would otherwise cause automatic writes (e.g., timestamp updates, journaling, or prefetch creation) that alter evidence and break the chain of custody.

Answer

To increase the transfer speed of the imaging process.

Answer

To bypass the drive's password protection.

Answer

To compress the data during imaging.

Question 3

After collecting digital evidence from a suspect's computer, the forensic examiner creates a forensic image using FTK Imager. The examiner then computes the MD5 hash of the original drive and the image file. Which of the following BEST describes the purpose of this hashing?

Accepted Answer

To verify that the image is an exact bit-for-bit copy of the original.. Hashing verifies the integrity of the image by ensuring it is an exact copy of the original, and is used to detect any tampering during the investigation.

Answer

To encrypt the data for secure storage.

Answer

To index the files for faster searching.

Answer

To reduce the storage size of the image.

Question 4

An organization receives a litigation hold notice regarding an ongoing lawsuit. The IT administrator is instructed to preserve all relevant electronic records. Which of the following actions is MOST consistent with proper legal hold implementation?

Accepted Answer

Place a hold on all data that may be relevant by suspending routine deletion and notifying custodians.. A legal hold requires suspending routine deletion policies and preserving potentially relevant data in its current state. Notifying custodians and disabling automatic deletion mechanisms are critical steps.

Answer

Reboot all servers to ensure they are running the latest patches.

Answer

Immediately delete all emails older than 90 days to reduce data volume.

Answer

Encrypt all data and change access passwords to prevent unauthorized access.

Question 5

Which of the following principles states that when two objects come into contact, there is a transfer of material between them?

Accepted Answer

Locard's exchange principle. Locard's exchange principle is a foundational concept in forensic science, including digital forensics, where every contact leaves a trace.

Answer

The best evidence rule

Answer

The chain of custody

Answer

The hearsay rule

Question 6

During a forensic investigation, the analyst needs to create a forensic image of a hard drive that also hashes the data during acquisition. Which command-line tool would be MOST appropriate for this task?

Accepted Answer

dcfldd. dcfldd is a modified version of dd that includes built-in hashing (e.g., MD5, SHA-1, SHA-256) during the imaging process, allowing the analyst to verify data integrity in real time without a separate hashing step. This makes it the most appropriate tool for creating a forensic image that also hashes the data during acquisition.

Answer

dd

Answer

fdisk

Answer

memdump

Question 7

In a UK-based investigation, law enforcement officers seize a computer without a warrant. The suspect argues the seizure violated his rights under the Police and Criminal Evidence Act 1984 (PACE). Which of the following is a key consideration under PACE regarding the admissibility of the seized evidence?

Accepted Answer

The court may exclude the evidence if its admission would be unfair to the suspect.. Under Section 78 of PACE, the court has discretion to exclude prosecution evidence if its admission would have such an adverse effect on the fairness of the proceedings that it ought not to be admitted. Since the computer was seized without a warrant, the court must weigh the potential breach of PACE safeguards against the probative value of the digital evidence. This is not automatic exclusion, but a judicial balancing test specific to the circumstances of the seizure.

Answer

The evidence is automatically admissible because it was seized during an investigation.

Answer

The evidence is admissible because it is circumstantial.

Answer

The evidence is admissible only if the suspect signed a consent form.

Question 8

A forensic analyst is testifying as an expert witness in court. The opposing counsel challenges the analyst's testimony based on the Frye standard. What does the Frye standard require for scientific evidence to be admissible?

Accepted Answer

The evidence must be based on techniques generally accepted in the scientific community.. The Frye standard requires that scientific evidence be based on principles and methods that are generally accepted by the relevant scientific community.

Answer

The evidence must have been obtained with a warrant.

Answer

The evidence must be relevant and more probative than prejudicial.

Answer

The evidence must have been peer-reviewed and published.

Question 9

During a forensic examination, the analyst encounters a file that is not automatically readable by forensic tools. The analyst suspects the file contains contraband images. Which of the following is the BEST approach to handle this evidence in accordance with the rules of evidence?

Accepted Answer

Create a forensic copy and use a write blocker to access the copy with appropriate software.. The analyst should document the file's location and metadata, then use a validated tool to extract and view the content while maintaining a chain of custody and ensuring the original is not altered.

Answer

Delete the file to prevent accidental distribution.

Answer

Ignore the file because it cannot be easily read.

Answer

Open the file using the original application on the suspect's computer.

Question 10

Which of the following BEST describes the chain of custody in digital forensics?

Accepted Answer

A log of all personnel who have accessed the evidence, along with timestamps and reasons.. Chain of custody is a documented record that tracks the seizure, custody, control, transfer, analysis, and disposition of evidence, ensuring its integrity and admissibility.

Answer

The software tool used to image the hard drive.

Answer

The process of encrypting evidence to prevent unauthorized access.

Answer

The physical lock and key used to secure the evidence locker.

Question 11

A company's legal department issues a legal hold notice for electronically stored information (ESI) related to a pending lawsuit. The IT department is tasked with preserving data. Which of the following actions is MOST likely to violate the legal hold requirements?

Accepted Answer

Continuing to run a script that deletes temporary files older than 24 hours.. Option C is correct because continuing to run a script that deletes temporary files older than 24 hours directly destroys ESI that may be relevant to the lawsuit, violating the legal hold requirement to preserve all potentially relevant data. Legal hold mandates the suspension of any automated or manual processes that could alter or delete ESI, including temporary files that might contain fragments of relevant documents or metadata. Unlike suspending routine email deletion (Option B), which is a preservation action, the script actively purges data and thus breaches the hold.

Answer

Notifying all employees to preserve documents related to the lawsuit.

Answer

Suspending routine deletion of emails older than 30 days.

Answer

Taking a forensic image of the relevant servers.

Question 12

An investigator is examining a Windows system and needs to capture volatile data without altering the system. Which of the following tools would be MOST appropriate for acquiring the contents of RAM?

Accepted Answer

FTK Imager. FTK Imager can capture a memory dump (RAM) from a live system, preserving volatile data for analysis.

Answer

dd

Answer

EnCase

Answer

Tableau write blocker

Question 13

Which TWO of the following are considered forms of evidence under the rules of evidence? (Select two.)

Accepted Answer

Circumstantial evidence. Circumstantial evidence is a recognized form of evidence under the rules of evidence because it allows a fact-finder to infer a fact from other established facts, even without direct witness testimony. In digital forensics, this is critical when reconstructing user activity from log files, file metadata, or network traffic patterns that indirectly prove an action occurred.

Answer

Illegally obtained evidence

Answer

Hearsay evidence

Answer

Opinion evidence

Question 14

Which THREE of the following are essential steps in the digital forensics investigation process? (Select three.)

Accepted Answer

Examination. Option A (Examination) is correct because it is a core phase in the digital forensics process where investigators identify and extract potential evidence from collected data without altering it. This step involves techniques such as hashing (e.g., SHA-256) to verify integrity and using tools like FTK Imager or EnCase to preview files, ensuring the evidence is preserved in a forensically sound manner. Without examination, the raw collected data cannot be systematically reviewed for relevant artifacts.

Answer

Encryption

Answer

Destruction

Question 15

Which TWO of the following are common hashing algorithms used to verify the integrity of forensic images? (Select two.)

Accepted Answer

SHA-1. MD5 and SHA-1 are widely used hash functions for integrity verification in digital forensics. SHA-256 is also used but less common in legacy contexts.

Answer

AES

Answer

Blowfish

Answer

RSA