CHFI Computer Forensics Fundamentals and Process Practice Question
A forensic investigator uses the 'dd' command to create a forensic image. The original drive has a SHA-256 hash of a1b2c3... and the image produces the same hash. Which rule of evidence does this satisfy?
⚠ Common exam trap
A common mix-up: candidates confuse authenticity (proving the copy is identical to the original) with reliability (the tool's consistency), leading them to choose Option A instead of B.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Authenticity
The SHA-256 hash of the original drive matches the hash of the forensic image, proving that the image is an exact, unaltered copy of the original. This satisfies the rule of authenticity, which requires that evidence be shown to be the same as what was originally seized and not tampered with. The hash acts as a digital fingerprint, and matching hashes confirm the integrity and origin of the evidence.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Reliability
Why it's wrong here
Reliability concerns the extent to which the forensic acquisition method and tools produce consistent, dependable results. A hash match between the source and the dd image shows data preservation, but it does not validate that dd was executed with the correct device parameters, that the hardware write-blocker was functioning, or that the tool has been tested against error rates. Thus, hash matching cannot by itself establish reliability.
- ✓
Authenticity
Why this is correct
Authenticity in digital forensics means proving that the evidence is what it purports to be and has not been modified during acquisition or handling. When the hash computed from the original source matches the hash computed from the dd image, it demonstrates the image is a bit-for-bit copy with no data altered, added, or removed. This cryptographic match directly supports the authenticity/integrity of the evidence.
- ✗
Completeness
Why it's wrong here
Completeness asks whether all relevant evidence was captured, not whether a single captured object was copied accurately. Hash matching only confirms that the image matches the source target; if the investigator imaged the wrong partition, omitted unallocated space, or failed to include a logical file needed for the case, the hashes will still match. Therefore, a hash match provides no assurance of evidentiary completeness.
- ✗
Admissibility
Why it's wrong here
Admissibility is a legal decision made by a judge based on rules of evidence, whether the methods satisfy standards like Daubert or Frye, and whether the chain of custody is documented. A matching hash is one component of authentication, but it does not address legal authorization, tool acceptance, or the provenance of the original evidence, so it cannot by itself make evidence admissible.
Go deeper
Related to this question
Learn chapter
Evidence Handling and Chain of Custody
Key term
Evidence Admissibility
Evidence admissibility is the legal and technical standard that determines whether digital evidence can be used in a court of law.
Key term
EnCase Forensic
EnCase Forensic is a digital forensics software suite used by investigators to acquire, analyze, and report on data from computers and mobile devices in a legally admissible way.
About these practice questions
This CHFI question is part of Courseiva's 745-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.