CHFI Computer Forensics Investigation Process — 10 Questions

Question 1

During a forensic investigation, an analyst discovers that the suspect's hard drive was encrypted using BitLocker. The analyst has obtained the recovery key. Which of the following is the best next step to ensure data integrity?

Accepted Answer

Create a forensic image of the encrypted drive, then decrypt the image.. Option C is correct because creating a forensic image of the encrypted drive before decryption preserves the original evidence in its pristine, unaltered state. Decrypting the image later using the recovery key ensures that the original encrypted data remains intact and verifiable, maintaining data integrity throughout the investigation.

Answer

Decrypt the drive using the recovery key and then create a forensic image.

Answer

Run a live analysis tool to extract encryption keys from memory.

Answer

Boot the suspect computer and copy files to an external drive.

Question 2

A CHFI analyst is called to investigate a suspected data breach. The IT team has already shut down the server. Which of the following is the most appropriate order of actions to preserve evidence?

Accepted Answer

Secure the scene, photograph the setup, document connections, remove hard drives, and create forensic images using a write-blocker.. Option D is correct because it follows the established forensic investigation process: secure the scene to prevent contamination, document the state of the server (photographs and connection diagrams), then physically remove the hard drives and create forensic images using a write-blocker to preserve the original data without alteration. This ensures evidence integrity and admissibility in legal proceedings.

Answer

Immediately power on the server to check for running processes.

Answer

Copy all files from the server to an external USB drive.

Answer

Run antivirus scan to ensure no malware is present before imaging.

Question 3

An incident responder has acquired a forensic image of a Linux server suspected of being compromised. The image was taken using 'dd' with no compression. The analyst needs to verify the integrity of the image. Which command should be used and what should be compared?

Accepted Answer

Use 'sha256sum image.dd' and compare with the hash computed during acquisition from the source device.. Option D is correct because the SHA-256 hash computed during acquisition from the source device provides a cryptographic integrity check. By recomputing the hash on the acquired image and comparing it to the original hash, the analyst can verify that the image is an exact bit-for-bit copy without any alteration or corruption. SHA-256 is preferred over MD5 in forensic contexts due to its stronger collision resistance.

Answer

Use 'cmp' to compare the image byte-by-byte with the original drive.

Answer

Use 'md5sum image.dd' and compare with the original file's MD5 hash provided by the system administrator.

Answer

Run 'fsck' on the image to check for filesystem errors.

Question 4

Which TWO of the following are considered essential steps in the computer forensics investigation process according to EC-Council guidelines?

Accepted Answer

Identification of potential evidence. Identification of potential evidence is a core initial step in the EC-Council's computer forensics investigation process because it defines the scope and sources of data that may contain relevant evidence. Without proper identification, investigators risk missing critical data or collecting irrelevant information, which can compromise the entire investigation. This step involves recognizing potential evidence sources such as hard drives, network logs, and volatile memory, ensuring that all relevant data is accounted for before collection begins.

Answer

Data recovery from damaged media

Answer

Deletion of irrelevant data

Answer

Public disclosure of findings

Question 5

An analyst executed the commands shown in the exhibit on a Windows system to prepare a forensic image for analysis. What is the most likely reason for the error message from e2fsck?

Accepted Answer

The analyst failed to properly dismount the source volume before imaging, leading to filesystem inconsistencies.. The error message from e2fsck indicates that the filesystem has inconsistencies, which typically occur when a volume is imaged while it is still mounted and actively being written to. The analyst likely did not dismount the source volume before acquiring the forensic image, resulting in a snapshot that reflects an inconsistent state (e.g., dirty journal, unflushed writes). This is a common chain-of-custody and acquisition procedure error in forensic imaging.

Answer

The forensic image was not acquired with a write-blocker, causing data corruption.

Answer

The image file contains an NTFS filesystem, but e2fsck is designed for ext filesystems.

Answer

The e2fsck command syntax is incorrect; it should be 'e2fsck -f -n' instead.

Question 6

You are a CHFI analyst responding to a security incident at a medium-sized financial firm. The IT team reports that an employee's workstation (Windows 10, single SSD) was used to access sensitive customer data without authorization. The workstation is still running, and the employee is currently logged in. The IT team has isolated the machine from the network but has not powered it off. You have been called to perform forensic acquisition. The company policy requires preservation of volatile data and a full disk image. The machine has 16 GB RAM and a 512 GB SSD. You have a forensic toolkit including FTK Imager, win32dd (for memory acquisition), and a write-blocker. Which of the following is the best course of action?

Accepted Answer

Use win32dd to capture the contents of RAM to an external drive, then use FTK Imager to create a physical image of the SSD over the network to a secure share.. Option A is correct because it follows the proper order of volatility: capturing RAM first (volatile data) using win32dd, then imaging the SSD with FTK Imager. Since the machine is still running and isolated, network imaging is acceptable and preserves the disk state without risking data loss from a shutdown. This approach complies with the requirement to preserve volatile data and create a full disk image.

Answer

Perform a graceful shutdown via the operating system, then remove the SSD and image it using a hardware write-blocker.

Answer

Boot the workstation from a forensic live CD, then use 'dd' to image the SSD to an external USB drive.

Answer

Immediately shut down the workstation by unplugging the power cord, remove the SSD, and create a forensic image using a write-blocker on a forensic workstation.

Question 7

Drag and drop the steps to perform forensic imaging of a hard drive using FTK Imager into the correct order.

Question 8

Drag and drop the steps to perform a forensic analysis of a PDF file for hidden data or malicious content into the correct order.

Question 9

Match each forensic tool to its primary purpose.

Question 10

Match each email forensic artifact to its source.