CHFI Computer Forensics Investigation Process — 20 Questions

Question 1

During a forensic investigation, an analyst discovers that the suspect's hard drive was encrypted using BitLocker. The analyst has obtained the recovery key. Which of the following is the best next step to ensure data integrity?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a forensic image of the encrypted drive, then decrypt the image.. Creating a forensic image of the encrypted drive before decryption preserves the original evidence in its pristine, unaltered state. Decrypting the image later using the recovery key ensures that the original encrypted data remains intact and verifiable, maintaining data integrity throughout the investigation.

Answer

Decrypt the drive using the recovery key and then create a forensic image.

Answer

Run a live analysis tool to extract encryption keys from memory.

Answer

Boot the suspect computer and copy files to an external drive.

Question 2

A CHFI analyst is called to investigate a suspected data breach. The IT team has already shut down the server. Which of the following is the most appropriate order of actions to preserve evidence?

Accepted Answer

Secure the scene, photograph the setup, document connections, remove hard drives, and create forensic images using a write-blocker.. It follows the established forensic investigation process: secure the scene to prevent contamination, document the state of the server (photographs and connection diagrams), then physically remove the hard drives and create forensic images using a write-blocker to preserve the original data without alteration. This ensures evidence integrity and admissibility in legal proceedings.

Answer

Immediately power on the server to check for running processes.

Answer

Copy all files from the server to an external USB drive.

Answer

Run antivirus scan to ensure no malware is present before imaging.

Question 3

An incident responder has acquired a forensic image of a Linux server suspected of being compromised. The image was taken using 'dd' with no compression. The analyst needs to verify the integrity of the image. Which command should be used and what should be compared?

Accepted Answer

Use 'sha256sum image.dd' and compare with the hash computed during acquisition from the source device.. The SHA-256 hash computed during acquisition from the source device provides a cryptographic integrity check. By recomputing the hash on the acquired image and comparing it to the original hash, the analyst can verify that the image is an exact bit-for-bit copy without any alteration or corruption. SHA-256 is preferred over MD5 in forensic contexts due to its stronger collision resistance.

Answer

Use 'cmp' to compare the image byte-by-byte with the original drive.

Answer

Use 'md5sum image.dd' and compare with the original file's MD5 hash provided by the system administrator.

Answer

Run 'fsck' on the image to check for filesystem errors.

Question 4

Which TWO of the following are considered essential steps in the computer forensics investigation process according to EC-Council guidelines?

Accepted Answer

Identification of potential evidence. Identification of potential evidence is a core initial step in the EC-Council's computer forensics investigation process because it defines the scope and sources of data that may contain relevant evidence. Without proper identification, investigators risk missing critical data or collecting irrelevant information, which can compromise the entire investigation. This step involves recognizing potential evidence sources such as hard drives, network logs, and volatile memory, ensuring that all relevant data is accounted for before collection begins.

Answer

Data recovery from damaged media

Answer

Deletion of irrelevant data

Answer

Public disclosure of findings

Question 5

You are a CHFI analyst responding to a security incident at a medium-sized financial firm. The IT team reports that an employee's workstation (Windows 10, single SSD) was used to access sensitive customer data without authorization. The workstation is still running, and the employee is currently logged in. The IT team has isolated the machine from the network but has not powered it off. You have been called to perform forensic acquisition. The company policy requires preservation of volatile data and a full disk image. The machine has 16 GB RAM and a 512 GB SSD. You have a forensic toolkit including FTK Imager, win32dd (for memory acquisition), and a write-blocker. Which of the following is the best course of action?

Accepted Answer

Use win32dd to capture the contents of RAM to an external drive, then use FTK Imager to create a physical image of the SSD over the network to a secure share.. A is not valid: FTK Imager cannot send an image over the network if the machine is disconnected, and a live disk image risks inconsistent data. The correct forensic process is to (1) acquire volatile memory with win32dd, (2) hard-power off the system to preserve the disk state, (3) remove the SSD, and (4) image it using a hardware write-blocker to an external forensic drive. None of the provided options reflects this sequence.

Answer

Perform a graceful shutdown via the operating system, then remove the SSD and image it using a hardware write-blocker.

Answer

Boot the workstation from a forensic live CD, then use 'dd' to image the SSD to an external USB drive.

Answer

Immediately shut down the workstation by unplugging the power cord, remove the SSD, and create a forensic image using a write-blocker on a forensic workstation.

Question 6

Drag and drop the steps to perform forensic imaging of a hard drive using FTK Imager into the correct order.

Accepted Answer

1. Launch FTK Imager and select 'Create Disk Image'. 2. Select the source drive. 3. Configure destination image settings (name, location, segment size, image type). 4. Enable verification and start imaging. 5. Verify image integrity after completion.. Forensic imaging involves selecting source, configuring destination, and verifying integrity with hash.

Answer

1. Launch FTK Imager and select 'Create Disk Image'. 2. Configure destination image settings. 3. Select the source drive. 4. Enable verification and start imaging. 5. Verify image integrity after completion.

Answer

1. Launch FTK Imager and select 'Create Disk Image'. 2. Select the source drive. 3. Enable verification. 4. Configure destination image settings. 5. Start imaging. 6. Verify image integrity after completion.

Answer

1. Launch FTK Imager and select 'Create Disk Image'. 2. Configure destination image settings. 3. Enable verification. 4. Select the source drive. 5. Start imaging. 6. Verify image integrity after completion.

Question 7

Drag and drop the steps to perform a forensic analysis of a PDF file for hidden data or malicious content into the correct order.

Accepted Answer

Step 1: Parse PDF structure and identify objects/streams. Step 2: Extract and examine embedded files and JavaScript. Step 3: Analyze metadata, annotations, and hidden data. Step 4: Perform sandbox execution for dynamic analysis.. PDF forensics involves parsing objects, checking for scripts, and sandbox analysis.

Answer

Step 1: Extract and examine embedded files and JavaScript. Step 2: Parse PDF structure and identify objects/streams. Step 3: Analyze metadata, annotations, and hidden data. Step 4: Perform sandbox execution for dynamic analysis.

Answer

Step 1: Analyze metadata, annotations, and hidden data. Step 2: Parse PDF structure and identify objects/streams. Step 3: Perform sandbox execution for dynamic analysis. Step 4: Extract and examine embedded files and JavaScript.

Answer

Step 1: Perform sandbox execution for dynamic analysis. Step 2: Parse PDF structure and identify objects/streams. Step 3: Extract and examine embedded files and JavaScript. Step 4: Analyze metadata, annotations, and hidden data.

Question 8

Match each forensic tool to its primary purpose.

Accepted Answer

EnCase: Forensic imaging and data acquisition. EnCase is for forensic imaging, FTK for analysis, Volatility for memory forensics, and Autopsy for file system analysis. Common confusions include swapping EnCase with memory analysis or FTK with network analysis.

Answer

EnCase: Memory forensics and analysis

Answer

FTK: Network packet analysis

Question 9

Match each email forensic artifact to its source.

Accepted Answer

PST: Microsoft Outlook email folder file. Correct matches: PST for Outlook, EML for generic email, MBOX for Apple Mail/Thunderbird, DBX for Outlook Express. Common confusions involve mixing PST with EML or MBOX.

Answer

PST: Generic email message file

Answer

MBOX: Microsoft Outlook email folder file

Question 10

An analyst executed the commands shown in the exhibit on a Windows system to prepare a forensic image for analysis. What is the most likely reason for the error message from e2fsck?

Accepted Answer

The analyst failed to properly dismount the source volume before imaging, leading to filesystem inconsistencies.. The error message from e2fsck indicates that the filesystem has inconsistencies, which typically occur when a volume is imaged while it is still mounted and actively being written to. The analyst likely did not dismount the source volume before acquiring the forensic image, resulting in a snapshot that reflects an inconsistent state (e.g., dirty journal, unflushed writes). This is a common chain-of-custody and acquisition procedure error in forensic imaging.

Answer

The forensic image was not acquired with a write-blocker, causing data corruption.

Answer

The image file contains an NTFS filesystem, but e2fsck is designed for ext filesystems.

Answer

The e2fsck command syntax is incorrect; it should be 'e2fsck -f -n' instead.