CHFI Computer Forensics Fundamentals and Process Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Disconnecting the server from the network

  Why it's wrong here

  Disconnecting the server from the network is a reactive containment step that halts further remote access and preserves volatile data, but it does not create the legally required documentation of evidence provenance. The act itself modifies the system state—active network connections are terminated and system processes may change—and without a contemporaneous record of that action, opposing counsel can argue the evidence is not trustworthy. Admissibility depends on demonstrating that the evidence remained unaltered from seizure onward, which requires a documented chain of custody, not merely a technical isolation event.

• ✓

  Documenting the chain of custody

  Why this is correct

  Documenting the chain of custody is the foundational act that makes digital evidence legally admissible because it establishes an unbroken record of who handled the evidence, when, how, and where it was stored. This record demonstrates that the evidence cannot have been substituted, tampered with, or contaminated between the moment of discovery and its presentation in court. Without it, the evidence is subject to exclusion on the grounds that its authenticity cannot be verified, regardless of how technically sound the other forensic steps were.

• ✗

  Running a full antivirus scan on the server

  Why it's wrong here

  Running a full antivirus scan is a forensic analysis action that should be performed on a forensic copy of the original data, not the live server, because the scan itself alters evidence—file access times are updated, quarantined files are moved, logs are written, and the scan engine may modify the very artifacts it is inspecting. This alteration undermines the integrity of the original evidence and, without a documented chain of custody proving that the evidence was already in a reliable state, any conclusions drawn from the scan will be challenged. The priority during initial response is to preserve the original state and document its custody, not to perform potentially intrusive scans that could destroy the evidentiary value.

• ✗

  Taking screenshots of the server's screen

  Why it's wrong here

  Taking screenshots of the server's screen provides a transient visual record of what was displayed at a given moment, which can be helpful for context, but it is not sufficient to ensure legal admissibility because screenshots do not establish the integrity or provenance of the underlying digital data. A screenshot can be easily manipulated, edited, or taken out of context, and it offers no verifiable metadata linking it to the original server state at the time of the incident. Chain of custody is the critical factor because it provides a forensic, verifiable trail of evidence handling, whereas a screenshot is simply a secondary representation that cannot support a legal argument on its own.

Go deeper

Related to this question