CHFI Computer Forensics Fundamentals and Process Practice Test 9 — 15 Questions

Question 1

In a UK-based investigation, law enforcement officers seize a computer without a warrant. The suspect argues the seizure violated his rights under the Police and Criminal Evidence Act 1984 (PACE). Which of the following is a key consideration under PACE regarding the admissibility of the seized evidence?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The court may exclude the evidence if its admission would be unfair to the suspect.. Under Section 78 of PACE, the court has discretion to exclude prosecution evidence if its admission would have such an adverse effect on the fairness of the proceedings that it ought not to be admitted. Since the computer was seized without a warrant, the court must weigh the potential breach of PACE safeguards against the probative value of the digital evidence. This is not automatic exclusion, but a judicial balancing test specific to the circumstances of the seizure.

Answer

The evidence is automatically admissible because it was seized during an investigation.

Answer

The evidence is admissible because it is circumstantial.

Answer

The evidence is admissible only if the suspect signed a consent form.

Question 2

A forensic analyst is testifying as an expert witness in court. The opposing counsel challenges the analyst's testimony based on the Frye standard. What does the Frye standard require for scientific evidence to be admissible?

Accepted Answer

The evidence must be based on techniques generally accepted in the scientific community.. The Frye standard requires that scientific evidence be based on principles and methods that are generally accepted by the relevant scientific community.

Answer

The evidence must have been obtained with a warrant.

Answer

The evidence must be relevant and more probative than prejudicial.

Answer

The evidence must have been peer-reviewed and published.

Question 3

During a forensic examination, the analyst encounters a file that is not automatically readable by forensic tools. The analyst suspects the file contains contraband images. Which of the following is the BEST approach to handle this evidence in accordance with the rules of evidence?

Accepted Answer

Create a forensic copy and use a write blocker to access the copy with appropriate software.. Forensic best practices require creating a bit-for-bit forensic copy of the original evidence and using a write blocker to prevent any alteration to the original. The analyst can then use specialized software (e.g., a hex editor, file carving tools, or a viewer that supports the file's raw format) to access the copy and extract contraband images without violating the integrity of the evidence, which is essential for admissibility under rules of evidence such as the Federal Rules of Evidence (FRE) 901.

Answer

Delete the file to prevent accidental distribution.

Answer

Ignore the file because it cannot be easily read.

Answer

Open the file using the original application on the suspect's computer.

Question 4

Which of the following BEST describes the chain of custody in digital forensics?

Accepted Answer

A log of all personnel who have accessed the evidence, along with timestamps and reasons.. The chain of custody is a documented chronological record that tracks the seizure, custody, control, transfer, analysis, and disposition of digital evidence. It must include every person who handled the evidence, the date and time it was accessed, the purpose of access, and any changes made, ensuring the evidence's integrity and admissibility in court under rules like Federal Rule of Evidence 901.

Answer

The software tool used to image the hard drive.

Answer

The process of encrypting evidence to prevent unauthorized access.

Answer

The physical lock and key used to secure the evidence locker.

Question 5

A company's legal department issues a legal hold notice for electronically stored information (ESI) related to a pending lawsuit. The IT department is tasked with preserving data. Which of the following actions is MOST likely to violate the legal hold requirements?

Accepted Answer

Continuing to run a script that deletes temporary files older than 24 hours.. Continuing to run a script that deletes temporary files older than 24 hours directly destroys ESI that may be relevant to the lawsuit, violating the legal hold requirement to preserve all potentially relevant data. Legal hold mandates the suspension of any automated or manual processes that could alter or delete ESI, including temporary files that might contain fragments of relevant documents or metadata. Unlike suspending routine email deletion (Option B), which is a preservation action, the script actively purges data and thus breaches the hold.

Answer

Notifying all employees to preserve documents related to the lawsuit.

Answer

Suspending routine deletion of emails older than 30 days.

Answer

Taking a forensic image of the relevant servers.

Question 6

Which THREE of the following are essential steps in the digital forensics investigation process? (Select three.)

Accepted Answer

Examination. The digital forensics investigation process follows a defined sequence of phases, and Collection (D) is essential because it is the phase where potentially relevant data is identified, preserved, and acquired from sources such as disks, memory, and logs using write-blockers and hashing to maintain integrity. Examination (A) is essential because it is where the collected data is filtered, extracted, and reduced to identify only the information relevant to the case, using forensic tools and techniques. Analysis (B) is essential because it is where the examined data is interpreted to answer the investigative questions, establish timelines, attribute actions, and draw conclusions supported by the evidence. Encryption (C) is not a forensic process phase; it is a data-protection technique that may be encountered as an obstacle during examination, not a required step. Destruction (E) is not part of the investigation process either, since evidence must be preserved and retained per legal and chain-of-custody requirements rather than destroyed.

Answer

Encryption

Answer

Destruction

Question 7

Which TWO of the following are common hashing algorithms used to verify the integrity of forensic images? (Select two.)

Accepted Answer

SHA-1. SHA-1 (B) is a cryptographic hash function that produces a 160-bit digest and is widely used in forensic imaging tools to verify that a disk image has not been altered, making it correct here. MD5 (E) is likewise a common hashing algorithm producing a 128-bit digest, and it is routinely paired with SHA-1 to validate the integrity of forensic images, so it is also correct. AES (A) is a symmetric block cipher used for encryption, not a hashing algorithm, so it does not verify integrity. Blowfish (C) is also a symmetric encryption cipher, not a hash function. RSA (D) is an asymmetric public-key algorithm used for encryption and digital signatures, not for generating integrity hashes.

Answer

AES

Answer

Blowfish

Answer

RSA

Question 8

During a forensic investigation, the first responder arrives at a scene where a computer is powered on and a user is logged in. Which of the following is the MOST appropriate initial action?

Accepted Answer

Disconnect the computer from the network and take a photograph of the screen. Securing the scene and documenting everything is the first priority to preserve evidence and ensure chain of custody. Powering off or accessing the system without proper documentation can lead to evidence spoliation.

Answer

Immediately power off the computer to prevent data alteration

Answer

Begin collecting data by copying all files to an external drive

Answer

Ask the user to save their work and then shut down normally

Question 9

A forensic analyst is creating a forensic image of a suspect's hard drive using a write blocker. Which of the following BEST describes the purpose of using a hardware write blocker?

Accepted Answer

To ensure that no data is written to the source drive during imaging. A hardware write blocker is a device placed between the suspect drive and the forensic workstation that intercepts and blocks any write commands from the operating system or imaging software. Its primary purpose is to guarantee that the source drive remains completely unaltered during acquisition, preserving the integrity of the evidence for legal and forensic purposes. This is achieved by allowing only read commands to pass through, while all write commands are physically or logically blocked at the hardware level.

Answer

To increase the speed of data acquisition

Answer

To encrypt the forensic image for secure storage

Answer

To allow the suspect drive to be booted without altering data

Question 10

During a forensic investigation, an analyst uses the following command: dd if=/dev/sda of=/mnt/evidence/image.dd bs=4096 conv=noerror,sync. What is the effect of the conv=noerror,sync option?

Accepted Answer

It ignores read errors and pads bad blocks with zeros in the output image. The `conv=noerror,sync` option in `dd` instructs the tool to continue processing even when a read error is encountered (`noerror`) and to pad the output block with zeros (`sync`) to maintain the correct block size and offset alignment. This ensures that the forensic image remains a bit-for-bit copy of the source device in terms of size and structure, with corrupted sectors replaced by zeros rather than causing the imaging process to abort or produce a truncated image.

Answer

It verifies the integrity of the image using a hash algorithm

Answer

It creates a compressed image to save disk space

Answer

It enables logging of all I/O errors to a separate file

Question 11

A forensic investigator is required to testify in court about the findings of a digital investigation. Which of the following roles does the investigator fulfill?

Accepted Answer

Expert witness. A is correct because a forensic investigator who testifies about their analysis and conclusions—such as interpreting file system artifacts, registry data, or network logs—qualifies as an expert witness under Federal Rule of Evidence 702. The investigator’s testimony goes beyond mere fact recitation; it applies specialized knowledge, training, and experience to form opinions about the digital evidence, which is the hallmark of an expert witness.

Answer

Lay witness

Answer

Character witness

Answer

Fact witness

Question 12

During an investigation, a forensic analyst must preserve a hard drive that is part of a RAID array. Which of the following is the MOST appropriate method to preserve the evidence?

Accepted Answer

Image each physical drive individually using a write blocker. Imaging each physical drive individually with a write blocker preserves the exact bit-for-bit state of every disk in the RAID array, including metadata, parity, and superblock information. This approach ensures that the logical volume can be reconstructed later in a controlled environment without altering the original evidence, which is critical for maintaining chain of custody and forensic integrity.

Answer

Power off the system and remove only the drive with the operating system

Answer

Disconnect all drives and image a logical volume after the RAID controller

Answer

Rebuild the array in a different system and then image

Question 13

A forensic examiner is presented with evidence that a suspect's computer was used to commit a fraud. The defense argues that the evidence was obtained without a warrant. Which US Constitutional Amendment is MOST relevant to this argument?

Accepted Answer

Fourth Amendment. The Fourth Amendment protects against unreasonable searches and seizures and requires warrants supported by probable cause.

Answer

First Amendment

Answer

Sixth Amendment

Answer

Fifth Amendment

Question 14

Which of the following tools is specifically designed for forensic imaging and can create compressed, segmented, or E01 format images?

Accepted Answer

FTK Imager. FTK Imager is specifically designed for forensic imaging and supports creating compressed, segmented, and E01 (Expert Witness Format) images. Unlike generic tools, it provides a GUI and built-in validation (e.g., MD5/SHA1 hashing) tailored for forensic acquisition, making it the correct choice for this question.

Answer

dd

Answer

Nmap

Answer

Wireshark

Question 15

Locard's exchange principle in digital forensics states that:

Accepted Answer

Every contact leaves a trace, and digital evidence is no exception. Locard's exchange principle, originally from forensic science, asserts that whenever two objects come into contact, a transfer of material occurs. In digital forensics, this translates to the fact that digital devices and systems inevitably leave traces of their interactions—such as log entries, metadata, file artifacts, or network packets—making it possible to reconstruct events. Option D correctly captures this core idea that every contact leaves a trace, and digital evidence is no exception.

Answer

The chain of custody must be documented for all evidence

Answer

Digital evidence is always stored in the cloud

Answer

Only the forensic examiner can handle evidence