CHFI Computer Forensics Lab Practice Test 1 — 15 Questions

Question 1

During a forensic investigation, an analyst needs to acquire data from a live Windows system without altering the system's state. Which tool should the analyst use to capture the contents of RAM?

Accepted Answer

FTK Imager Lite. FTK Imager Lite is designed for live forensic acquisition on Windows systems, including capturing RAM contents without altering the system state. It uses a lightweight, read-only approach that avoids writing to the disk or modifying memory pages, preserving the integrity of the evidence.

Answer

dd

Answer

EnCase

Answer

WinHex

Question 2

A forensic lab is designing a network architecture to ensure the integrity of evidence during acquisition. What is the most critical design consideration?

Accepted Answer

Implement hardware write-blockers on all acquisition stations. Hardware write-blockers are the most critical design consideration because they physically prevent any write operations to the source drive at the ATA/SCSI command level, ensuring that the evidence remains bit-for-bit unchanged during acquisition. Without a hardware write-blocker, even a single read operation from a forensic workstation could inadvertently modify metadata (e.g., last access timestamps) or trigger anti-forensic mechanisms, compromising the integrity of the evidence and its admissibility in court.

Answer

Deploy multiple forensic workstations to parallelize tasks

Answer

Use a segmented network to isolate forensic tools

Answer

Encrypt all data in transit over the network

Question 3

A forensic analyst is troubleshooting a write-blocker that is not working correctly. The analyst connected the write-blocker between the suspect drive and the forensic workstation, but the workstation still shows the drive as writable. What is the most likely cause?

Accepted Answer

The suspect drive was connected before the write-blocker was powered on. When a write-blocker is powered on after the suspect drive is already connected, the drive may have already been enumerated by the operating system as a writable device. Write-blockers rely on intercepting and filtering ATA/SCSI commands at the hardware level before the OS sees the drive; if the drive is connected first, the OS may have already sent write commands or cached write attributes, bypassing the blocker's protection. This is why the proper sequence is to power on the write-blocker first, then connect the suspect drive.

Answer

The write-blocker does not have external power

Answer

The suspect drive uses SATA but the write-blocker is USB-only

Answer

The write-blocker is connected to the suspect drive's output port

Question 4

A forensic lab is establishing a chain of custody procedure. Which practice is considered best according to CHFI guidelines?

Accepted Answer

Document every transfer of evidence with signatures and timestamps. The chain of custody is fundamentally a legal and procedural requirement to demonstrate the integrity and admissibility of digital evidence. CHFI guidelines emphasize that every transfer of evidence must be meticulously documented with signatures, timestamps, and purpose to create an unbroken audit trail, which is the only practice that directly satisfies the legal standard for evidence handling.

Answer

Require biometric authentication for all lab personnel

Answer

Store evidence in a secure room with limited access

Answer

Use encryption to protect evidence files

Question 5

Which TWO of the following are essential components of a computer forensics lab according to CHFI best practices?

Accepted Answer

Evidence storage area with controlled access. Options B and E are correct because a computer forensics lab must include a secure evidence storage area with controlled access to maintain chain of custody and prevent tampering, and a forensic workstation with specialized software to analyze digital evidence. CHFI best practices emphasize physical security and proper forensic tools as essential components for conducting investigations.

Answer

Server farm for data processing

Answer

Public-facing website for case management

Answer

Coffee machine for staff convenience

Question 6

Which THREE of the following are recommended practices for maintaining the integrity of digital evidence in a forensics lab?

Accepted Answer

Maintain a detailed chain of custody log. Maintaining a detailed chain of custody log (Option A) is a recommended practice because it provides a verifiable, chronological record of every person who handled the evidence, the time and date of each transfer, and the purpose of each transfer. This ensures the evidence's integrity by demonstrating that it has not been tampered with or altered from the moment of seizure through analysis and presentation in court. Without a proper chain of custody, the evidence can be challenged as inadmissible under rules like Federal Rule of Evidence 901.

Answer

Perform regular backups of all evidence

Answer

Run antivirus scans on evidence before analysis

Question 7

You are a forensic analyst in a corporate lab. A compromised server was taken offline and brought to the lab. The server runs Windows Server 2019 with a RAID 5 array of three 1TB SATA drives. The drives are hot-swappable. The server was shut down properly before removal. The lab has a forensic workstation with write-blockers, a hardware RAID controller, and imaging software. The analyst needs to acquire a forensic image of the RAID array. What is the correct course of action?

Accepted Answer

Reconstruct the RAID array using the same controller model in the lab, then image the logical volume via a write-blocker. The RAID 5 array must be reconstructed using the same controller model (or an identical one) to correctly interpret the parity and striping metadata. Imaging the logical volume via a write-blocker preserves the integrity of the file system and ensures a forensically sound acquisition of the live data, which is the standard practice when the controller is available and the array is intact.

Answer

Send the drives to a vendor for specialized RAID recovery

Answer

Image each drive individually using a write-blocker and then combine the images in software

Answer

Connect all drives to the forensic workstation and use a software RAID tool to assemble the array

Question 8

A forensic lab manager is setting up a new lab and must decide on the physical security measures. Which of the following is the MOST important to implement first?

Accepted Answer

Implement a biometric access control system. Biometric access control is the most critical first step because it establishes a foundational layer of physical security that authenticates and authorizes personnel before they can access the lab. Without controlling who enters, other measures like CCTV or fire suppression are less effective, as unauthorized individuals could compromise evidence integrity. This aligns with the principle of defense-in-depth, where access control is the primary barrier against tampering or theft.

Answer

Construct Faraday cages around the evidence storage area

Answer

Deploy CCTV cameras covering all entry points

Answer

Install a gas-based fire suppression system

Question 9

Refer to the exhibit. A forensic examiner is analyzing a Windows system and sees the above NTFS file metadata. The user claims the file was last accessed at 09:15. Which of the following best explains the discrepancy?

Accepted Answer

The $UsnJrnl entry shows the file was modified, and the last access time was updated by the system when the file was opened for reading. The $UsnJrnl (Update Sequence Number Journal) records that the file was modified, and on Windows systems, when a file is opened for reading, the last access time is updated by default. The discrepancy arises because the user claims the file was last accessed at 09:15, but the NTFS metadata shows a different last access time, which could be due to the system updating the last access time upon modification or read operations, as recorded in the $UsnJrnl.

Answer

The system has disabled last access time updates, so the reported times are unreliable

Answer

The creation time is earlier than the last access, indicating the file was copied from another volume

Answer

The $LogFile sequence number indicates a transaction rollback that reset the timestamps

Question 10

Which TWO of the following are essential requirements for a computer forensics lab according to best practices?

Accepted Answer

Uninterruptible power supply (UPS) and surge protectors. A is correct because a UPS provides temporary power during outages to prevent data loss or corruption during forensic imaging, while surge protectors guard against voltage spikes that could damage sensitive lab equipment. Best practices require both to ensure chain of custody integrity and hardware reliability.

Answer

Offsite cloud storage for all case files

Answer

Shared workstations to reduce hardware costs

Answer

Open wireless network for flexibility

Question 11

A forensic examiner is setting up a new lab. Which THREE of the following practices are essential for maintaining the integrity of digital evidence?

Accepted Answer

Use write-blocking devices when acquiring data from suspect drives.. Write-blocking devices (hardware or software) prevent any write operations to the source drive during acquisition, ensuring the original data remains unaltered. This is fundamental to maintaining the integrity of digital evidence, as any modification could render the evidence inadmissible in court. Forensic imaging tools like FTK Imager or dd rely on write-blockers to guarantee a bit-for-bit copy without contaminating the source.

Answer

Perform regular backups of the forensic workstation’s operating system.

Answer

Disable write-blocking when imaging drives to improve speed.

Question 12

Refer to the exhibit. The FTK Imager output shows a disk with an NTFS partition. The examiner notes that the $MFT mirror is at cluster 2. What is the logical size of the $MFT mirror in bytes?

Accepted Answer

4096 bytes. The $MFT mirror is a backup copy of the first four records of the Master File Table. Each MFT record is typically 1024 bytes, so four records total 4096 bytes. This logical size is independent of cluster size or the cluster location (cluster 2). The fact that it occupies one cluster does not determine its logical size; a file smaller than the cluster still occupies an entire cluster.

Answer

320 GB

Answer

512 bytes

Answer

8192 bytes

Question 13

You are a forensic examiner at a corporate security firm. You receive a laptop from the HR department that belonged to a terminated employee. The laptop was used for company business and is suspected of containing unauthorized file-sharing software. The laptop is running Windows 10 with BitLocker drive encryption enabled. Before shutdown, the employee was logged into the system. HR claims the laptop was shut down properly and then handed over within an hour. You are asked to acquire a forensic image of the hard drive for analysis. However, when you boot the laptop, you are prompted for the BitLocker recovery key. HR does not have the key, and the employee refuses to cooperate. The laptop also has a TPM chip. Which of the following is the most appropriate course of action to acquire the data?

Accepted Answer

Contact IT to obtain the BitLocker recovery key from Active Directory.. The laptop was shut down properly, and the TPM should still retain the BitLocker key in its secure storage. The recovery key prompt that appeared may have been caused by an incorrect boot order or an attempt to boot from external media. Booting normally from the internal drive should allow the TPM to automatically unlock the drive without requiring a recovery key, as long as the boot configuration has not changed. This is the standard behavior for a TPM-only protector configuration and is the simplest first step before resorting to other methods.

Answer

Perform a cold boot attack to extract the BitLocker key from memory.

Answer

Boot from a Linux live USB and use tools to bypass BitLocker.

Answer

Boot the laptop normally and let BitLocker unlock the drive using the TPM.

Question 14

Drag and drop the steps to recover deleted files using Recuva into the correct order.

Accepted Answer

Select file type, then select location, then scan, then recover and save to a different drive.. File recovery involves selecting type, location, scanning, and saving to a different drive.

Answer

Select location, then select file type, then scan, then recover and save to a different drive.

Answer

Select file type, then scan, then select location, then recover and save to a different drive.

Answer

Select file type, then select location, then recover and save to the same drive, then scan.

Question 15

Match each Windows Registry hive to its stored information.

Accepted Answer

HKLM: Stores system-wide configuration for hardware, software, and security policies.. These hives store specific types of configuration data. HKLM is machine-wide, HKCU is user-specific, HKCC is hardware profile, HKCR handles file associations and COM classes, and HKU stores all user profiles.

Answer

HKCR: Stores information about all user profiles on the system.

Answer

HKU: Stores file associations and COM class registration information.