CHFI Computer Forensics Fundamentals and Process Practice Question
A company receives a legal hold notice regarding a lawsuit. What immediate action should the company take to comply?
⚠ Common exam trap
EC-Council often tests the misconception that a legal hold notice is optional or that routine deletion policies can continue, but the trap is that preservation duties begin immediately upon anticipation of litigation, regardless of whether a formal court order has been served.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Preserve all potentially relevant electronic documents and data
A legal hold notice triggers a duty to preserve all potentially relevant electronically stored information (ESI). Under the Federal Rules of Civil Procedure (FRCP) Rule 37(e), failure to preserve can lead to spoliation sanctions. The immediate action is to issue a litigation hold notice and suspend routine data deletion policies, ensuring that all relevant emails, documents, and logs are preserved in their current state.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Delete all emails older than 30 days to free up storage
Why it's wrong here
Deleting emails older than 30 days after a legal hold notice constitutes spoliation of evidence. The preservation duty overrides routine storage-retention policies, so all auto-delete and cleanup jobs must be suspended for potentially relevant custodians. Courts can issue severe sanctions, including adverse inference instructions, when discoverable ESI is intentionally destroyed.
- ✗
Immediately format the hard drives of all employees involved
Why it's wrong here
Formatting employee hard drives destroys potentially relevant ESI and unmistakably violates the legal hold obligation. Even if remnants are recoverable, the destruction itself demonstrates intent to render evidence unavailable and may expose the company to spoliation sanctions, contempt, or obstruction charges. The proper step is forensic imaging of the drives, not erasure.
- ✓
Preserve all potentially relevant electronic documents and data
Why this is correct
The correct action is to implement a litigation hold preserving all potentially relevant electronic documents and data, including emails, attachments, metadata, and backup copies. The organization must notify custodians of their duty and suspend any automated deletion, archiving, or alteration processes. This protects the integrity and provenance of the ESI so it can be produced in discovery without allegations of spoliation.
- ✗
Ignore the notice because it is not a court order
Why it's wrong here
Ignoring the notice because it is not a court order is a serious error because the preservation duty attaches when litigation is reasonably anticipated, which is often triggered by a written legal hold from a party or counsel. Formal court orders may come later, but failure to preserve after notice can still result in sanctions, adverse evidentiary inferences, or default judgment. If scope is unclear, the entity should preserve and then seek judicial guidance.
Go deeper
Related to this question
About these practice questions
One of 205 original CHFI practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.