CHFI Evidence Acquisition and Duplication — 10 Questions

Question 1

During a forensic investigation, you are asked to acquire the contents of RAM from a live Windows 10 system without causing system instability. Which tool would be most appropriate for this task?

Accepted Answer

Belkasoft RAM Capturer. Belkasoft RAM Capturer is the most appropriate tool for acquiring RAM from a live Windows 10 system because it is designed specifically for live memory acquisition on Windows, uses a lightweight kernel-mode driver to read physical memory without causing system instability, and supports acquisition from 64-bit systems. Unlike other tools, it minimizes interaction with the target process list and avoids loading unnecessary user-mode components that could trigger crashes or alter the memory state.

Answer

LiME

Answer

DumpIt

Answer

FTK Imager

Question 2

You are imaging a suspect's hard drive using a write blocker and dd command. After imaging, you verify the hash of the original drive and the image file. The original drive hash is SHA1: A1B2C3D4E5..., and the image hash is SHA1: F6G7H8I9J0... What is the most likely cause of the mismatch?

Accepted Answer

The write blocker malfunctioned and allowed writes to the original drive. The hash mismatch indicates that the data on the original drive and the image file are not identical. A write blocker malfunction that allowed writes to the original drive during the imaging process would alter the source data after the initial hash was computed, causing the final hash of the original drive to differ from the hash of the image file taken at a different point in time. This is the most direct cause of a hash mismatch because the write blocker's primary purpose is to prevent any modification to the evidence.

Answer

The dd command used a different block size

Answer

The dd command compressed the output

Answer

The image file was corrupted during transfer

Question 3

A forensic examiner needs to acquire a hard drive that is part of a RAID 5 array. The RAID controller is unavailable. What is the best approach to acquire the data?

Accepted Answer

Acquire each disk individually, then reconstruct the array using software. When the RAID controller is unavailable, the only reliable method to acquire the data is to image each physical disk individually using a forensic write blocker, then reconstruct the logical RAID 5 volume in a forensic software tool (e.g., FTK Imager, X-Ways Forensics, or EnCase). This preserves the original evidence on each disk and allows the examiner to rebuild the array by specifying the stripe size, parity rotation, and disk order, which is essential because RAID 5 distributes data and parity across all disks and can tolerate a single disk failure.

Answer

Acquire only one disk because RAID 5 can be reconstructed from a single disk

Answer

Use a hardware write blocker that supports RAID

Answer

Connect the RAID array to a similar controller and acquire as a single drive

Question 4

During a network forensic investigation, you need to capture live network traffic from a switch span port. Which tool would best capture the traffic in a forensically sound manner?

Accepted Answer

Wireshark. Wireshark is the best tool for capturing live network traffic from a switch SPAN port in a forensically sound manner because it provides a robust graphical interface for real-time packet capture and analysis, supports full packet capture with timestamps, and can write captures directly to a pcapng file format that preserves packet integrity and metadata. Its ability to run in promiscuous mode ensures all traffic from the SPAN port is captured without altering the data, meeting forensic requirements for accuracy and completeness.

Answer

Nmap

Answer

Netcat

Answer

Tcpdump

Question 5

You are acquiring a laptop with a self-encrypting drive (SED) that is powered on and logged in. What is the best method to acquire the drive while preserving encrypted data?

Accepted Answer

Acquire a logical image from the running operating system. When a self-encrypting drive (SED) is powered on and logged in, the drive's hardware encryption key is already loaded and the data is accessible through the operating system. The best method to preserve the encrypted data in its decrypted state is to acquire a logical image from the running OS, which captures files and metadata without powering off the drive and losing the decryption context. Removing power or rebooting would cause the SED to lock, requiring the authentication key again and potentially altering the data state.

Answer

Remove the drive and use a forensic bridge that supports SED

Answer

Power off the laptop and image the drive using a hardware write blocker

Answer

Boot from a forensic live CD and image the drive

Question 6

Which of the following is the primary purpose of using a hardware write blocker during disk acquisition?

Accepted Answer

To prevent any writes to the original evidence drive. A hardware write blocker is a device placed between the suspect drive and the forensic workstation that intercepts and blocks any write commands from the host operating system, ensuring that the original evidence drive remains unaltered. This is critical for maintaining the integrity of digital evidence, as any modification to the source drive could render it inadmissible in court. The primary purpose is therefore to prevent any writes to the original evidence drive, preserving its exact state for forensic analysis.

Answer

To decrypt the drive during acquisition

Answer

To compress the acquired image

Answer

To increase the speed of the acquisition

Question 7

During a forensic acquisition, you notice that the target drive has bad sectors. What is the best approach to acquire the drive?

Accepted Answer

Use ddrescue to recover as much data as possible. B is correct because ddrescue is specifically designed to handle media with bad sectors by using a sophisticated read-retry algorithm that logs errors and attempts recovery from multiple angles, including reverse reads and splitting the drive into good and bad regions. Unlike dd, which will abort or produce corrupted output on encountering a bad sector, ddrescue maximizes data recovery while preserving a map of unrecoverable areas.

Answer

Use dd with a higher block size to skip bad sectors

Answer

Use FTK Imager and ignore the errors

Answer

Perform a physical acquisition by removing platters

Question 8

Which TWO of the following are valid methods for acquiring volatile data from a live Windows system? (Choose two.)

Accepted Answer

Capturing active network connections. Option B is correct because capturing active network connections (e.g., using `netstat -anob` or `netstat -ano`) retrieves volatile data that is lost when the system is powered off. This data includes current TCP/UDP connections, listening ports, and associated process IDs, which are critical for identifying active network threats or unauthorized communications during incident response.

Answer

Copying the Windows registry

Answer

Imaging the hard drive

Answer

Extracting the Master File Table (MFT)

Question 9

Which THREE of the following are acceptable best practices when acquiring evidence from a mobile device? (Choose three.)

Accepted Answer

Document the SIM card information. Option A is correct because documenting the SIM card information, such as the ICCID (Integrated Circuit Card Identifier) and IMSI (International Mobile Subscriber Identity), is a critical step in establishing chain of custody and preserving evidence that may link the device to a specific subscriber or network. This documentation must occur before any acquisition to ensure the SIM's data is not altered by subsequent imaging or isolation procedures.

Answer

Power off the device immediately to preserve battery

Answer

Only perform a physical acquisition, as it is the only forensically sound method

Question 10

The command used to acquire a disk image resulted in an I/O error. What is the most likely cause?

Accepted Answer

The source disk has bad sectors. When a disk imaging tool (e.g., dd, FTK Imager, EnCase) encounters an I/O error during acquisition, the most common cause is physical damage or degradation of the source media, specifically bad sectors. Bad sectors prevent the read head from reliably retrieving data, triggering an I/O error at the operating system or device driver level. This is distinct from logical errors like file system corruption, which typically produce different error messages.

Answer

The output file already exists and is being overwritten

Answer

The target directory does not have write permissions

Answer

The target drive is full