CHFI Computer Forensics Lab Practice Question
A forensic lab receives a sealed evidence bag containing a laptop seized during an investigation. The chain-of-custody form shows the bag was sealed at the scene by an officer. Before beginning analysis, the examiner must document the evidence. Which action best preserves the chain of custody at this point?
⚠ Common exam trap
The trap here is treating chain of custody as a formality that can be completed later, when in fact the receipt documentation is the critical link that proves the evidence was not altered.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Photograph the sealed bag and its seal number, then record the date, time, and examiner name before opening
Chain of custody requires documenting the evidence's condition at every transfer. Photographing the sealed bag, recording the seal number, and logging the date, time, and examiner name before opening establishes an unbroken record from seizure to analysis. Skipping, delaying, or re-sealing without documentation creates gaps that weaken admissibility.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Ask the officer who sealed the bag to re-seal it in the lab before analysis
Why it's wrong here
Re-sealing by the original officer in the lab does not document the bag's condition at receipt and could be seen as altering the evidence. It also creates confusion about who had control between seizure and lab receipt. The correct practice is to document, not re-seal, unless a documented transfer requires it.
- ✗
Immediately open the bag and begin imaging to save time
Why it's wrong here
Opening the bag without documenting the seal number and condition breaks the chain of custody because there is no record of the bag's state at receipt. If the seal was already compromised, that fact would go unnoticed. This shortcut undermines the admissibility of any evidence derived from the laptop.
- ✗
Store the bag in the evidence locker and delay documentation until analysis begins
Why it's wrong here
Delaying documentation leaves a gap in the chain of custody between receipt and the start of analysis. If the bag were accessed or damaged during storage, there would be no baseline record to compare against. Documentation must occur at the moment of receipt, not later.
- ✓
Photograph the sealed bag and its seal number, then record the date, time, and examiner name before opening
Why this is correct
Photographing the sealed bag and recording the seal number, date, time, and examiner name creates an auditable record of the bag's condition at receipt. This documentation links the seal applied at the scene to the examiner who opens it, preserving continuity. It is the expected first step before any analysis and supports later testimony about evidence integrity.
Go deeper
Related to this question
Learn chapter
Overview of Computer Forensics and Investigation Process
Key term
Evidence Admissibility
Evidence admissibility is the legal and technical standard that determines whether digital evidence can be used in a court of law.
Key term
Chain of custody
Chain of custody is a documented process that tracks the handling, transfer, and possession of evidence or digital assets from the moment they are collected until they are presented in court or used in an investigation.
About these practice questions
Courseiva writes every CHFI question from scratch — 745 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official EC-Council exam blueprint
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.