CHFI Computer Forensics Fundamentals and Process Practice Question
A first responder arrives at a suspected intrusion scene. A desktop computer is powered on and logged in. The user claims they saw suspicious files being copied to a USB drive. Which of the following should the first responder do FIRST?
⚠ Common exam trap
The CHFI exam often tests the principle of the order of volatility, and the trap here is that candidates mistakenly prioritize preserving the hard drive (non-volatile) over capturing volatile data, thinking that powering off or imaging the drive first prevents evidence tampering.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Capture volatile data such as memory and running processes.
In a live intrusion where a USB transfer is in progress, volatile data (memory, running processes, network connections) is the most ephemeral and will be lost if the system is powered down. Capturing this data first preserves evidence of the malicious activity, such as the process that initiated the copy and any network connections, which is critical for reconstructing the attack. This follows the order of volatility (RFC 3227), which mandates capturing volatile data before non-volatile data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Capture volatile data such as memory and running processes.
Why this is correct
Volatile data must be collected first because RAM, active network connections, and running processes exist only while the system is powered. A memory dump can recover encryption keys, injected malicious code, and open handles, while a process listing and netstat output capture attacker activity that would vanish at shutdown. This follows the order of volatility, moving from the most ephemeral evidence to the least ephemeral evidence.
- ✗
Power off the computer immediately to prevent further data loss.
Why it's wrong here
Powering off immediately destroys the very evidence an incident response should prioritize: physical memory, established TCP sessions, mounted volumes, and kernel-resident artifacts. Many operating systems also execute shutdown routines that can alter logs or unmount filesystems, potentially triggering anti-forensic measures. Instead, a first responder should perform live data capture before taking any decision to power down, and even then only after volatile evidence is secured.
- ✗
Photograph the scene and document everything in a notebook.
Why it's wrong here
Photographing the scene and taking notes preserves contextual information such as screen contents, attached peripherals, and device state, but it cannot preserve the transient data in memory or the list of running processes. Documentation is a supporting activity that should continue throughout the response, yet it does not satisfy the immediate need to capture volatile data before it is lost. If time is spent only documenting, critical live evidence like network connections and encryption keys may disappear.
- ✗
Create a forensic image of the hard drive using a write blocker.
Why it's wrong here
Forensic imaging with a write blocker is an essential later step because it preserves the exact state of persistent storage, but it does nothing to capture volatile data. Creating a disk image typically requires either shutting down the system or booting from a forensic CD, either of which would wipe RAM and terminate the very processes that indicate intrusion. The order of volatility requires acquiring memory and network state first, then performing a forensically sound acquisition of the hard drive.
Go deeper
Related to this question
Learn chapter
Overview of Computer Forensics and Investigation Process
Key term
Memory Acquisition
Memory acquisition is the process of capturing the contents of a computer's volatile memory to preserve data for forensic analysis and incident response.
Key term
Process Memory Dump
A process memory dump is a snapshot of all the data a specific running program has stored in RAM at a single moment, used for analyzing its behavior and contents.
About these practice questions
One of 205 original CHFI practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.