CHFI Computer Forensics Investigation Process Practice Question
This CHFI practice question tests your understanding of computer forensics investigation process. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Exhibit
Refer to the exhibit.
C:\> fsutil volume dismount C:
C:\> diskpart
DISKPART> select volume 1
DISKPART> attribute volume clear readonly
DISKPART> exit
C:\> e2fsck -fn image.dd
e2fsck 1.45.6 (20-Mar-2020)
Pass 1: Checking inodes, blocks, and sizes
Pass 2: Checking directory structure
Pass 3: Checking directory connectivity
Pass 4: Checking reference counts
Pass 5: Checking group summary information
image.dd: ********** WARNING: Filesystem still has errors **********
An analyst executed the commands shown in the exhibit on a Windows system to prepare a forensic image for analysis. What is the most likely reason for the error message from e2fsck?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "most likely"
Why it matters: Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The analyst failed to properly dismount the source volume before imaging, leading to filesystem inconsistencies.
The error message from e2fsck indicates that the filesystem has inconsistencies, which typically occur when a volume is imaged while it is still mounted and actively being written to. The analyst likely did not dismount the source volume before acquiring the forensic image, resulting in a snapshot that reflects an inconsistent state (e.g., dirty journal, unflushed writes). This is a common chain-of-custody and acquisition procedure error in forensic imaging.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
The analyst failed to properly dismount the source volume before imaging, leading to filesystem inconsistencies.
Why this is correct
The fsutil dismount command was run on C:, but the image was taken later, possibly without ensuring the volume was cleanly unmounted.
Clue confirmation
The clue word "most likely" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✗
The forensic image was not acquired with a write-blocker, causing data corruption.
Why it's wrong here
While possible, the commands show diskpart operations, not acquisition.
✗
The image file contains an NTFS filesystem, but e2fsck is designed for ext filesystems.
Why it's wrong here
If it were NTFS, e2fsck would likely fail to recognize it, not show ext-specific errors.
✗
The e2fsck command syntax is incorrect; it should be 'e2fsck -f -n' instead.
Why it's wrong here
The syntax is valid; -fn is equivalent to -f -n.
Common exam traps
Common exam trap: answer the scenario, not the keyword
EC-Council often tests the misconception that a write-blocker alone guarantees a forensically sound image, but the trap here is that even with a write-blocker, imaging a mounted volume can produce an inconsistent filesystem because the OS may have pending writes in cache.
Trap categories for this question
Command / output trap
While possible, the commands show diskpart operations, not acquisition.
Detailed technical explanation
How to think about this question
When a filesystem is mounted, the operating system caches writes in memory and updates the journal; imaging without dismounting captures a state where the journal may not be replayed or the superblock may be out of sync. The e2fsck tool checks for such inconsistencies by verifying block group descriptors, inode tables, and journal replay; a dirty journal flag or mismatched checksums will trigger this error. In real-world forensic practice, this is why the 'first rule of forensics' is to never image a live system without using a snapshot or live acquisition technique that accounts for filesystem state.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A practitioner preparing for the CHFI exam encounters this exact type of scenario on the job. The correct answer here is not the most general option — it is the best answer for the specific constraint described. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Real exam questions reward reading the full scenario before eliminating options, because the constraint defines which answer fits.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this CHFI question in full detail.
Computer Forensics Investigation Process — This question tests Computer Forensics Investigation Process — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: The analyst failed to properly dismount the source volume before imaging, leading to filesystem inconsistencies. — The error message from e2fsck indicates that the filesystem has inconsistencies, which typically occur when a volume is imaged while it is still mounted and actively being written to. The analyst likely did not dismount the source volume before acquiring the forensic image, resulting in a snapshot that reflects an inconsistent state (e.g., dirty journal, unflushed writes). This is a common chain-of-custody and acquisition procedure error in forensic imaging.
What should I do if I get this CHFI question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Are there clue words in this question I should notice?
Yes — watch for: "most likely". Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.