CHFI Computer Forensics Fundamentals and Process Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Photograph the scene and secure the area

  Why this is correct

  Documenting the scene through photographs and establishing a secure perimeter is the mandatory first step in digital forensics, as it creates a verifiable record of the original state of the computer, cables, and peripherals before any interaction. Securing the area prevents unauthorized personnel from touching the machine, which could alter timestamps, memory contents, or other volatile evidence. This step also grounds the chain of custody by showing exactly what was present when first responders arrived, and it should precede any hardware or software actions on the system.

• ✗

  Connect a write blocker and create a forensic image immediately

  Why it's wrong here

  Connecting a write blocker and immediately imaging the hard drive is a critical later step in the forensic workflow, but performing it before documenting the scene violates standard operating procedure because it modifies the system state by requiring the computer to be powered and potentially mounting devices. It also risks missing volatile data residing in RAM, such as encryption keys or active network connections, that would be lost when powering on or off. Additionally, a first responder may lack the required forensic tools, legal authority, or trained expertise to perform a sound acquisition, so scene documentation and triage must come first.

• ✗

  Immediately shut down the computer to prevent data alteration

  Why it's wrong here

  Immediately shutting down the computer to preserve evidence is a common but flawed instinct because normal shutdown triggers the operating system to modify system files, such as clearing page files and recording clean shutdown events, and it destroys all volatile data in memory. Furthermore, modern systems with Fast Startup may not fully shut down and can flush cached data to disk, altering evidence. The correct sequence is to photograph the scene, then capture the RAM contents using a specialized memory acquisition tool, and finally choose the appropriate shutdown method based on the incident type.

• ✗

  Pull the power cord to ensure the system does not shut down normally

  Why it's wrong here

  Pulling the power cord is a controlled, but not universally safe, action that should only be taken after volatile memory has been captured and the need to bypass the operating system's shutdown routines is justified, because an abrupt power loss can leave NTFS or ext4 filesystems inconsistent and may trigger journal replay or checkdisk on reboot. On systems with self-encrypting drives, cutting power can strip the decryption key from memory and make the drive inaccessible, while RAID arrays might enter a degraded state. This step is never the first action when a system is running, and it is only one choice among several based on the platform and evidence goals.

Go deeper

Related to this question