CHFI Evidence Acquisition and Duplication — 20 Questions

Question 1

During a forensic investigation, you are asked to acquire the contents of RAM from a live Windows 10 system without causing system instability. Which tool would be most appropriate for this task?

Accepted Answer

Belkasoft RAM Capturer. Belkasoft RAM Capturer is the most appropriate tool for acquiring RAM from a live Windows 10 system because it is designed specifically for live memory acquisition on Windows, uses a lightweight kernel-mode driver to read physical memory without causing system instability, and supports acquisition from 64-bit systems. Unlike other tools, it minimizes interaction with the target process list and avoids loading unnecessary user-mode components that could trigger crashes or alter the memory state.

Answer

LiME

Answer

DumpIt

Answer

FTK Imager

Question 2

A forensic examiner needs to acquire a hard drive that is part of a RAID 5 array. The RAID controller is unavailable. What is the best approach to acquire the data?

Accepted Answer

Acquire each disk individually, then reconstruct the array using software. When the RAID controller is unavailable, the only reliable method to acquire the data is to image each physical disk individually using a forensic write blocker, then reconstruct the logical RAID 5 volume in a forensic software tool (e.g., FTK Imager, X-Ways Forensics, or EnCase). This preserves the original evidence on each disk and allows the examiner to rebuild the array by specifying the stripe size, parity rotation, and disk order, which is essential because RAID 5 distributes data and parity across all disks and can tolerate a single disk failure.

Answer

Acquire only one disk because RAID 5 can be reconstructed from a single disk

Answer

Use a hardware write blocker that supports RAID

Answer

Connect the RAID array to a similar controller and acquire as a single drive

Question 3

During a network forensic investigation, you need to capture live network traffic from a switch span port. Which tool would best capture the traffic in a forensically sound manner?

Accepted Answer

Wireshark. Wireshark is the best tool for capturing live network traffic from a switch SPAN port in a forensically sound manner because it provides a robust graphical interface for real-time packet capture and analysis, supports full packet capture with timestamps, and can write captures directly to a pcapng file format that preserves packet integrity and metadata. Its ability to run in promiscuous mode ensures all traffic from the SPAN port is captured without altering the data, meeting forensic requirements for accuracy and completeness.

Answer

Nmap

Answer

Netcat

Answer

Tcpdump

Question 4

You are acquiring a laptop with a self-encrypting drive (SED) that is powered on and logged in. What is the best method to acquire the drive while preserving encrypted data?

Accepted Answer

Acquire a logical image from the running operating system. When a self-encrypting drive (SED) is powered on and logged in, the drive's hardware encryption key is already loaded and the data is accessible through the operating system. The best method to preserve the encrypted data in its decrypted state is to acquire a logical image from the running OS, which captures files and metadata without powering off the drive and losing the decryption context. Removing power or rebooting would cause the SED to lock, requiring the authentication key again and potentially altering the data state.

Answer

Remove the drive and use a forensic bridge that supports SED

Answer

Power off the laptop and image the drive using a hardware write blocker

Answer

Boot from a forensic live CD and image the drive

Question 5

Which of the following is the primary purpose of using a hardware write blocker during disk acquisition?

Accepted Answer

To prevent any writes to the original evidence drive. A hardware write blocker is a device placed between the suspect drive and the forensic workstation that intercepts and blocks any write commands from the host operating system, ensuring that the original evidence drive remains unaltered. This is critical for maintaining the integrity of digital evidence, as any modification to the source drive could render it inadmissible in court. The primary purpose is therefore to prevent any writes to the original evidence drive, preserving its exact state for forensic analysis.

Answer

To decrypt the drive during acquisition

Answer

To compress the acquired image

Answer

To increase the speed of the acquisition

Question 6

During a forensic acquisition, you notice that the target drive has bad sectors. What is the best approach to acquire the drive?

Accepted Answer

Use ddrescue to recover as much data as possible. B is correct because ddrescue is specifically designed to handle media with bad sectors by using a sophisticated read-retry algorithm that logs errors and attempts recovery from multiple angles, including reverse reads and splitting the drive into good and bad regions. Unlike dd, which will abort or produce corrupted output on encountering a bad sector, ddrescue maximizes data recovery while preserving a map of unrecoverable areas.

Answer

Use dd with a higher block size to skip bad sectors

Answer

Use FTK Imager and ignore the errors

Answer

Perform a physical acquisition by removing platters

Question 7

Which TWO of the following are valid methods for acquiring volatile data from a live Windows system? (Choose two.)

Accepted Answer

Capturing active network connections. Capturing active network connections (e.g., using `netstat -anob` or `netstat -ano`) retrieves volatile data that is lost when the system is powered off. This data includes current TCP/UDP connections, listening ports, and associated process IDs, which are critical for identifying active network threats or unauthorized communications during incident response.

Answer

Copying the Windows registry

Answer

Imaging the hard drive

Answer

Extracting the Master File Table (MFT)

Question 8

Which THREE of the following are acceptable best practices when acquiring evidence from a mobile device? (Choose three.)

Accepted Answer

Document the SIM card information. Documenting the SIM card information, such as the ICCID (Integrated Circuit Card Identifier) and IMSI (International Mobile Subscriber Identity), is a critical step in establishing chain of custody and preserving evidence that may link the device to a specific subscriber or network. This documentation must occur before any acquisition to ensure the SIM's data is not altered by subsequent imaging or isolation procedures.

Answer

Power off the device immediately to preserve battery

Answer

Only perform a physical acquisition, as it is the only forensically sound method

Question 9

The command used to acquire a disk image resulted in an I/O error. What is the most likely cause?

Accepted Answer

The source disk has bad sectors. When a disk imaging tool (e.g., dd, FTK Imager, EnCase) encounters an I/O error during acquisition, the most common cause is physical damage or degradation of the source media, specifically bad sectors. Bad sectors prevent the read head from reliably retrieving data, triggering an I/O error at the operating system or device driver level. This is distinct from logical errors like file system corruption, which typically produce different error messages.

Answer

The output file already exists and is being overwritten

Answer

The target directory does not have write permissions

Answer

The target drive is full

Question 10

Based on the acquisition log, what can be concluded about the integrity of the acquired image?

Accepted Answer

The image is an exact copy of the source. The acquisition log shows that the hash values computed for the source drive and the acquired image match exactly. A matching hash (e.g., MD5 or SHA-1) verifies that the image is a bit-for-bit identical copy of the original evidence, confirming forensic soundness. Therefore, the image is an exact copy of the source, making option D correct.

Answer

The image is not forensically sound because the verification passed

Answer

The source and image have different data

Answer

The image is corrupted because only one hash algorithm was used

Question 11

You are a forensic examiner responding to a data breach incident at a medium-sized company. The incident response team has identified a Windows Server 2019 that may contain evidence of unauthorized access. The server is running and logged in with administrative privileges. The server has 32 GB of RAM, a 1 TB SSD (bitlocker encrypted, but unlocked), and is connected to the corporate network. The server is running several critical business applications, and the IT manager asks you to minimize downtime. You have a forensic workstation with write blockers, a hardware acquisition tool, and various software tools. What is the best course of action to acquire evidence while preserving integrity and minimizing downtime?

Accepted Answer

Dump RAM and capture network connections, then create a logical image of the SSD using FTK Imager while the server remains on. It prioritizes capturing volatile data (RAM and network connections) first, which would be lost on shutdown, then creates a logical image of the unlocked BitLocker SSD while the server remains online to minimize downtime. This approach preserves the integrity of volatile evidence and allows critical business applications to continue running, aligning with the IT manager's request to minimize downtime.

Answer

Use a network acquisition tool like Guymager to image the drive over the network

Answer

Immediately power off the server, remove the SSD, and image it using a hardware write blocker

Answer

Pull the power cord, remove the SSD, and use a forensic bridge to image the drive

Question 12

During a forensic investigation, an analyst needs to acquire the contents of a live server's RAM without altering the evidence. Which tool and technique should the analyst use to minimize the footprint on the system?

Accepted Answer

Run a trusted version of win32dd.exe from a write-protected USB drive and capture memory to the USB. Running a trusted version of win32dd.exe from read-only forensic media (e.g., a write-protected USB drive) prevents modification of the tool binary and avoids writing artifacts to the server's local disk. However, the memory image itself must be captured to a separate writable external forensic drive or network share, not to the same write-protected USB. This minimizes the forensic footprint and preserves evidence integrity.

Answer

Install FTK Imager on the server and capture memory to a network share

Answer

Use a remote acquisition tool over SSH to capture memory to a remote server

Answer

Use the built-in task manager to create a memory dump and save it locally

Question 13

Which TWO of the following are valid reasons for using a hardware write blocker during disk acquisition? (Choose two.)

Accepted Answer

It allows the source drive to be connected to a forensic workstation without risking modification. A hardware write blocker is a device that sits between the source drive and the forensic workstation, intercepting and blocking any write commands from the host operating system. This ensures that the source drive is connected in a read-only state, preventing any accidental modifications to the evidence during acquisition. Option C correctly identifies this core function of preserving the integrity of the source drive.

Answer

It compresses the acquired data to save storage space

Answer

It increases the speed of data acquisition

Answer

It creates a forensic image of the drive

Question 14

During acquisition of a live Linux server, the forensic examiner runs the following command: # dd if=/dev/sda of=/mnt/evidence/disk.dd conv=noerror,sync bs=4k. Which TWO statements are true about this acquisition?

Accepted Answer

If a read error occurs, dd will pad the output with zeros and continue.. The `conv=noerror,sync` parameter tells `dd` to continue reading even if a read error occurs, and to pad the output block with zeros to maintain the correct offset and size. This ensures the image remains usable for analysis despite bad sectors on the source disk.

Answer

The command preserves the partition table of the source disk.

Answer

The command automatically computes MD5 hash of the output file.

Answer

The output file will be compressed to save storage space.

Question 15

Refer to the exhibit. An investigator runs fsstat and dstat on a captured image. What is the total capacity of the volume?

Accepted Answer

1 GB. The `fsstat` and `dstat` commands from The Sleuth Kit (TSK) provide file system and disk statistics. In the exhibit, `dstat` shows the total disk size as 2097152 sectors, and each sector is 512 bytes. Multiplying 2097152 × 512 = 1073741824 bytes, which equals exactly 1 GB (1024 MB). This is the total capacity of the volume.

Answer

512 MB

Answer

1 MB

Answer

4 GB

Question 16

Drag and drop the steps to conduct a memory acquisition using DumpIt on a Windows system into the correct order.

Accepted Answer

Boot from trusted media, then run DumpIt as administrator, then specify output file path, then verify hash.. Memory acquisition requires booting from trusted media, running tool as admin, and verifying hash.

Answer

Run DumpIt as administrator on the live system, then boot from trusted media, then specify output, then verify hash.

Answer

Boot from trusted media, then specify output file path, then run DumpIt as administrator, then verify hash.

Answer

Boot from trusted media, then run DumpIt as administrator, then verify hash, then specify output.

Question 17

Match each network protocol to its well-known port number (TCP/UDP).

Accepted Answer

HTTP: Port 80. The correct matches are: HTTP uses port 80, HTTPS uses port 443, and FTP uses port 21. Common confusions include swapping these ports or confusing FTP with SSH (port 22).

Answer

HTTP: Port 443

Answer

HTTPS: Port 80

Answer

FTP: Port 22

Question 18

You are imaging a suspect's hard drive using a write blocker and dd command. After imaging, you verify the hash of the original drive and the image file. The original drive hash is SHA1: A1B2C3D4E5..., and the image hash is SHA1: F6G7H8I9J0... What is the most likely cause of the mismatch?

Accepted Answer

The write blocker malfunctioned and allowed writes to the original drive. The hash mismatch indicates that the data on the original drive and the image file are not identical. A write blocker malfunction that allowed writes to the original drive during the imaging process would alter the source data after the initial hash was computed, causing the final hash of the original drive to differ from the hash of the image file taken at a different point in time. This is the most direct cause of a hash mismatch because the write blocker's primary purpose is to prevent any modification to the evidence.

Answer

The dd command used a different block size

Answer

The dd command compressed the output

Answer

The image file was corrupted during transfer

Question 19

You are a forensic investigator responding to a suspected data breach at a financial institution. The incident response team has isolated a Windows 10 workstation used by a former employee. The system is still powered on, and the login screen is displayed. Your task is to acquire forensic evidence in a defensible manner. The following actions are available:

A. Immediately pull the power cord to perform a cold acquisition of the hard drive.
B. Capture volatile data (RAM, network connections, running processes) using a trusted tool on a USB drive, then shut down normally and remove the hard drive for imaging.
C. Boot the system from a forensic live CD and create a forensic image of the hard drive while the system is running.
D. Use the built-in Windows backup to create a system image to an external drive.

Which action is the most appropriate first step in this scenario?

Accepted Answer

Capture volatile data using a trusted tool on a USB drive, then shut down normally and remove the hard drive for imaging. The system is still powered on with the login screen displayed, meaning volatile data (RAM, network connections, running processes) is present and will be lost if the system is powered off. Capturing this data first using a trusted forensic tool (e.g., FTK Imager or DumpIt) from a write-blocked USB drive preserves critical evidence such as encryption keys, active network connections, and malware in memory. Only after volatile data is secured should the system be shut down normally and the hard drive removed for forensic imaging, ensuring a defensible chain of custody.

Answer

Use the built-in Windows backup to create a system image to an external drive

Answer

Boot the system from a forensic live CD and create a forensic image of the hard drive while the system is running

Answer

Immediately pull the power cord to perform a cold acquisition of the hard drive

Question 20

You are a forensic investigator responding to a data breach at a financial institution. The compromised server is a Windows Server 2019 running a custom trading application. The server is still powered on and connected to the production network. The incident response team has instructed you to acquire forensic evidence while minimizing downtime. The server has 2 TB of storage with 500 GB used. You have a forensic workstation with a write-blocker and an empty 2 TB external drive. The server's RAM is 64 GB. You need to acquire both volatile data (RAM) and a forensic image of the disk. However, the legal team requires a verified bit-for-bit copy with cryptographic hash verification. Additionally, the server's performance is critical; acquiring RAM via network is not feasible due to bandwidth constraints. Which of the following is the best course of action?

Accepted Answer

Run win32dd locally to capture RAM to the external drive, then use FTK Imager over the network to create a physical disk image with verification.. It prioritizes capturing volatile RAM first using win32dd (a memory acquisition tool) locally to the external drive, which preserves the most volatile evidence before any shutdown or network transfer. After RAM capture, FTK Imager over the network creates a verified physical disk image, satisfying the legal requirement for cryptographic hash verification while minimizing downtime. This approach avoids the risk of losing RAM data (as in shutdown) and avoids bandwidth constraints (as in network RAM acquisition).

Answer

Shut down the server, remove the disk, connect it to a write-blocker, and acquire the disk image using FTK Imager; RAM is lost but disk acquisition is verified.

Answer

Use FTK Imager over the network to acquire RAM first, then use dd to image the disk to the external drive via write-blocker.

Answer

Use dd over netcat to acquire RAM and disk simultaneously, then compute hashes separately.