CHFI Computer Forensics Fundamentals and Process Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Run antivirus software to check for malware

  Why it's wrong here

  Running antivirus software on a live suspect system is an act that itself alters the evidentiary state: it creates new files, modifies system logs and timestamps, and may auto-quarantine or delete files that are relevant to the case. Even a read-only scan updates data structures like the NTFS $LogFile and last-accessed timestamps, contaminating every piece of digital evidence on the drive. Any malware analysis must be performed on a write-blocked forensic image in a controlled lab environment, never on the original evidence.

• ✗

  Immediately disconnect the power cord

  Why it's wrong here

  Immediately disconnecting the power cord destroys volatile memory, which often holds the most valuable evidence such as running processes, network connections, decrypted sessions, and in-memory credentials. Such a hard power-off also risks filesystem inconsistency, forces a crash-consistency recovery on reboot, and can flush cached writes that overwrite unallocated space. The correct sequence for a live system is to first acquire RAM using a trusted forensic tool, then perform a graceful shutdown or forensically-safe power removal after gathering a memory image.

• ✗

  Copy all files from the hard drive

  Why it's wrong here

  Copying all files from the hard drive merely reproduces the logical directory structure and active files, omitting deleted files, residual data in slack space, unallocated clusters, and the File System Metadata that are essential for recovery and audit. This file-by-file copy also updates each file's last-accessed time and modifies directory entries, further tainting evidence. A forensically sound approach is to create a bit-for-bit HDD image, utilizing a write blocker, so that every sector including free space is captured without altering the source.

• ✓

  Photograph the scene and document everything

  Why this is correct

  Photographing the scene and thoroughly documenting the computer's configuration—including the screen display, attached peripherals, cable connections, power state, and visible indicators—establishes a legally defensible baseline before any forensically relevant action is taken. This initial documentation preserves the original spatial and temporal context of the system, supports the chain of custody, and is indispensable if the scene must be reconstructed or the impact of subsequent steps is questioned. Without such records, even a perfectly performed forensic acquisition may fail admissibility because the examiner cannot prove the scene was preserved.

Go deeper

Related to this question