CHFI Computer Forensics Fundamentals and Process Practice Test 8 — 15 Questions

Question 1

In a UK-based investigation, which legal framework governs the search and seizure of digital evidence?

Accepted Answer

PACE (Police and Criminal Evidence Act). The Police and Criminal Evidence Act 1984 (PACE) provides the legal framework for police powers, including search and seizure of digital evidence in the UK.

Answer

Electronic Communications Privacy Act

Answer

Fourth Amendment

Answer

GDPR

Question 2

Which of the following is the BEST description of Locard's exchange principle as applied to digital forensics?

Accepted Answer

Every contact leaves a trace; the perpetrator will leave digital traces on the crime scene. Locard's exchange principle states that every contact leaves a trace. In digital forensics, this means that when a perpetrator interacts with a system—whether by accessing files, running commands, or connecting to a network—they inevitably leave digital artifacts such as log entries, registry keys, metadata, or network connection records. Option C correctly captures this core concept of trace transfer in the digital domain.

Answer

Only original evidence is admissible in court

Answer

Digital evidence must be collected in a manner that preserves its integrity

Answer

Evidence must be documented with a chain of custody

Question 3

A forensic examiner needs to create a bit-for-bit copy of a suspect's hard drive for analysis. Which tool is specifically designed for this purpose and can also verify integrity using hashing?

Accepted Answer

dd. The `dd` command is a Unix/Linux utility that performs low-level bit-for-bit copying of storage devices, creating an exact forensic image (e.g., raw .dd or .img format). It can verify integrity by piping the output through a hashing tool like `md5sum` or `sha256sum`, or by using `dd` with `conv=noerror,sync` and later comparing hash values of the source and destination.

Answer

Wireshark

Answer

Metasploit

Answer

Nmap

Question 4

During a forensic investigation, the examiner uses a write blocker to connect the suspect drive to the forensic workstation. What is the PRIMARY purpose of using a write blocker?

Accepted Answer

To prevent the operating system from writing data to the evidence drive. The primary purpose of a write blocker is to intercept and block any write commands from the operating system to the evidence drive, ensuring that the original data remains unaltered (bit-for-bit identical) during acquisition. This maintains the forensic integrity of the evidence, which is critical for admissibility in legal proceedings. Without a write blocker, the OS could automatically write metadata, logs, or temporary files to the drive, contaminating the evidence.

Answer

To speed up the data acquisition process

Answer

To encrypt the data on the evidence drive

Answer

To allow the evidence drive to be used as a boot device

Question 5

Which hashing algorithm is commonly used in forensic imaging to verify the integrity of evidence and is considered more secure than MD5?

Accepted Answer

SHA-256. SHA-256 is the correct answer because it is a widely adopted cryptographic hash function in forensic imaging tools (e.g., FTK Imager, EnCase) to verify evidence integrity. It produces a 256-bit (32-byte) hash value and is considered collision-resistant, making it significantly more secure than MD5, which has known collision vulnerabilities.

Answer

SHA-1

Answer

CRC32

Answer

MD5

Question 6

An organization receives a legal hold notice regarding a pending lawsuit. The IT department is instructed to preserve all relevant electronically stored information (ESI). Which of the following actions must be taken FIRST?

Accepted Answer

Immediately suspend any automated data deletion policies. When a legal hold notice is issued, the first priority is to preserve all potentially relevant ESI by immediately suspending any automated data deletion policies (e.g., retention schedules, auto-archiving, or purge scripts). This prevents spoliation of evidence before any collection or analysis begins. Failure to do so could result in sanctions for destroying discoverable data.

Answer

Perform a full forensic analysis of all systems

Answer

Notify all employees to delete personal files

Answer

Delete all emails older than 30 days to reduce storage

Question 7

A forensic analyst is preparing to testify as an expert witness in court. Which of the following characteristics is MOST essential for the court to accept the analyst's testimony?

Accepted Answer

The analyst's methods are generally accepted in the forensic community. The court's acceptance of expert testimony hinges on the reliability and validity of the methods used, not the analyst's personal involvement or credentials. Under the Daubert standard (or Frye standard in some jurisdictions), the key factor is whether the forensic methods have been subjected to peer review, are generally accepted within the relevant scientific community, and have a known error rate. This ensures the testimony is based on sound scientific principles, not just the analyst's qualifications or role in the case.

Answer

The analyst has direct knowledge of the case

Answer

The analyst has a certification in computer forensics

Answer

The analyst is employed by the prosecution

Question 8

Which TWO of the following are essential components of chain of custody documentation?

Accepted Answer

Every person who handled the evidence must sign and date the form. Option A is correct because chain of custody requires an unbroken, auditable record of possession, so every individual who handled the evidence must sign and date the form to establish accountability and continuity. Option B is correct because the evidence must be uniquely and precisely identified—including make, model, and serial number—so it can be distinguished from similar items and matched to the custody entries. Option C is not essential to chain of custody itself; the forensic tool used belongs to the analysis methodology and is documented in the examination report, not the custody log. Option D is not required; evidence must be secured against tampering, but a fireproof safe is a storage recommendation, not a chain-of-custody component. Option E is not part of chain of custody; the final analysis report documents findings and conclusions, not the chronological transfer and handling of the evidence.

Answer

The forensic tool used to analyze the evidence

Answer

The evidence must be stored in a fireproof safe

Answer

The final analysis report

Question 9

A first responder arrives at a crime scene where a computer is running. Which THREE actions should the first responder take to preserve volatile evidence?

Accepted Answer

Collect contents of RAM using a tool like FTK Imager or dd. Option A is correct because RAM contents are highly volatile and lost on power-off, so capturing memory with a tool like FTK Imager or dd preserves running processes, encryption keys, and other in-memory artifacts. Option C is correct because netstat records active network connections and listening ports, which are volatile and can reveal remote sessions or exfiltration activity before they disappear. Option E is correct because photographing the screen captures the current visual state of the running system, including open windows and displayed data, without altering the machine. Option B is not appropriate because unplugging the power cord immediately destroys volatile evidence such as RAM and active connections. Option D is not appropriate because running an antivirus scan modifies the system, overwrites volatile data, and can destroy evidence rather than preserve it.

Answer

Unplug the power cord immediately

Answer

Run a full antivirus scan on the system

Question 10

A first responder arrives at a crime scene where a computer is powered on and displaying a desktop. According to best practices, which of the following actions should the responder take FIRST?

Accepted Answer

Photograph the scene and the computer screen.. The first priority at a live crime scene is to document the state of the system before any interaction. Photographing the screen captures volatile data (e.g., open windows, running processes, time) that would be lost upon any keystroke or power change. This aligns with the order of volatility (RFC 3227) and ensures a legally defensible chain of custody from the outset.

Answer

Press Ctrl+Alt+Del to check for active user sessions.

Answer

Connect a write blocker and begin imaging the hard drive.

Answer

Unplug the power cord immediately to preserve volatile data.

Question 11

During a forensic investigation, an analyst acquires a hard drive using a hardware write blocker. Which of the following is the PRIMARY reason for using a hardware write blocker?

Accepted Answer

To ensure that the operating system does not mount the drive as writable.. The primary reason for using a hardware write blocker is to physically intercept the SATA/IDE bus between the suspect drive and the forensic workstation, ensuring that only read commands (e.g., ATA READ DMA) are passed through while blocking any write commands (e.g., ATA WRITE DMA). This prevents the operating system from mounting the drive as writable, which would otherwise cause automatic writes (e.g., timestamp updates, journaling, or prefetch creation) that alter evidence and break the chain of custody.

Answer

To increase the transfer speed of the imaging process.

Answer

To bypass the drive's password protection.

Answer

To compress the data during imaging.

Question 12

After collecting digital evidence from a suspect's computer, the forensic examiner creates a forensic image using FTK Imager. The examiner then computes the MD5 hash of the original drive and the image file. Which of the following BEST describes the purpose of this hashing?

Accepted Answer

To verify that the image is an exact bit-for-bit copy of the original.. Hashing with MD5 (or SHA-1/SHA-256) produces a unique fixed-size digest of the data. By comparing the hash of the original drive to the hash of the forensic image, the examiner can confirm that the image is an exact bit-for-bit copy, ensuring the integrity of the evidence and that no data has been altered during acquisition.

Answer

To encrypt the data for secure storage.

Answer

To index the files for faster searching.

Answer

To reduce the storage size of the image.

Question 13

An organization receives a litigation hold notice regarding an ongoing lawsuit. The IT administrator is instructed to preserve all relevant electronic records. Which of the following actions is MOST consistent with proper legal hold implementation?

Accepted Answer

Place a hold on all data that may be relevant by suspending routine deletion and notifying custodians.. A litigation hold (also known as a legal hold) requires suspending routine data deletion and preservation of potentially relevant electronically stored information (ESI). The IT administrator must notify custodians and implement a hold that prevents automated purging (e.g., via retention policies in Exchange or file servers) to comply with the duty to preserve evidence under FRCP Rule 37(e).

Answer

Reboot all servers to ensure they are running the latest patches.

Answer

Immediately delete all emails older than 90 days to reduce data volume.

Answer

Encrypt all data and change access passwords to prevent unauthorized access.

Question 14

Which of the following principles states that when two objects come into contact, there is a transfer of material between them?

Accepted Answer

Locard's exchange principle. Locard's exchange principle is a foundational concept in forensic science stating that whenever two objects come into contact, there is a transfer of material between them. In digital forensics, this principle applies to the transfer of digital artifacts (e.g., file fragments, metadata, network traces) when systems interact, such as when a suspect's device connects to a server or when data is copied between storage media.

Answer

The best evidence rule

Answer

The chain of custody

Answer

The hearsay rule

Question 15

During a forensic investigation, the analyst needs to create a forensic image of a hard drive that also hashes the data during acquisition. Which command-line tool would be MOST appropriate for this task?

Accepted Answer

dcfldd. dcfldd is a modified version of dd that includes built-in hashing (e.g., MD5, SHA-1, SHA-256) during the imaging process, allowing the analyst to verify data integrity in real time without a separate hashing step. This makes it the most appropriate tool for creating a forensic image that also hashes the data during acquisition.

Answer

dd

Answer

fdisk

Answer

memdump