CHFI Computer Forensics Fundamentals and Process Practice Test 9 — 15 Questions

Question 1

During a forensic investigation, the first responder arrives at a scene where a computer is powered on and a user is logged in. Which of the following is the MOST appropriate initial action?

Accepted Answer

Disconnect the computer from the network and take a photograph of the screen. Securing the scene and documenting everything is the first priority to preserve evidence and ensure chain of custody. Powering off or accessing the system without proper documentation can lead to evidence spoliation.

Answer

Immediately power off the computer to prevent data alteration

Answer

Begin collecting data by copying all files to an external drive

Answer

Ask the user to save their work and then shut down normally

Question 2

A forensic analyst is creating a forensic image of a suspect's hard drive using a write blocker. Which of the following BEST describes the purpose of using a hardware write blocker?

Accepted Answer

To ensure that no data is written to the source drive during imaging. A hardware write blocker prevents any modification to the original evidence by intercepting write commands at the hardware level, ensuring the integrity of the source drive.

Answer

To increase the speed of data acquisition

Answer

To encrypt the forensic image for secure storage

Answer

To allow the suspect drive to be booted without altering data

Question 3

During a forensic investigation, an analyst uses the following command: dd if=/dev/sda of=/mnt/evidence/image.dd bs=4096 conv=noerror,sync. What is the effect of the conv=noerror,sync option?

Accepted Answer

It ignores read errors and pads bad blocks with zeros in the output image. The `conv=noerror,sync` option in `dd` instructs the tool to continue processing even when a read error is encountered (`noerror`) and to pad the output block with zeros (`sync`) to maintain the correct block size and offset alignment. This ensures that the forensic image remains a bit-for-bit copy of the source device in terms of size and structure, with corrupted sectors replaced by zeros rather than causing the imaging process to abort or produce a truncated image.

Answer

It verifies the integrity of the image using a hash algorithm

Answer

It creates a compressed image to save disk space

Answer

It enables logging of all I/O errors to a separate file

Question 4

Which of the following is the BEST example of direct evidence in a computer forensics investigation?

Accepted Answer

A server log showing the suspect's IP address accessed a restricted file at the time of the incident. Direct evidence directly proves a fact without requiring inference. A server log showing the suspect's IP address accessing a restricted file at the time of the incident is direct evidence because it directly links the suspect's system to the specific action (accessing the file) at the relevant time, without needing additional reasoning or assumptions. This is based on the principle that logs capture actual system events, making them direct proof of the occurrence of that event.

Answer

A document found on the suspect's computer with content about the crime

Answer

Expert testimony that the suspect's computer contained malware

Answer

A witness testifying that the suspect was the only person who knew the password

Question 5

A forensic investigator is required to testify in court about the findings of a digital investigation. Which of the following roles does the investigator fulfill?

Accepted Answer

Expert witness. An expert witness is someone with specialized knowledge who provides opinion testimony to assist the court in understanding technical evidence.

Answer

Lay witness

Answer

Character witness

Answer

Fact witness

Question 6

During an investigation, a forensic analyst must preserve a hard drive that is part of a RAID array. Which of the following is the MOST appropriate method to preserve the evidence?

Accepted Answer

Image each physical drive individually using a write blocker. Option C is correct because imaging each physical drive individually with a write blocker preserves the exact bit-for-bit state of every disk in the RAID array, including metadata, parity, and superblock information. This approach ensures that the logical volume can be reconstructed later in a controlled environment without altering the original evidence, which is critical for maintaining chain of custody and forensic integrity.

Answer

Power off the system and remove only the drive with the operating system

Answer

Disconnect all drives and image a logical volume after the RAID controller

Answer

Rebuild the array in a different system and then image

Question 7

A forensic examiner is presented with evidence that a suspect's computer was used to commit a fraud. The defense argues that the evidence was obtained without a warrant. Which US Constitutional Amendment is MOST relevant to this argument?

Accepted Answer

Fourth Amendment. The Fourth Amendment protects against unreasonable searches and seizures and requires warrants supported by probable cause.

Answer

First Amendment

Answer

Sixth Amendment

Answer

Fifth Amendment

Question 8

Which of the following tools is specifically designed for forensic imaging and can create compressed, segmented, or E01 format images?

Accepted Answer

FTK Imager. FTK Imager is a free forensic imaging tool that supports multiple output formats including E01 (EnCase), DD, and segmented images.

Answer

dd

Answer

Nmap

Answer

Wireshark

Question 9

Locard's exchange principle in digital forensics states that:

Accepted Answer

Every contact leaves a trace, and digital evidence is no exception. Locard's exchange principle, originally from forensic science, asserts that whenever two objects come into contact, a transfer of material occurs. In digital forensics, this translates to the fact that digital devices and systems inevitably leave traces of their interactions—such as log entries, metadata, file artifacts, or network packets—making it possible to reconstruct events. Option D correctly captures this core idea that every contact leaves a trace, and digital evidence is no exception.

Answer

The chain of custody must be documented for all evidence

Answer

Digital evidence is always stored in the cloud

Answer

Only the forensic examiner can handle evidence

Question 10

A legal hold is issued by an organization's legal department. What is the primary purpose of a legal hold?

Accepted Answer

To preserve all relevant data that may be needed for a legal case. A legal hold suspends normal document deletion and preservation policies to ensure that relevant electronically stored information (ESI) is retained for potential litigation or investigation.

Answer

To notify employees that litigation is pending

Answer

To authorize law enforcement to seize computers

Answer

To encrypt all company data for security

Question 11

During a forensic investigation, the analyst needs to verify the integrity of a forensic image. The analyst originally computed MD5 and SHA-1 hashes of the source drive. Which action BEST ensures the image has not been altered?

Accepted Answer

Recompute MD5 and SHA-1 hashes of the image and compare with the original. Recomputing the hashes on the image and comparing them to the original hashes ensures that the image matches the source exactly, proving integrity.

Answer

Check that the image was created using a write blocker

Answer

Compare the file size of the image with the original drive's capacity

Answer

Open the image in FTK Imager and browse a few files

Question 12

In the context of the UK Police and Criminal Evidence Act (PACE), which of the following is a key requirement for the admissibility of digital evidence?

Accepted Answer

The evidence must be obtained lawfully and without oppression. PACE requires that evidence is not obtained through oppression or in violation of legal procedures, ensuring reliability and fairness.

Answer

The evidence must be stored on a write-protected medium

Answer

The evidence must be reviewed by an independent third party

Answer

The evidence must be encrypted at all times

Question 13

Which TWO of the following are essential components of a proper chain of custody documentation? (Select TWO.)

Accepted Answer

Date and time of each evidence transfer. The chain of custody documentation must record the date and time of each evidence transfer to establish a clear chronological timeline of custody. This ensures that the evidence can be tracked from collection through analysis to presentation in court, preventing claims of tampering or mishandling.

Answer

The name of the suspect

Answer

The operating system version of the suspect's computer

Answer

The IP address of the forensic workstation

Question 14

Which THREE of the following are rules of evidence that must be satisfied for digital evidence to be admissible in court? (Select THREE.)

Accepted Answer

Admissibility. Admissibility requires that evidence is relevant (admissible), reliable (authentic), and complete (not partial).

Answer

Simplicity

Answer

Encryption

Question 15

Which TWO of the following are considered best practices for a first responder at a digital crime scene? (Select TWO.)

Accepted Answer

Photograph the scene including screen contents and connections. First responders should not power off the system (to preserve volatile data) and should photograph the scene to document the state.

Answer

Power off the computer immediately to secure data

Answer

Boot the system into safe mode to examine logs

Answer

Disconnect all cables to isolate the device