CHFI Computer Forensics Fundamentals and Process Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Delete all data that is not relevant to the lawsuit to reduce storage.

  Why it's wrong here

  Deleting data to reduce storage during a litigation hold is a textbook spoliation risk: the organization cannot yet know what a trier of fact will deem relevant, and even seemingly irrelevant documents may gain context or lead to discoverable evidence. Courts impose severe sanctions—including adverse inference instructions, monetary penalties, or dismissal—for intentional destruction of ESI when litigation was reasonably anticipated. The duty is to preserve, not curate, so any deletion prior to a defensible legal review violates the hold.

• ✓

  Immediately preserve all potentially relevant data, including backups and archives, and suspend automatic deletion policies.

  Why this is correct

  Upon receiving a litigation hold notice, a legally defensible response is to immediately issue a legal hold that suspends all normal retention, deletion, backup rotation/recycling, and archive destruction schedules across all media—including email servers, file shares, SharePoint/cloud repositories, and offline backups. Preserving backups and archives can prevent loss of older or metadata-rich versions of documents that may be responsive. The hold must be communicated to custodians and IT administrators, and its implementation should be documented to demonstrate reasonable, good-faith compliance.

• ✗

  Notify all employees to ignore the hold and continue normal operations.

  Why it's wrong here

  Directing employees to ignore a litigation hold and continue normal operations is a deliberate violation of the duty to preserve, and it effectively transforms routine email/IT retention practices into ongoing destruction of potentially discoverable evidence. Unlike simple negligence, this option suggests an intentional instruction, exposing the organization to the harshest spoliation sanctions, including default judgment or monetary sanctions. It also eviscerates any later claim of good-faith compliance because the organization consciously failed to preserve known ESI.

• ✗

  Conduct a forensic analysis of the data to determine relevance before preservation.

  Why it's wrong here

  Conducting a forensic analysis to determine relevance before preservation inverts the required sequence: any analysis that touches original media can alter metadata, timestamps, or data itself, creating a chain-of-custody problem and potentially qualifying as spoliation. Preservation must come first—typically by creating forensic images or copying data—after which relevance evaluation can be performed on the preserved copies without risking the original evidence. Attempting a pre-preservation investigation also delays the hold, leaving a window for normal deletion processes to destroy data.

Go deeper

Related to this question