Courseiva

CCNA Computer Forensics Fundamentals and Process Questions

75 of 155 questions · Page 1/3 · Computer Forensics Fundamentals and Process · Answers revealed

Practice these questionsDomain overviewAll questions
1
MCQhard

An organization receives a legal hold notice regarding a pending lawsuit. The IT department is instructed to preserve all relevant electronically stored information (ESI). Which of the following actions must be taken FIRST?

A.Perform a full forensic analysis of all systems
B.Notify all employees to delete personal files
C.Immediately suspend any automated data deletion policies
D.Delete all emails older than 30 days to reduce storage
AnswerC

This ensures that no relevant data is automatically purged.

Why this answer

When a legal hold notice is issued, the first priority is to preserve all potentially relevant ESI by immediately suspending any automated data deletion policies (e.g., retention schedules, auto-archiving, or purge scripts). This prevents spoliation of evidence before any collection or analysis begins. Failure to do so could result in sanctions for destroying discoverable data.

Exam trap

EC-Council often tests the misconception that forensic analysis or data collection should be the immediate step, when in fact the legal hold requires first stopping any automated destruction mechanisms to preserve the current state of ESI.

How to eliminate wrong answers

Option A is wrong because a full forensic analysis is a later step in the e-discovery process, not the first action; performing it prematurely could alter data or waste resources before the scope of preservation is defined. Option B is wrong because notifying employees to delete personal files contradicts the legal hold's purpose and could be construed as intentional spoliation; employees should be instructed to preserve all potentially relevant data, not delete anything. Option D is wrong because deleting emails older than 30 days would destroy potentially relevant evidence and directly violate the duty to preserve ESI under the legal hold.

Practice this question →
2
Multi-Selecthard

Which THREE of the following are steps in the forensic investigation process? (Select three.)

Select 3 answers
A.Analysis
B.Sentencing
C.Reporting
D.First response
E.Deletion of irrelevant data
AnswersA, C, D

Analysis is a core step.

Why this answer

Analysis is a core phase in the forensic investigation process where collected data is examined to identify evidence, reconstruct events, and draw conclusions. This step involves techniques such as file carving, hash verification, and timeline analysis to uncover relevant artifacts from acquired images.

Exam trap

EC-Council often tests the distinction between the forensic investigation process and the broader legal or judicial process, leading candidates to mistakenly include post-investigation actions like sentencing as a forensic step.

Practice this question →
3
MCQmedium

A security analyst arrives at a suspected computer crime scene. The computer is on and a user is logged in. The analyst needs to preserve volatile data. According to first responder duties, what should the analyst do FIRST?

A.Immediately unplug the power cord to prevent data alteration
B.Create a forensic image of the hard drive using a write blocker
C.Photograph the scene and document everything
D.Capture volatile data such as running processes and network connections
AnswerD

Volatile data must be captured before powering off because it is lost when the system loses power.

Why this answer

Option D is correct because the first responder's priority is to preserve volatile data, which is lost when the system is powered off. Volatile data includes running processes, network connections, and memory contents, which must be captured before any other action. This aligns with the order of volatility (RFC 3227) and standard forensic procedures.

Exam trap

Cisco often tests the misconception that preserving the hard drive (Option A or B) is the top priority, but the trap is that volatile data is more fragile and must be captured first to avoid losing critical evidence like active network connections or malware in memory.

How to eliminate wrong answers

Option A is wrong because immediately unplugging the power cord destroys volatile data in RAM and active network connections, violating the order of volatility. Option B is wrong because creating a forensic image of the hard drive is a non-volatile data acquisition step that should occur after volatile data capture, and using a write blocker is irrelevant for volatile data. Option C is wrong because while photographing and documenting the scene is important, it is not the first action; volatile data must be captured immediately before it is lost.

Practice this question →
4
Multi-Selecthard

Which THREE of the following are considered rules of evidence that digital evidence must satisfy to be admissible in court? (Select THREE)

Select 3 answers
A.Best evidence
B.Authenticity
C.Hearsay
D.Completeness
E.Admissibility
AnswersB, D, E

Evidence must be proven to be what it claims to be.

Why this answer

Authenticity (B) is a core rule of evidence because the court must be assured that the digital evidence is exactly what it purports to be and has not been tampered with. This is typically established through cryptographic hash verification (e.g., SHA-256) and a documented chain of custody. Without authenticity, the evidence could be challenged as fabricated or altered, rendering it inadmissible.

Exam trap

EC-Council often tests the distinction between the 'best evidence rule' (which is a legal principle, not a rule of evidence that digital evidence must satisfy) and the actual three rules (authenticity, completeness, admissibility), causing candidates to mistakenly select 'Best evidence' as a required rule.

Practice this question →
5
MCQmedium

A first responder arrives at a scene where a computer is suspected to contain evidence of fraud. The computer is turned on and a file is open. Which of the following actions should the responder AVOID?

A.Photographing the screen and documenting open windows.
B.Double-clicking the open file to fully view its contents.
C.Noting the time and date from the system clock.
D.Using a hardware write blocker to image the hard drive after shutdown.
AnswerB

Double-clicking alters the file's metadata and potentially the file itself.

Why this answer

Double-clicking files changes file access times and may modify data, which should be avoided to preserve evidence integrity.

Practice this question →
6
MCQmedium

A forensic examiner needs to verify the integrity of a forensic image after acquisition. Which of the following methods is the MOST reliable for ensuring the image has not been altered?

A.Opening the image in a hex editor and visually inspecting the first few bytes.
B.Using the 'dir' command to list files and compare timestamps.
C.Calculating and comparing hash values (e.g., MD5 or SHA-1) of the original and the image.
D.Comparing file sizes of the original drive and the image.
AnswerC

Hash comparison ensures that the image is bit-for-bit identical to the original.

Why this answer

Option C is correct because cryptographic hash functions like MD5 or SHA-1 produce a fixed-size digest that is uniquely tied to the data content. By comparing the hash of the original drive (or its bit-for-bit copy) with the hash of the forensic image, any single bit change in the image will result in a completely different hash value, providing mathematically strong integrity verification. This is the standard method recommended in forensic best practices (e.g., NIST SP 800-86) and is far more reliable than any metadata or size comparison.

Exam trap

Cisco often tests the misconception that file metadata or size comparisons are sufficient for integrity verification, when in fact only cryptographic hashing provides content-level assurance against tampering.

How to eliminate wrong answers

Option A is wrong because visually inspecting the first few bytes in a hex editor only checks a tiny fraction of the data; any alteration elsewhere in the image would go undetected. Option B is wrong because the 'dir' command lists file metadata (names, timestamps, sizes) from the filesystem, which does not verify the underlying raw data integrity; timestamps can be modified without changing the actual file content, and the command does not examine unallocated space or slack space. Option D is wrong because comparing file sizes only ensures the total byte count matches; an attacker could replace data with different content of the same size (e.g., swapping files or padding data) without changing the size, so size alone provides no cryptographic assurance.

Practice this question →
7
MCQmedium

During a forensic investigation, an analyst uses a hardware write blocker to connect a suspect hard drive to a forensic workstation. What is the primary purpose of using a hardware write blocker?

A.To prevent the operating system from writing to the source drive
B.To speed up the data transfer rate during imaging
C.To compress the forensic image to save storage space
D.To automatically hash the drive contents for integrity verification
AnswerA

This is the core function: blocking write commands to preserve evidence.

Why this answer

A hardware write blocker physically intercepts the write commands from the forensic workstation to the suspect drive, ensuring that no data can be altered on the source drive during acquisition. This preserves the evidentiary integrity of the original media, which is a foundational requirement in digital forensics to maintain a chain of custody and admissibility in court.

Exam trap

The trap here is that candidates often confuse the purpose of a write blocker with other forensic tools or features, such as hashing or compression, which are separate software functions, not hardware-level protections.

How to eliminate wrong answers

Option B is wrong because hardware write blockers do not speed up data transfer rates; they may even introduce a slight latency due to the bridge circuitry. Option C is wrong because compression of the forensic image is a software feature (e.g., EnCase or FTK Imager options), not a function of a hardware write blocker. Option D is wrong because hashing for integrity verification is performed by imaging software (e.g., using MD5 or SHA-1) after acquisition, not by the hardware write blocker itself.

Practice this question →
8
MCQmedium

A first responder arrives at a suspected data breach scene. The system is powered on and a user is logged in. Which of the following actions should the responder take FIRST to preserve volatile data?

A.Document the scene and take photographs, then proceed to interview witnesses.
B.Immediately disconnect the network cable and power off the computer.
C.Collect volatile data such as RAM, network connections, and running processes using appropriate tools.
D.Use a hardware write-blocker to create a forensic image of the hard drive.
AnswerC

Volatile data must be captured first as it is lost when the system is powered off.

Why this answer

The first responder should capture volatile data (RAM, network connections, running processes) before powering off. Using a write-blocker to image the hard drive is done after capturing volatile data.

Practice this question →
9
MCQeasy

Which of the following is the BEST example of direct evidence in a computer forensics investigation?

A.A document found on the suspect's computer with content about the crime
B.A server log showing the suspect's IP address accessed a restricted file at the time of the incident
C.Expert testimony that the suspect's computer contained malware
D.A witness testifying that the suspect was the only person who knew the password
AnswerB

This directly shows the access event, linking the IP to the action.

Why this answer

Direct evidence directly proves a fact without requiring inference. A server log showing the suspect's IP address accessing a restricted file at the time of the incident is direct evidence because it directly links the suspect's system to the specific action (accessing the file) at the relevant time, without needing additional reasoning or assumptions. This is based on the principle that logs capture actual system events, making them direct proof of the occurrence of that event.

Exam trap

EC-Council often tests the distinction between direct and circumstantial evidence; the trap here is that candidates mistakenly classify any evidence found on a suspect's computer (like a document) as direct, when in fact it is circumstantial because it requires additional inference to connect it to the crime.

How to eliminate wrong answers

Option A is wrong because a document found on the suspect's computer with content about the crime is circumstantial evidence; it requires inference that the suspect created or possessed the document with intent, and does not directly prove the crime occurred. Option C is wrong because expert testimony that the suspect's computer contained malware is indirect evidence; it only proves the presence of malware, not that the malware was used to commit the crime or that the suspect was responsible. Option D is wrong because a witness testifying that the suspect was the only person who knew the password is hearsay or opinion evidence, not direct evidence; it does not directly prove any action or event, only a belief about knowledge.

Practice this question →
10
Multi-Selectmedium

Which TWO of the following are essential steps that a first responder should take when arriving at a digital crime scene? (Select TWO)

Select 2 answers
A.Capture volatile data from running systems
B.Immediately start the forensic imaging process
C.Install forensic software on the suspect's computer
D.Interview all witnesses without documentation
E.Photograph and document the scene
AnswersA, E

Volatile data is lost when power is removed; capture it early.

Why this answer

A is correct because volatile data (e.g., RAM contents, running processes, network connections) is lost when power is removed. A first responder must capture this data using tools like `dd` or `memdump` before shutting down the system, as it may contain encryption keys, active malware, or evidence of ongoing network activity.

Exam trap

EC-Council often tests the misconception that imaging the hard drive is the first priority, but the trap here is that volatile data (RAM, network state) must be captured first to prevent permanent loss.

Practice this question →
11
MCQmedium

During a forensic examination of a Windows system, the investigator finds a file named 'notes.txt' that contains a list of passwords. The file's last modified timestamp is before the incident date, but its last accessed timestamp is during the incident. Which type of evidence is this file considered?

A.Circumstantial evidence
B.Best evidence
C.Hearsay evidence
D.Direct evidence
AnswerA

The access timestamp is circumstantial; it implies the file was opened, but other explanations are possible.

Why this answer

The file 'notes.txt' has a last modified timestamp before the incident but a last accessed timestamp during the incident. This indicates the file was opened or read during the incident, but not modified. Such indirect evidence suggests the attacker may have viewed the passwords, but does not directly prove the act of using them.

Therefore, it is circumstantial evidence because it requires inference to connect the file access to the incident.

Exam trap

EC-Council often tests the distinction between direct and circumstantial evidence by presenting timestamp data that shows access without modification, leading candidates to mistakenly classify it as direct evidence because they assume 'accessed during incident' equals 'used in the incident'.

How to eliminate wrong answers

Option B (Best evidence) is wrong because best evidence refers to the original or primary source of evidence (e.g., the original file on disk), not the type of inference drawn from timestamps. Option C (Hearsay evidence) is wrong because hearsay applies to out-of-court statements offered for their truth, not to file system metadata like timestamps. Option D (Direct evidence) is wrong because direct evidence would prove a fact without inference (e.g., a video of the attacker typing the passwords), whereas the timestamp only shows access, not the action of using the passwords.

Practice this question →
12
MCQmedium

A forensic investigator is required to testify in court about the findings of a digital investigation. Which of the following roles does the investigator fulfill?

A.Expert witness
B.Lay witness
C.Character witness
D.Fact witness
AnswerA

The investigator's specialized knowledge qualifies them as an expert witness to provide opinions on technical matters.

Why this answer

An expert witness is someone with specialized knowledge who provides opinion testimony to assist the court in understanding technical evidence.

Practice this question →
13
MCQmedium

Which of the following tools is specifically designed for forensic imaging and can create compressed, segmented, or E01 format images?

A.dd
B.Nmap
C.FTK Imager
D.Wireshark
AnswerC

FTK Imager is a GUI tool created by AccessData that supports E01, DD, and other formats with compression and segmentation.

Why this answer

FTK Imager is a free forensic imaging tool that supports multiple output formats including E01 (EnCase), DD, and segmented images.

Practice this question →
14
MCQhard

During an e-discovery process, a forensic examiner encounters a hard drive that is encrypted using BitLocker. The examiner has a valid password to unlock the drive. Which of the following is the MOST appropriate action to acquire the data while maintaining the chain of custody?

A.Remove the hard drive and connect it to a forensic workstation without a write blocker
B.Ask the IT administrator to decrypt the drive and then image
C.Use a hardware write blocker to image the encrypted drive directly, then decrypt the image in a lab
D.Boot the system and unlock the drive using the password, then create a forensic image
AnswerC

This preserves the original encrypted state and integrity.

Why this answer

Using a write blocker ensures the drive is not modified during acquisition. Unlocking via the OS may alter data; imaging the encrypted drive preserves the original state.

Practice this question →
15
MCQhard

An organization receives a litigation hold notice regarding an ongoing lawsuit. The IT administrator is instructed to preserve all relevant electronic records. Which of the following actions is MOST consistent with proper legal hold implementation?

A.Reboot all servers to ensure they are running the latest patches.
B.Immediately delete all emails older than 90 days to reduce data volume.
C.Place a hold on all data that may be relevant by suspending routine deletion and notifying custodians.
D.Encrypt all data and change access passwords to prevent unauthorized access.
AnswerC

This preserves evidence and meets legal obligations.

Why this answer

A legal hold requires suspending routine deletion policies and preserving potentially relevant data in its current state. Notifying custodians and disabling automatic deletion mechanisms are critical steps.

Practice this question →
16
MCQhard

A forensic examiner is presented with evidence that a suspect's computer was used to commit a fraud. The defense argues that the evidence was obtained without a warrant. Which US Constitutional Amendment is MOST relevant to this argument?

A.Fourth Amendment
B.First Amendment
C.Sixth Amendment
D.Fifth Amendment
AnswerA

The Fourth Amendment directly addresses warrants and unreasonable searches.

Why this answer

The Fourth Amendment protects against unreasonable searches and seizures and requires warrants supported by probable cause.

Practice this question →
17
MCQmedium

A forensic analyst is creating a forensic image of a suspect's hard drive using a write blocker. Which of the following BEST describes the purpose of using a hardware write blocker?

A.To ensure that no data is written to the source drive during imaging
B.To increase the speed of data acquisition
C.To encrypt the forensic image for secure storage
D.To allow the suspect drive to be booted without altering data
AnswerA

This is the primary function: it blocks write commands from the forensic workstation to the suspect drive.

Why this answer

A hardware write blocker prevents any modification to the original evidence by intercepting write commands at the hardware level, ensuring the integrity of the source drive.

Practice this question →
18
MCQmedium

During a forensic investigation, an analyst uses a hardware write blocker to connect a suspect hard drive to a forensic workstation. Which of the following is the PRIMARY reason for using a write blocker?

A.To allow the suspect drive to be mounted as read-write for analysis
B.To decrypt the drive automatically without the key
C.To prevent any modification to the suspect drive during acquisition
D.To speed up the imaging process by caching writes
AnswerC

The primary purpose is to ensure the drive is not altered during forensic acquisition.

Why this answer

The primary reason for using a hardware write blocker is to ensure that the suspect drive is connected in a read-only manner, preventing any write operations from the forensic workstation from reaching the drive. This preserves the integrity of the evidence by guaranteeing that no data is altered, added, or deleted during the acquisition process, which is a fundamental requirement for admissibility in legal proceedings.

Exam trap

EC-Council often tests the misconception that write blockers are used to speed up imaging or that they provide some form of decryption, when in fact their sole purpose is write prevention for evidence integrity.

How to eliminate wrong answers

Option A is wrong because a write blocker forces the drive to be read-only, not read-write; mounting as read-write would risk modifying evidence. Option B is wrong because write blockers do not perform decryption; they only block write commands at the hardware level and have no capability to decrypt drives without the key. Option D is wrong because write blockers do not cache writes or speed up imaging; in fact, they add a slight overhead by intercepting and blocking write commands, and caching writes would contradict the goal of preventing modification.

Practice this question →
19
MCQmedium

During a forensic investigation, an analyst creates a forensic image using `dcfldd` with the command: `dcfldd if=/dev/sda of=image.dd hash=sha256 hashwindow=10M`. What is the purpose of the `hashwindow` parameter?

A.It limits the total amount of data to hash to 10 MB
B.It creates a hash for every 10 MB block of data
C.It sets the hash algorithm to SHA-256
D.It enables error correction for every 10 MB
AnswerB

This allows verification of each 10 MB segment independently.

Why this answer

The `hashwindow` parameter in `dcfldd` specifies the size of the data chunks for which individual hash values are computed. With `hashwindow=10M`, the tool generates a SHA-256 hash for every 10 MB block of the input data, allowing verification of integrity on a per-block basis rather than only a single hash for the entire image. This is useful for detecting corruption or tampering in specific segments of large forensic images.

Exam trap

EC-Council often tests the distinction between parameters that set the hash algorithm (`hash=`) versus those that control hash granularity (`hashwindow`), leading candidates to confuse `hashwindow` with limiting the total data or enabling error correction.

How to eliminate wrong answers

Option A is wrong because `hashwindow` does not limit the total amount of data to hash; it defines the block size for per-block hashing, and the entire input is still processed. Option C is wrong because the hash algorithm is set by the `hash=sha256` parameter, not by `hashwindow`. Option D is wrong because `hashwindow` does not enable error correction; it only controls the granularity of hash computation, and `dcfldd` does not provide built-in error correction for data blocks.

Practice this question →
20
MCQhard

During a forensic investigation, an examiner finds a log entry: 'User JohnDoe accessed file contract.pdf at 10:32:45 AM'. This log is considered which type of evidence?

A.Circumstantial evidence
B.Hearsay
C.Direct evidence
D.Best evidence
AnswerC

Direct evidence directly proves a fact; the log entry directly shows the user accessed the file.

Why this answer

The log entry directly states that User JohnDoe accessed contract.pdf at a specific time, which is a firsthand account of the event without requiring inference. In digital forensics, direct evidence is evidence that, if believed, proves a fact without any additional reasoning or presumption. This log is a direct record of the user's action, making it direct evidence.

Exam trap

EC-Council often tests the distinction between direct and circumstantial evidence by presenting a log entry that seems to imply an action (e.g., 'User logged in at 10:30, file accessed at 10:32'), which would be circumstantial, but here the log explicitly states the user accessed the file, making it direct—candidates often confuse 'log' with 'circumstantial' because logs are sometimes used to build a circumstantial case.

How to eliminate wrong answers

Option A is wrong because circumstantial evidence requires an inference to connect it to a conclusion (e.g., a fingerprint on a keyboard suggests access, but doesn't prove it), whereas this log explicitly states the access event. Option B is wrong because hearsay is an out-of-court statement offered to prove the truth of the matter asserted, but logs are considered business records or computer-generated records that are generally admissible as an exception to hearsay under FRE 803(6) or similar rules, not hearsay themselves. Option D is wrong because the best evidence rule applies to the original writing, recording, or photograph to prove its content, but this question is about the classification of the log as a type of evidence (direct vs. circumstantial), not about the admissibility of a copy versus an original.

Practice this question →
21
MCQeasy

A first responder arrives at a crime scene where a computer is running. According to standard forensic procedure, what should the responder do FIRST?

A.Photograph the scene and secure the area
B.Connect a write blocker and create a forensic image immediately
C.Immediately shut down the computer to prevent data alteration
D.Pull the power cord to ensure the system does not shut down normally
AnswerA

Securing and photographing the scene ensures preservation of the original state.

Why this answer

Option A is correct because the first priority at a live crime scene is to preserve the integrity of the scene and all potential evidence. Standard forensic procedure (e.g., from NIST SP 800-86 and ACPO guidelines) mandates that the first responder must photograph the scene to document the state of the computer (including screen contents, cables, and peripherals) and secure the area to prevent unauthorized access or tampering. Only after this documentation and scene stabilization can the responder proceed to handle the live system, such as capturing volatile data or creating a forensic image.

Exam trap

The trap here is that candidates often confuse the urgency of preserving volatile data with the need to immediately perform a live acquisition or shut down the system, forgetting that scene documentation and security are the foundational first steps in any forensic investigation.

How to eliminate wrong answers

Option B is wrong because connecting a write blocker and creating a forensic image immediately is a later step in the forensic process; the first responder must first document the scene and secure it to preserve the chain of custody and prevent evidence contamination. Option C is wrong because immediately shutting down the computer can destroy volatile data (e.g., RAM contents, network connections, running processes) and may trigger anti-forensic mechanisms or cause file system corruption; proper live acquisition should be performed first if the system is running. Option D is wrong because pulling the power cord (hard power-off) can cause data loss, file system corruption, and loss of volatile memory, and it bypasses the need to document the system state and capture live data; it should only be considered as a last resort when the system is actively being used to destroy evidence.

Practice this question →
22
MCQmedium

A forensic investigator is documenting evidence for a case. What is the PRIMARY purpose of maintaining an unbroken chain of custody for digital evidence?

A.To track the storage location of the evidence.
B.To prove that the evidence has not been altered or tampered with.
C.To speed up the investigation process.
D.To assign responsibility for the evidence to a single individual.
AnswerB

Chain of custody establishes that evidence is authentic and unchanged.

Why this answer

The primary purpose of maintaining an unbroken chain of custody is to establish the integrity and authenticity of digital evidence by documenting every person who handled it, every transfer, and every access event. This documentation allows the court to verify that the evidence has not been altered, tampered with, or corrupted from the moment of seizure through analysis and presentation. Without a provable chain of custody, the evidence may be deemed inadmissible under rules like Federal Rule of Evidence 901 or similar standards in other jurisdictions.

Exam trap

EC-Council often tests the distinction between the operational benefit (tracking location) and the legal purpose (proving integrity), so candidates mistakenly choose Option A because they focus on the logistical aspect rather than the evidentiary admissibility requirement.

How to eliminate wrong answers

Option A is wrong because tracking the storage location is only a secondary benefit of chain-of-custody documentation, not its primary legal purpose; the core goal is to prove integrity, not merely to log physical or logical locations. Option C is wrong because maintaining a rigorous chain of custody often slows down the investigation process due to required documentation, logging, and verification steps; it is designed for legal admissibility, not speed. Option D is wrong because chain of custody does not assign responsibility to a single individual; it documents every individual who handled the evidence, ensuring multiple points of accountability and preventing a single point of failure or bias.

Practice this question →
23
MCQeasy

A first responder arrives at a scene where a computer is turned on and a user is logged in. What is the FIRST action the responder should take to preserve volatile evidence?

A.Photograph the screen and then shut down the system normally
B.Immediately unplug the power cord to prevent data alteration
C.Remove the hard drive immediately for forensic imaging
D.Collect volatile data such as RAM contents and running processes
AnswerD

Volatile data must be collected first before any power-down to preserve critical evidence.

Why this answer

Option D is correct because volatile data (e.g., RAM contents, running processes, network connections) is lost when power is removed. The first responder must collect this data before any shutdown or hardware removal, following the order of volatility (RFC 3227). This preserves critical evidence that cannot be recovered later.

Exam trap

EC-Council often tests the order of volatility (RFC 3227) and the misconception that immediate shutdown or hardware removal is safer, when in fact the priority is capturing volatile data first to avoid permanent loss.

How to eliminate wrong answers

Option A is wrong because shutting down the system normally allows the OS to write data to disk (e.g., pagefile.sys, temporary files), potentially overwriting evidence, and destroys volatile data. Option B is wrong because immediately unplugging the power cord causes an abrupt loss of all volatile data (RAM, network state) and may corrupt the file system, making forensic analysis harder. Option C is wrong because removing the hard drive without first capturing volatile data loses all RAM-based evidence, and hot-swapping a running system can cause data corruption or loss of encryption keys in memory.

Practice this question →
24
MCQeasy

What is the primary goal of the chain of custody in a digital forensic investigation?

A.To maintain the integrity and admissibility of evidence
B.To encrypt the evidence during transport
C.To speed up the forensic analysis process
D.To ensure that the forensic tools used are properly licensed
AnswerA

This is the main purpose: to show that evidence has not been tampered with.

Why this answer

The chain of custody is a documented chronological record that tracks the seizure, custody, control, transfer, analysis, and disposition of digital evidence. Its primary goal is to maintain the integrity and admissibility of evidence by proving that the evidence has not been tampered with or altered from the moment it was collected until it is presented in court. This is critical because any break in the chain can lead to evidence being deemed inadmissible under rules like the Federal Rules of Evidence (FRE) or the Daubert standard.

Exam trap

EC-Council often tests the misconception that chain of custody is about physical security or tool licensing, when in fact it is solely about maintaining a verifiable, unbroken record of evidence handling to ensure legal admissibility.

How to eliminate wrong answers

Option B is wrong because encrypting evidence during transport is a security measure to protect confidentiality, not a goal of the chain of custody, which focuses on integrity and accountability through documentation. Option C is wrong because the chain of custody does not speed up analysis; in fact, it adds procedural steps that can slow the process but are necessary for legal admissibility. Option D is wrong because ensuring forensic tools are properly licensed is a matter of tool validation and legal compliance, unrelated to the chain of custody's purpose of tracking evidence handling.

Practice this question →
25
Multi-Selectmedium

Which TWO of the following are BEST practices when using a hardware write blocker during forensic acquisition? (Select TWO)

Select 2 answers
A.Test the write blocker on a non-evidence drive before connecting it to the suspect drive
B.Use the write blocker to write data to the suspect drive to verify functionality
C.Use the same write blocker for both source and destination drives
D.Connect the write blocker between the suspect drive and the forensic workstation
E.Bypass the write blocker if the imaging tool supports software write protection
AnswersA, D

Testing ensures the device is working properly.

Why this answer

Option A is correct because testing the write blocker on a non-evidence drive verifies that the device is functioning correctly and will not inadvertently allow writes to the suspect drive. This step ensures the integrity of the forensic acquisition by confirming the write blocker's hardware-level protection is operational before it is connected to evidence.

Exam trap

The trap here is that candidates may confuse the role of a write blocker as a device that protects both source and destination drives, when in fact it is only used to protect the source (suspect) drive from accidental writes.

Practice this question →
26
Multi-Selectmedium

Which TWO of the following are essential components of the forensic investigation process? (Select two.)

Select 2 answers
A.Reporting
B.First response
C.Chain of custody
D.Analysis
E.Preservation
AnswersD, E

Analysis is a core phase where data is examined to draw conclusions.

Why this answer

Analysis (D) is an essential component because it is the phase where the investigator examines the acquired data to identify evidence, reconstruct events, and draw conclusions. Preservation (E) is equally essential as it ensures the integrity of digital evidence from the moment of collection through the entire investigation, typically by creating a bit-for-bit forensic image (e.g., using dd or FTK Imager) and storing it on write-protected media. Without analysis, no actionable findings emerge; without preservation, evidence is inadmissible due to tampering or spoliation.

Exam trap

EC-Council often tests the distinction between procedural steps (like first response or chain of custody) and the core forensic process phases, leading candidates to select 'First Response' or 'Chain of Custody' as essential components when they are actually supporting activities within the preservation phase.

Practice this question →
27
Multi-Selectmedium

Which TWO of the following are essential components of a proper chain of custody documentation? (Select TWO)

Select 2 answers
A.The forensic tools used to analyze the evidence
B.The hash value of the evidence at the time of acquisition
C.Date and time of each transfer of custody along with the names of individuals involved
D.A description of the evidence including serial numbers and unique identifiers
E.Digital signatures of all individuals who handled the evidence
AnswersC, D

Tracking every transfer is crucial.

Why this answer

Option C is correct because the chain of custody documentation must record the date, time, and identity of each individual who handles the evidence to ensure a complete, unbroken record of custody. This allows the court to verify that evidence was not tampered with or altered between collection and presentation. Without these timestamps and names, the chain of custody is legally insufficient.

Exam trap

EC-Council often tests the distinction between evidence integrity verification (hash values) and chain of custody documentation, leading candidates to mistakenly select hash values as a required component of the chain of custody form.

Practice this question →
28
MCQhard

In a UK-based investigation under the Police and Criminal Evidence Act (PACE), a forensic examiner is asked to seize computers from a business premises. Which of the following actions is MOST compliant with PACE requirements?

A.Conduct a forensic analysis at the scene to determine relevance before seizure
B.Copy all data on-site and delete the originals to avoid leaving evidence behind
C.Enter the premises without a warrant because evidence may be destroyed
D.Seize only items that are specified in the search warrant and provide a receipt
AnswerD

PACE Code B requires officers to list seized items and provide a receipt to the occupier.

Why this answer

Option D is correct because PACE requires that during a search under warrant, only items specified in the warrant may be seized, and a receipt must be provided to the occupier. This ensures legal compliance, chain of custody, and respect for property rights, which are fundamental to admissible digital evidence.

Exam trap

EC-Council often tests the misconception that on-site preview or analysis is permissible under PACE to determine relevance, but the correct procedure is to seize only warrant-specified items and provide a receipt, deferring analysis to the lab.

How to eliminate wrong answers

Option A is wrong because conducting forensic analysis at the scene (e.g., live imaging or preview) without proper authorization or a warrant extension can exceed the scope of PACE and risks altering evidence, violating the principle of maintaining integrity. Option B is wrong because copying data and deleting originals destroys potential evidence and violates PACE's requirement to preserve original media; deletion may also constitute unlawful destruction of property. Option C is wrong because entering without a warrant is only permissible under PACE in exigent circumstances (e.g., to prevent serious harm), not merely because evidence may be destroyed; the threshold is high and requires immediate risk, not speculative destruction.

Practice this question →
29
MCQmedium

In a legal context, which rule of evidence requires that the evidence presented be sufficient to prove a fact and not be misleading?

A.Reliability
B.Admissibility
C.Authenticity
D.Completeness
AnswerA

Reliability requires that evidence is consistent, accurate, and not misleading; it must be sufficient to prove the fact.

Why this answer

Reliability, under rules of evidence such as Federal Rule of Evidence 403, requires that the probative value of evidence is not substantially outweighed by the danger of unfair prejudice, confusing the issues, or misleading the jury. In computer forensics, this means the evidence must be sufficiently trustworthy and accurate to prove a fact without creating a misleading impression. For example, a log file with inconsistent timestamps or incomplete data would fail the reliability test because it could mislead the trier of fact.

Exam trap

EC-Council often tests the distinction between reliability and admissibility, trapping candidates who confuse the general requirement that evidence be 'admissible' with the specific rule that evidence must be sufficient and not misleading, which is a reliability concern under FRE 403.

How to eliminate wrong answers

Option B (Admissibility) is wrong because admissibility is a broader concept that encompasses multiple rules (relevance, authenticity, hearsay exceptions, etc.), not specifically the requirement that evidence be sufficient to prove a fact and not misleading. Option C (Authenticity) is wrong because authenticity, under FRE 901, requires evidence to be what it claims to be (e.g., proving a log file came from a specific system via hash verification), but it does not address whether the evidence is sufficient or misleading. Option D (Completeness) is wrong because completeness, under FRE 106, allows a party to introduce the remainder of a writing or recording to avoid misleading context, but it is a rule of completeness in presentation, not a standalone requirement that evidence itself be sufficient and not misleading.

Practice this question →
30
Multi-Selecthard

Which THREE of the following are best practices for a first responder when arriving at a computer crime scene?

Select 3 answers
A.Photograph the entire scene, including the computer screen and connections
B.Disconnect the computer from the network to prevent remote tampering
C.Turn off the computer immediately to prevent remote access
D.Boot the computer from a forensic CD to preview the hard drive
E.Collect volatile data such as RAM if the computer is on
AnswersA, B, E

Thorough documentation is critical for preserving the scene.

Why this answer

Option A is correct because photographing the entire scene, including the computer screen and connections, preserves a visual record of the state of the evidence before any changes are made. This documentation is critical for establishing the chain of custody and proving that the evidence was not tampered with. It also captures the exact configuration of cables and peripherals, which can be vital for later analysis.

Exam trap

EC-Council often tests the misconception that immediately powering off a computer is a safe first step, when in fact it destroys volatile evidence and can corrupt the file system, making forensic recovery harder.

Practice this question →
31
Multi-Selectmedium

Which TWO of the following are essential components of a proper chain of custody documentation? (Select TWO.)

Select 2 answers
A.The name of the suspect
B.Date and time of each evidence transfer
C.Signature of each person who handled the evidence
D.The operating system version of the suspect's computer
E.The IP address of the forensic workstation
AnswersB, C

Timestamps are crucial to establish a continuous chain.

Why this answer

The chain of custody documentation must record the date and time of each evidence transfer to establish a clear chronological timeline of custody. This ensures that the evidence can be tracked from collection through analysis to presentation in court, preventing claims of tampering or mishandling.

Exam trap

EC-Council often tests the misconception that technical details about the evidence (like OS version or IP address) are part of chain of custody, when in fact the chain only tracks who handled the evidence and when, not the evidence's configuration.

Practice this question →
32
Multi-Selecteasy

Which TWO of the following are considered best practices for a first responder at a digital crime scene? (Select TWO.)

Select 2 answers
A.Power off the computer immediately to secure data
B.Boot the system into safe mode to examine logs
C.Disconnect all cables to isolate the device
D.Photograph the scene including screen contents and connections
E.Document all actions taken at the scene
AnswersD, E

Photographs document the original state.

Why this answer

First responders should not power off the system (to preserve volatile data) and should photograph the scene to document the state.

Practice this question →
33
MCQmedium

During a forensic investigation, an analyst acquires a hard drive using a hardware write blocker. Which of the following is the PRIMARY reason for using a hardware write blocker?

A.To increase the transfer speed of the imaging process.
B.To bypass the drive's password protection.
C.To compress the data during imaging.
D.To ensure that the operating system does not mount the drive as writable.
AnswerD

The primary purpose is to prevent any writes to the original evidence drive.

Why this answer

The primary reason for using a hardware write blocker is to physically intercept the SATA/IDE bus between the suspect drive and the forensic workstation, ensuring that only read commands (e.g., ATA READ DMA) are passed through while blocking any write commands (e.g., ATA WRITE DMA). This prevents the operating system from mounting the drive as writable, which would otherwise cause automatic writes (e.g., timestamp updates, journaling, or prefetch creation) that alter evidence and break the chain of custody.

Exam trap

The trap here is that candidates confuse the write blocker's purpose with performance features (speed, compression) or assume it can bypass security mechanisms, when in fact its sole forensic function is to guarantee read-only access at the hardware interface level.

How to eliminate wrong answers

Option A is wrong because hardware write blockers do not increase transfer speed; they operate at the bus speed and may even introduce slight latency due to filtering logic. Option B is wrong because bypassing drive password protection is not a function of a write blocker; that requires specialized tools like forensic drive unlockers or ATA security commands. Option C is wrong because compression is a software feature of imaging tools (e.g., dd with gzip, FTK Imager, EnCase) and is unrelated to the hardware write blocker's role of write prevention.

Practice this question →
34
Multi-Selecthard

In the context of e-discovery, which THREE of the following are key steps in the Electronic Discovery Reference Model (EDRM)? (Select THREE)

Select 3 answers
A.Preservation
B.Production
C.Collection
D.Prosecution
E.Investigation
AnswersA, B, C

Preservation is a critical step to prevent spoliation.

Why this answer

The EDRM includes Information Governance, Identification, Preservation, Collection, Processing, Review, Analysis, and Production. Key steps include Preservation, Collection, and Production.

Practice this question →
35
Multi-Selectmedium

Which TWO of the following are essential duties of a first responder at a digital crime scene? (Select two.)

Select 2 answers
A.Photograph the scene including the screen, connections, and surrounding area
B.Use a write blocker when connecting the suspect drive to a forensic workstation
C.Attempt to recover deleted files using forensic software on the live system
D.Power off the computer immediately to prevent data modification
E.Disconnect the computer from the network to stop remote access
AnswersA, B

Documenting the scene is critical.

Why this answer

First responders must secure the scene, document everything, preserve evidence, and avoid altering the system state. Photographing the scene and using a write blocker to image are correct; collecting volatile memory is a specialized task, not a first responder's primary duty, and powering off without capturing RAM is generally avoided.

Practice this question →
36
MCQhard

During a forensic examination, an analyst uses the command 'dd if=/dev/sda of=/mnt/evidence/image.dd bs=4096 conv=noerror,sync'. What is the primary purpose of the 'conv=noerror,sync' option in this context?

A.To split the image into multiple smaller files
B.To skip bad sectors and continue imaging, padding the output with zeros
C.To compress the output image file
D.To verify the image integrity using a hash
AnswerB

noerror allows dd to continue on read errors, and sync pads the output so that the resulting image is the same size as the original device.

Why this answer

The 'conv=noerror,sync' option tells dd to continue reading even when it encounters read errors (noerror) and to pad the output with zeros (sync) to maintain the correct offset alignment, ensuring the image remains a bit-for-bit copy of the source drive despite bad sectors. This is critical in forensic imaging to preserve the integrity of the data stream and avoid truncation or corruption of the output file.

Exam trap

The trap here is that candidates often confuse 'conv=noerror,sync' with error correction or data recovery, when in fact it simply allows the imaging to proceed past bad sectors by padding with zeros, not by recovering the lost data.

How to eliminate wrong answers

Option A is wrong because splitting an image into multiple files is achieved with options like 'split' or 'bs' combined with 'count', not with 'conv=noerror,sync'. Option C is wrong because compression is not a function of dd's conv parameter; compression requires piping through gzip or using a separate tool. Option D is wrong because hash verification is done with separate commands like 'md5sum' or 'sha256sum', not with the conv parameter of dd.

Practice this question →
37
MCQeasy

Which of the following is the PRIMARY purpose of using a write blocker in computer forensics?

A.To speed up the imaging process by caching writes.
B.To convert the hard drive interface from SATA to USB.
C.To encrypt the forensic image for secure transport.
D.To prevent any modification to the original evidence drive during acquisition.
AnswerD

This is the primary purpose: preserving the original evidence.

Why this answer

A write blocker ensures that no data is written to the original evidence drive during acquisition, maintaining its integrity.

Practice this question →
38
MCQeasy

According to Locard's exchange principle, which of the following is MOST relevant to digital forensics?

A.The chain of custody must be maintained for all evidence
B.When a person interacts with a digital device, they leave digital traces that can be recovered
C.Every crime scene contains at least one latent fingerprint
D.Digital evidence is always stored in non-volatile memory
AnswerB

This is the digital adaptation of Locard's principle.

Why this answer

Locard's principle states that every contact leaves a trace. In digital forensics, this translates to the concept that digital devices leave traces of their activities and interactions, such as logs, metadata, and artifacts.

Practice this question →
39
MCQeasy

Which of the following is the BEST definition of computer forensics?

A.The application of investigative and analytical techniques to gather and preserve evidence from digital devices suitable for presentation in a court of law.
B.The use of software tools to scan for malware on a computer system.
C.The process of recovering deleted files from a hard drive.
D.The process of securing a computer network from unauthorized access.
AnswerA

This definition covers the full scope: collection, preservation, analysis, and legal admissibility.

Why this answer

Option A is correct because computer forensics is fundamentally the application of investigative and analytical techniques to collect, preserve, and analyze digital evidence in a manner that maintains its integrity and admissibility in a court of law. This definition encompasses the entire forensic process, from acquisition through chain of custody to presentation, aligning with the CHFI framework's emphasis on legal and procedural rigor.

Exam trap

EC-Council often tests the distinction between a narrow technical task (like file recovery or malware scanning) and the full legal and procedural scope of computer forensics, causing candidates to confuse a single step with the entire discipline.

How to eliminate wrong answers

Option B is wrong because it describes malware scanning, which is a security or incident response task, not the comprehensive legal and investigative process of computer forensics. Option C is wrong because it focuses solely on file recovery, which is only one small technical step within the broader forensic methodology, ignoring evidence preservation, analysis, and legal presentation. Option D is wrong because it defines network security (e.g., firewalls, access controls), not the post-incident forensic examination of digital evidence for legal proceedings.

Practice this question →
40
MCQhard

During an investigation, an analyst uses `dd if=/dev/sdb of=evidence.img bs=4k conv=noerror,sync`. What is the purpose of the `conv=noerror,sync` option?

A.It hashes each block to verify integrity.
B.It enables synchronous writing to ensure data integrity.
C.It compresses the output image to save space.
D.It skips read errors and pads the output with zeros to maintain block alignment.
AnswerD

That is the function of noerror and sync.

Why this answer

The `conv=noerror,sync` option in `dd` instructs the tool to continue processing even when a read error is encountered (`noerror`) and to pad the output block with zeros (`sync`) to maintain the original block alignment. This ensures that the resulting image file remains the same size as the source device, preserving the forensic integrity of the data layout despite hardware-level read failures.

Exam trap

EC-Council often tests the misconception that `sync` in `conv=noerror,sync` refers to synchronous I/O or write caching, when in fact it means padding output blocks with zeros to maintain alignment after read errors.

How to eliminate wrong answers

Option A is wrong because `conv=noerror,sync` does not perform hashing; hashing is done separately with options like `hash=md5` or via a pipe to `sha256sum`. Option B is wrong because synchronous writing is controlled by the `oflag=sync` or `conv=fsync` option, not `conv=noerror,sync`; the `sync` in `conv` refers to padding with zeros, not write synchronization. Option C is wrong because `dd` does not compress data; compression requires piping through `gzip` or using `conv=lz4` or similar, and `conv=noerror,sync` has no compression effect.

Practice this question →
41
MCQhard

An organization in the UK suspects an employee of data theft. The IT manager wants to search the employee's company-issued laptop without consent. Which law primarily governs this action?

A.Police and Criminal Evidence Act 1984 (PACE)
B.Computer Misuse Act 1990
C.GDPR (General Data Protection Regulation)
D.Human Rights Act 1998
AnswerA

PACE provides the legal framework for police powers to search and seize evidence, and applies to company investigations when involving law enforcement.

Why this answer

The Police and Criminal Evidence Act (PACE) 1984 governs search and seizure powers in the UK, including digital evidence.

Practice this question →
42
MCQmedium

An investigator needs to testify in court as an expert witness. Which of the following qualifications is MOST important for the court to accept their testimony?

A.They have a certification in computer forensics.
B.They have published articles in peer-reviewed journals on digital forensics.
C.They can demonstrate knowledge, skill, experience, training, or education that will assist the trier of fact.
D.They have been employed as a forensic analyst for over 10 years.
AnswerC

Under FRE 702 (Daubert standard), the expert must have qualifications that will help the jury understand the evidence.

Why this answer

Under the Federal Rules of Evidence (FRE) Rule 702, a witness qualified as an expert by knowledge, skill, experience, training, or education may testify if their specialized knowledge will assist the trier of fact. Option C directly mirrors this legal standard, making it the most critical qualification for admissibility. Certifications, publications, or years of service are supporting factors but not independently sufficient under the Daubert or Frye standards.

Exam trap

EC-Council often tests the misconception that a certification or years of experience alone qualifies someone as an expert witness, but the legal standard under FRE 702 requires the witness to demonstrate that their knowledge, skill, experience, training, or education will actually assist the trier of fact.

How to eliminate wrong answers

Option A is wrong because a certification alone does not guarantee that the court will accept the testimony; the court must assess whether the witness's actual knowledge and experience will assist the trier of fact, and certifications are not a substitute for demonstrated competence. Option B is wrong because published articles in peer-reviewed journals are a factor under the Daubert standard but are not the most important qualification; the witness must still show that their expertise directly aids the court in understanding the evidence. Option D is wrong because 10 years of employment as a forensic analyst does not automatically qualify someone as an expert; the court evaluates the substance of their experience and whether it logically applies to the specific digital evidence in question.

Practice this question →
43
MCQmedium

In a UK-based investigation, which legal framework governs the search and seizure of digital evidence?

A.Electronic Communications Privacy Act
B.PACE (Police and Criminal Evidence Act)
C.Fourth Amendment
D.GDPR
AnswerB

PACE governs police powers in England and Wales.

Why this answer

The Police and Criminal Evidence Act 1984 (PACE) provides the legal framework for police powers, including search and seizure of digital evidence in the UK.

Practice this question →
44
MCQhard

A company's legal department issues a legal hold notice for electronically stored information (ESI) related to a pending lawsuit. The IT department is tasked with preserving data. Which of the following actions is MOST likely to violate the legal hold requirements?

A.Notifying all employees to preserve documents related to the lawsuit.
B.Suspending routine deletion of emails older than 30 days.
C.Continuing to run a script that deletes temporary files older than 24 hours.
D.Taking a forensic image of the relevant servers.
AnswerC

If temporary files could contain relevant ESI, deletion violates the hold.

Why this answer

Option C is correct because continuing to run a script that deletes temporary files older than 24 hours directly destroys ESI that may be relevant to the lawsuit, violating the legal hold requirement to preserve all potentially relevant data. Legal hold mandates the suspension of any automated or manual processes that could alter or delete ESI, including temporary files that might contain fragments of relevant documents or metadata. Unlike suspending routine email deletion (Option B), which is a preservation action, the script actively purges data and thus breaches the hold.

Exam trap

EC-Council often tests the misconception that only 'obvious' data like emails or documents need preservation, but the trap here is that temporary files and caches are also ESI and must be preserved under a legal hold, making their automated deletion a violation.

How to eliminate wrong answers

Option A is wrong because notifying employees to preserve documents is a standard and necessary step to implement a legal hold, ensuring awareness and compliance. Option B is wrong because suspending routine deletion of emails older than 30 days is a proper preservation action that stops the destruction of potentially relevant ESI. Option D is wrong because taking a forensic image of relevant servers is a best-practice preservation technique that captures a point-in-time snapshot of data without altering it, fully compliant with legal hold requirements.

Practice this question →
45
MCQhard

A forensic analyst is examining a hard drive that was imaged using a software write blocker. Which of the following is a potential disadvantage of using a software write blocker compared to a hardware write blocker?

A.It cannot be used with USB drives
B.It may be susceptible to operating system or driver vulnerabilities
C.It does not support hashing algorithms for integrity
D.It is more expensive than hardware write blockers
AnswerB

Software blockers depend on the OS; a compromised OS could bypass the blocker.

Why this answer

A software write blocker operates at the operating system level, intercepting write commands before they reach the storage device. Because it relies on the OS and its drivers, any vulnerability in the OS kernel, storage driver stack, or the blocker's own filter driver could be exploited, potentially allowing unintended writes to the evidence. In contrast, a hardware write blocker physically prevents write signals from reaching the drive at the bus level, offering a more robust isolation that is independent of the host OS's security state.

Exam trap

EC-Council often tests the misconception that software write blockers are functionally equivalent to hardware blockers, but the trap here is that candidates overlook the OS-layer dependency and vulnerability surface of software blockers, assuming they are just as reliable as physical write-blocking hardware.

How to eliminate wrong answers

Option A is wrong because software write blockers can be used with USB drives; they intercept write commands at the OS level regardless of the interface (SATA, USB, etc.), though some may require specific driver support. Option C is wrong because software write blockers do not inherently prevent hashing; hashing algorithms like SHA-256 are applied to the acquired image by forensic tools (e.g., FTK Imager, dd with sha256sum) independently of the write blocker. Option D is wrong because software write blockers are generally less expensive than hardware write blockers, often being free or low-cost tools (e.g., built-in OS features or open-source utilities), while hardware blockers involve dedicated electronic components.

Practice this question →
46
MCQhard

In the context of e-discovery, what does the 'best evidence rule' require regarding digital documents?

A.That the original electronic file or a reliable duplicate be produced.
B.That all evidence be authenticated by a witness.
C.That only paper copies of digital documents are admissible.
D.That metadata is preserved in all copies.
AnswerA

The rule prefers the original, but accurate duplicates are often allowed.

Why this answer

The best evidence rule, codified in Federal Rule of Evidence 1002, requires the original writing, recording, or photograph to prove its content unless otherwise provided. In e-discovery, an original electronic file or a reliable duplicate (e.g., a bit-for-bit forensic image verified by a hash such as MD5 or SHA-1) satisfies this rule because the duplicate is functionally equivalent to the original for evidentiary purposes.

Exam trap

EC-Council often tests the misconception that the best evidence rule requires the 'original' in a physical sense, leading candidates to reject reliable duplicates, when in fact digital duplicates verified by hash are legally equivalent to the original under FRE 1003.

How to eliminate wrong answers

Option B is wrong because the best evidence rule does not mandate authentication by a witness; authentication is a separate requirement under FRE 901, which can be satisfied through testimony or circumstantial evidence like hash values. Option C is wrong because the rule does not require paper copies; in fact, paper copies of digital documents are often considered duplicates and may be admissible if they accurately reflect the original, but the rule prefers the original or a reliable duplicate, not exclusively paper. Option D is wrong because while metadata preservation is a best practice in forensics, the best evidence rule itself does not explicitly require metadata preservation in all copies; it focuses on the content of the document, not its metadata.

Practice this question →
47
MCQhard

An analyst runs 'dcfldd if=/dev/sdb of=/evidence/disk.dd hash=sha256 hashlog=/evidence/hash.log' on a Linux system. What is the primary advantage of using dcfldd over plain dd for forensic imaging?

A.It can acquire memory dumps from live systems
B.It supports compression of the output image
C.It automatically creates a write-blocked connection
D.It can compute hashes on-the-fly and log them
AnswerD

Correct. dcfldd can compute and log hashes during imaging.

Why this answer

D is correct because dcfldd is a specialized forensic version of dd that can compute cryptographic hashes (e.g., SHA-256) on-the-fly while writing the image, and log those hashes to a separate file (hashlog). This ensures data integrity verification without requiring a separate post-imaging hashing pass, which is a critical requirement in forensic imaging to prove the acquired image is an exact bit-for-bit copy of the source.

Exam trap

The trap here is that candidates may confuse dcfldd's on-the-fly hashing with other features like compression or memory acquisition, or assume that dd itself can perform hashing, when in fact plain dd has no built-in hash computation capability.

How to eliminate wrong answers

Option A is wrong because dcfldd is designed for disk imaging, not memory acquisition; tools like LiME or fmem are used for live memory dumps. Option B is wrong because dcfldd does not natively support compression; compression must be done via piping to gzip or using other tools like ewfacquire. Option C is wrong because dcfldd does not create a write-blocked connection; write-blocking is a hardware or software layer (e.g., using a hardware write-blocker or the Linux kernel's read-only mount) that must be established before running the imaging command.

Practice this question →
48
Multi-Selecthard

Which THREE of the following are valid rules of evidence that digital evidence must satisfy to be admissible in court? (Select three.)

Select 3 answers
A.Best evidence rule
B.Admissibility
C.Chain of custody
D.Authenticity
E.Completeness
AnswersB, D, E

Evidence must be relevant and not excluded by legal rules.

Why this answer

Option B (Admissibility) is correct because digital evidence must be legally permissible in court, meaning it must be obtained lawfully and not violate constitutional rights. Admissibility is a foundational rule that ensures evidence meets legal standards for consideration by the court, often tied to the Federal Rules of Evidence (FRE) or similar jurisdictional rules. Without admissibility, even the most compelling digital evidence cannot be presented to the jury.

Exam trap

EC-Council often tests the distinction between procedural concepts (like Chain of Custody) and formal rules of evidence, causing candidates to mistakenly select Chain of Custody as a rule when it is actually a supporting process for authenticity and completeness.

Practice this question →
49
MCQmedium

After collecting digital evidence from a suspect's computer, the forensic examiner creates a forensic image using FTK Imager. The examiner then computes the MD5 hash of the original drive and the image file. Which of the following BEST describes the purpose of this hashing?

A.To verify that the image is an exact bit-for-bit copy of the original.
B.To encrypt the data for secure storage.
C.To index the files for faster searching.
D.To reduce the storage size of the image.
AnswerA

Matching hashes confirm data integrity.

Why this answer

Hashing verifies the integrity of the image by ensuring it is an exact copy of the original, and is used to detect any tampering during the investigation.

Practice this question →
50
MCQmedium

A forensic examiner needs to acquire an image of a suspect's laptop hard drive. The laptop is running, and the examiner wants to capture volatile data first. According to best practices, which order of steps should the examiner follow?

A.Unplug the laptop, remove the drive, and boot the drive in a forensic workstation.
B.Immediately remove the hard drive, then capture RAM from the drive.
C.Create a full disk image over the network while the laptop is running.
D.Capture volatile data, then shut down normally, remove the drive, and image with a write blocker.
AnswerD

Volatile data first, then safe shutdown, then imaging.

Why this answer

Option D is correct because forensic best practices mandate capturing volatile data (e.g., RAM, network connections, running processes) first, as this data is lost on power loss. After capturing volatile data, the examiner should perform a graceful shutdown to preserve file system integrity, then remove the drive and acquire a forensic image using a write blocker to prevent any modification to the original evidence.

Exam trap

The trap here is that candidates may think immediate power-off (Option A) preserves the disk state, but they forget that volatile data is lost and an unclean shutdown can corrupt the filesystem, making the image less reliable.

How to eliminate wrong answers

Option A is wrong because unplugging the laptop immediately destroys volatile data (RAM contents, encryption keys, network state) and may cause file system corruption from an unclean shutdown. Option B is wrong because removing the hard drive while the system is running is physically dangerous and technically impossible without first powering off; moreover, capturing RAM from the drive is nonsensical—RAM is volatile memory, not stored on the hard drive. Option C is wrong because creating a full disk image over the network while the laptop is running modifies the system state (network traffic, open files, timestamps) and violates the principle of maintaining evidence integrity; network imaging should only be used when a write-blocked local acquisition is impossible, and even then volatile data must be captured first.

Practice this question →
51
MCQeasy

Locard's exchange principle in digital forensics states that:

A.The chain of custody must be documented for all evidence
B.Digital evidence is always stored in the cloud
C.Only the forensic examiner can handle evidence
D.Every contact leaves a trace, and digital evidence is no exception
AnswerD

This is the direct application of Locard's principle to digital evidence.

Why this answer

Locard's exchange principle, originally from forensic science, asserts that whenever two objects come into contact, a transfer of material occurs. In digital forensics, this translates to the fact that digital devices and systems inevitably leave traces of their interactions—such as log entries, metadata, file artifacts, or network packets—making it possible to reconstruct events. Option D correctly captures this core idea that every contact leaves a trace, and digital evidence is no exception.

Exam trap

EC-Council often tests whether candidates confuse procedural concepts (like chain of custody) with the foundational scientific principle of trace evidence transfer, leading them to pick Option A instead of D.

How to eliminate wrong answers

Option A is wrong because the chain of custody is a procedural requirement for maintaining evidence integrity, not a statement of Locard's exchange principle. Option B is wrong because digital evidence can reside on local storage (e.g., hard drives, SSDs, RAM) as well as in the cloud; the principle applies regardless of storage location. Option C is wrong because multiple authorized personnel (e.g., first responders, investigators, analysts) may handle evidence under proper protocols, not exclusively the forensic examiner.

Practice this question →
52
MCQeasy

Which of the following principles states that when two objects come into contact, there is a transfer of material between them?

A.The best evidence rule
B.Locard's exchange principle
C.The chain of custody
D.The hearsay rule
AnswerB

This principle describes the transfer of material upon contact.

Why this answer

Locard's exchange principle is a foundational concept in forensic science, including digital forensics, where every contact leaves a trace.

Practice this question →
53
MCQmedium

A security analyst responds to a suspected data breach. The analyst documents the scene, photographs the computer, and labels the cables. Which phase of the forensic investigation process is being performed?

A.Collection
B.First response
C.Examination
D.Reporting
AnswerB

First response covers initial actions to secure the scene, document, and preserve volatile evidence.

Why this answer

The actions described—documenting the scene, photographing the computer, and labeling cables—are part of the First Response phase. This phase occurs immediately after an incident is detected and focuses on preserving the integrity of the scene and evidence before any collection or analysis begins. In the CHFI methodology, First Response includes securing the area, creating a detailed log of the initial state, and ensuring no unauthorized changes occur.

Exam trap

EC-Council often tests the distinction between First Response and Collection, where candidates mistakenly think that any hands-on action (like labeling cables) is part of Collection, but Collection specifically refers to the technical acquisition of data, not scene preservation.

How to eliminate wrong answers

Option A is wrong because Collection involves the actual acquisition of digital evidence (e.g., creating bit-for-bit forensic images using tools like dd or FTK Imager), not the initial scene documentation and labeling. Option C is wrong because Examination is the in-depth analysis of acquired data (e.g., file carving, registry analysis, timeline reconstruction), which occurs after evidence has been collected and preserved. Option D is wrong because Reporting is the final phase where findings are documented and presented, not the initial response activities.

Practice this question →
54
MCQmedium

During a forensic investigation, an analyst creates a bit-for-bit copy of a suspect's hard drive using the 'dd' command with the following parameters: dd if=/dev/sda of=/evidence/image.dd bs=4k conv=noerror,sync. What is the purpose of 'conv=noerror,sync'?

A.To hash the output image
B.To ensure the command runs with superuser privileges
C.To ignore read errors and pad with zeros
D.To compress the output image
AnswerC

Correct. This ensures the image is complete despite errors.

Why this answer

Option C is correct because 'conv=noerror,sync' tells dd to continue reading even when encountering read errors (noerror) and to pad the output with zeros (sync) to maintain the same total size as the original drive. This ensures a complete forensic image is created despite bad sectors, preserving the integrity of the acquisition for analysis.

Exam trap

Cisco often tests the misconception that 'sync' refers to flushing disk caches (like the sync command) rather than its actual function of padding output with null bytes on read errors.

How to eliminate wrong answers

Option A is wrong because hashing is not performed by the conv parameter; hashing requires separate tools like sha256sum or md5sum, or using dd with piped output to a hash function. Option B is wrong because superuser privileges are obtained via sudo or running as root, not through conv parameters; conv controls data conversion, not permissions. Option D is wrong because compression is not a function of conv; compression requires piping dd output through gzip or using a separate tool like dc3dd with built-in compression.

Practice this question →
55
MCQeasy

Which of the following BEST defines the chain of custody in digital forensics?

A.The legal authority required to seize evidence
B.The order in which forensic tools are applied to evidence
C.The physical security measures used to store evidence
D.The chronological documentation of evidence handling, transfer, and analysis
AnswerD

This accurately describes the chain of custody.

Why this answer

The chain of custody is a formal, chronological record that documents every instance of evidence handling, transfer, and analysis from the moment of seizure through its entire lifecycle. This documentation is critical to prove that evidence has not been tampered with, altered, or corrupted, thereby maintaining its admissibility in legal proceedings under rules such as Federal Rule of Evidence 901.

Exam trap

Cisco often tests the distinction between the physical security of evidence (Option C) and the procedural documentation of its handling (Option D), leading candidates to confuse storage controls with the chain of custody itself.

How to eliminate wrong answers

Option A is wrong because legal authority to seize evidence (e.g., a search warrant or subpoena) is a prerequisite for lawful collection, not the ongoing tracking of evidence after seizure. Option B is wrong because the order of forensic tool application (e.g., using FTK Imager before Autopsy) is a procedural workflow choice, not a documentation requirement for evidentiary integrity. Option C is wrong because physical security measures (e.g., locked safes, access logs) are part of evidence storage controls, but they do not constitute the chronological documentation of handling and transfer that defines chain of custody.

Practice this question →
56
MCQeasy

What is the primary goal of computer forensics?

A.To prosecute cybercriminals
B.To recover deleted files for data recovery
C.To identify, preserve, analyze, and present digital evidence in a legally acceptable manner
D.To secure the network from future attacks
AnswerC

This encompasses the entire forensic process.

Why this answer

Computer forensics aims to preserve evidence in its most original form, identify the root cause of an incident, and document the investigation for legal proceedings.

Practice this question →
57
Multi-Selectmedium

Which TWO of the following are hardware write blockers commonly used in forensic acquisitions?

Select 2 answers
A.EnCase
B.FastBloc
C.dd
D.Tableau
E.FTK Imager
AnswersB, D

FastBloc is a hardware write blocker by Guidance Software.

Why this answer

FastBloc (Option B) is a hardware write blocker produced by Guidance Software that operates at the physical layer, intercepting ATA/ATAPI commands to prevent any write operations from reaching the suspect drive. It ensures bit-for-bit forensic acquisition without altering the source data, which is essential for maintaining evidentiary integrity.

Exam trap

Cisco often tests the distinction between hardware write blockers (physical devices) and forensic software tools (like EnCase, FTK Imager, or dd), leading candidates to mistakenly select software that can perform acquisitions but does not provide hardware-level write protection.

Practice this question →
58
MCQeasy

Which principle states that every contact leaves a trace?

A.Locard's exchange principle
B.Chain of custody
C.Best evidence rule
D.Hearsay rule
AnswerA

Correct. This principle is fundamental in forensic science.

Why this answer

Locard's exchange principle is the foundational forensic concept stating that whenever two objects come into contact, there is a transfer of material between them. In computer forensics, this means that digital activity—such as accessing a file, sending a packet, or connecting to a network—inevitably leaves traces in logs, memory, registry entries, or file metadata. This principle underpins the entire discipline of digital evidence recovery.

Exam trap

EC-Council often tests the distinction between a forensic principle (Locard's) and legal or procedural rules (chain of custody, best evidence, hearsay), so candidates mistakenly select a legal term that sounds related to evidence handling rather than the core scientific concept.

How to eliminate wrong answers

Option B (Chain of custody) is wrong because it is a procedural documentation process that tracks the handling of evidence from collection to court presentation, not a principle about trace evidence. Option C (Best evidence rule) is wrong because it is a legal rule requiring original evidence (e.g., original hard drive rather than a copy) to be presented in court, not a statement about contact leaving traces. Option D (Hearsay rule) is wrong because it is a legal rule excluding out-of-court statements offered for the truth of the matter, unrelated to physical or digital trace evidence.

Practice this question →
59
MCQhard

An investigator creates a forensic image using dcfldd with the following command: dcfldd if=/dev/sdb of=image.dd hash=sha256 hashwindow=10M hashlog=hash.txt. What is the effect of the 'hashwindow=10M' parameter?

A.It divides the output into 10 MB chunks and hashes each chunk, logging the results
B.It sets the input buffer size to 10 MB for performance
C.It verifies the hash of the input device in 10 MB windows before copying
D.It causes the tool to hash the entire image only after completion
AnswerA

This is the correct behavior; it enables piecewise verification.

Why this answer

Option A is correct because the `hashwindow=10M` parameter in dcfldd instructs the tool to compute a SHA-256 hash for every 10 MB segment (window) of the input data as it is being copied, and then log each segment's hash to the specified hashlog file. This allows the investigator to verify the integrity of individual chunks of the forensic image, which is useful for detecting corruption or tampering in specific regions of the image without rehashing the entire file.

Exam trap

Cisco often tests the distinction between 'hashing during acquisition' and 'hashing after completion' — the trap here is that candidates may assume `hashwindow` is for performance tuning (buffer size) or for pre-copy verification, rather than understanding it as a segmentation feature for incremental hashing and logging.

How to eliminate wrong answers

Option B is wrong because `hashwindow` does not control the input buffer size; dcfldd uses separate parameters (e.g., `bs=`) for block size and buffer settings, and `hashwindow` is specifically for segment-based hashing. Option C is wrong because `hashwindow` does not cause the tool to verify the hash of the input device before copying; it computes hashes of the output chunks during the copy process, not as a pre-copy verification step. Option D is wrong because `hashwindow=10M` causes hashing to occur incrementally during the imaging process, not only after completion; the `hashlog` file is populated as each 10 MB window is processed.

Practice this question →
60
MCQeasy

During a forensic investigation, the first responder arrives at a scene where a computer is powered on and a user is logged in. Which of the following is the MOST appropriate initial action?

A.Immediately power off the computer to prevent data alteration
B.Begin collecting data by copying all files to an external drive
C.Disconnect the computer from the network and take a photograph of the screen
D.Ask the user to save their work and then shut down normally
AnswerC

This preserves the current state and documents the scene, which is standard first responder procedure.

Why this answer

Securing the scene and documenting everything is the first priority to preserve evidence and ensure chain of custody. Powering off or accessing the system without proper documentation can lead to evidence spoliation.

Practice this question →
61
MCQmedium

A forensic analyst needs to collect evidence from a running Windows system without altering the system state. Which tool should they use to acquire volatile memory?

A.Wireshark
B.dd
C.DumpIt
D.Tableau write blocker
AnswerC

DumpIt is a memory acquisition tool for Windows.

Why this answer

DumpIt is a lightweight memory acquisition tool designed specifically for capturing the contents of volatile memory (RAM) on a running Windows system. It minimizes interaction with the system to avoid altering the memory state, making it ideal for forensic collection of live evidence.

Exam trap

EC-Council often tests the distinction between volatile memory acquisition and disk imaging, leading candidates to confuse tools like dd (for disks) with memory-specific tools like DumpIt.

How to eliminate wrong answers

Option A is wrong because Wireshark is a network protocol analyzer used for capturing and inspecting network traffic, not for acquiring volatile memory from a running system. Option B is wrong because dd is a disk imaging tool typically used for creating bit-for-bit copies of storage devices, not for capturing RAM contents, and it does not handle Windows memory structures natively. Option D is wrong because a Tableau write blocker is a hardware device used to prevent writes to storage media during acquisition, but it does not acquire volatile memory; it is used for forensic imaging of hard drives or SSDs.

Practice this question →
62
MCQmedium

In a corporate investigation, legal counsel issues a litigation hold to preserve electronically stored information (ESI) relevant to a lawsuit. Which of the following is the BEST description of a litigation hold?

A.A form of encryption used to protect evidence during transport.
B.A notice to employees to preserve all relevant ESI and cease routine deletion.
C.A technique used to acquire forensic images without altering the source.
D.A court order authorizing law enforcement to seize computers.
AnswerB

Litigation holds require organizations to preserve potentially relevant data.

Why this answer

A litigation hold is a legal directive to prevent spoliation of evidence by suspending normal data retention and deletion policies.

Practice this question →
63
MCQeasy

What is the primary goal of computer forensics?

A.To prevent future cyber attacks
B.To identify and prosecute cybercriminals
C.To preserve and analyze digital evidence in a legally admissible manner
D.To recover deleted files from a hard drive
AnswerC

This matches the definition of computer forensics.

Why this answer

The primary goal of computer forensics is to preserve and analyze digital evidence in a manner that is legally admissible in court.

Practice this question →
64
MCQhard

During a forensic examination, an analyst runs the following command: 'dd if=/dev/sda of=/mnt/evidence/image.dd bs=4k conv=noerror,sync'. The source drive has bad sectors. What is the effect of the 'conv=noerror,sync' option?

A.It stops the imaging process when an error is encountered.
B.It skips the bad sectors and compresses the output.
C.It retries reading the bad sector multiple times before giving up.
D.It fills the bad sectors with zeros in the output image, allowing the imaging to complete without errors.
AnswerD

noerror continues on error, sync pads with zeros so the output size matches the input.

Why this answer

The 'noerror' option tells dd to continue reading after errors, and 'sync' pads the bad sectors with zeros to maintain the correct size.

Practice this question →
65
MCQeasy

What is the primary purpose of maintaining a chain of custody during a forensic investigation?

A.To document the handling of evidence from collection to presentation in court
B.To reduce the size of evidence for easier storage
C.To analyze the evidence for hidden data
D.To encrypt the evidence to prevent unauthorized access
AnswerA

Chain of custody provides a clear record of evidence handling, ensuring admissibility.

Why this answer

The primary purpose of maintaining a chain of custody is to create a documented, unbroken record of every person who handled the evidence, from the moment it is collected until it is presented in court. This documentation is critical to establish the authenticity and integrity of the evidence, ensuring it has not been tampered with or altered, which is a foundational requirement for admissibility under legal standards like the Federal Rules of Evidence (FRE) 901. Without a proper chain of custody, the evidence can be challenged as inadmissible due to lack of trustworthiness.

Exam trap

EC-Council often tests the distinction between the chain of custody's documentation purpose and other forensic activities like analysis or security, so candidates mistakenly choose options that describe evidence handling steps (e.g., encryption or analysis) rather than the core legal documentation requirement.

How to eliminate wrong answers

Option B is wrong because reducing the size of evidence for easier storage is not a forensic goal; it would actually destroy or compress data, potentially losing critical metadata and violating the principle of maintaining evidence in its original state. Option C is wrong because analyzing evidence for hidden data is a separate investigative step (e.g., using tools like FTK or EnCase for steganography detection), not the purpose of the chain of custody, which is purely about documenting handling. Option D is wrong because encrypting evidence to prevent unauthorized access is a security measure, not a documentation process; encryption can even complicate chain of custody if the key is not properly managed, and the chain of custody itself does not involve cryptographic operations.

Practice this question →
66
MCQmedium

A forensic analyst is testifying as an expert witness in court. The opposing counsel challenges the analyst's testimony based on the Frye standard. What does the Frye standard require for scientific evidence to be admissible?

A.The evidence must have been obtained with a warrant.
B.The evidence must be relevant and more probative than prejudicial.
C.The evidence must have been peer-reviewed and published.
D.The evidence must be based on techniques generally accepted in the scientific community.
AnswerD

Frye focuses on general acceptance.

Why this answer

The Frye standard requires that scientific evidence be based on principles and methods that are generally accepted by the relevant scientific community.

Practice this question →
67
MCQeasy

Which of the following BEST describes the chain of custody in digital forensics?

A.The software tool used to image the hard drive.
B.A log of all personnel who have accessed the evidence, along with timestamps and reasons.
C.The process of encrypting evidence to prevent unauthorized access.
D.The physical lock and key used to secure the evidence locker.
AnswerB

This captures the essence of chain of custody.

Why this answer

Chain of custody is a documented record that tracks the seizure, custody, control, transfer, analysis, and disposition of evidence, ensuring its integrity and admissibility.

Practice this question →
68
MCQmedium

A first responder arrives at a suspected intrusion scene. A desktop computer is powered on and logged in. The user claims they saw suspicious files being copied to a USB drive. Which of the following should the first responder do FIRST?

A.Capture volatile data such as memory and running processes.
B.Power off the computer immediately to prevent further data loss.
C.Photograph the scene and document everything in a notebook.
D.Create a forensic image of the hard drive using a write blocker.
AnswerA

Volatile data (RAM, processes, network connections) is lost when power is removed, so it must be collected first.

Why this answer

The first priority is to preserve volatile data (e.g., memory, running processes) which may be lost if the system is powered off. Photographing the scene and documenting are important but come after securing volatile data.

Practice this question →
69
Multi-Selectmedium

Which TWO of the following are essential components of chain of custody documentation?

Select 2 answers
A.Every person who handled the evidence must sign and date the form
B.A detailed description of the evidence including make, model, and serial number
C.The forensic tool used to analyze the evidence
D.The evidence must be stored in a fireproof safe
E.The final analysis report
AnswersA, B

This documents the chain of custody.

Why this answer

Option A is correct because chain of custody documentation must record every individual who handled the evidence, along with their signature and the date/time of transfer, to establish an unbroken custody trail. This ensures the evidence's integrity and admissibility in court by demonstrating who had access at each stage.

Exam trap

EC-Council often tests the distinction between what belongs in chain of custody documentation versus what belongs in the forensic analysis report or security procedures, leading candidates to mistakenly include analysis tools or storage specifications.

Practice this question →
70
MCQeasy

What is the PRIMARY purpose of a chain of custody document in a forensic investigation?

A.To provide a chronological record of who handled the evidence, when, and why.
B.To document the tools used during the investigation.
C.To list all the files found on the suspect's computer.
D.To authorize the search and seizure of digital evidence.
AnswerA

This establishes the integrity and continuity of evidence from collection to court.

Why this answer

The chain of custody document is the foundational record that ensures evidence integrity and admissibility in court. Its primary purpose is to create a chronological, unbroken log of every person who handled the evidence, the exact time and date of each transfer, and the reason for the transfer. This directly supports the legal requirement to prove that the evidence has not been tampered with or altered from the moment of seizure to its presentation in court.

Exam trap

EC-Council often tests the distinction between the chain of custody (which tracks handling history) and the search warrant (which grants legal authority), causing candidates to mistakenly choose the authorization option.

How to eliminate wrong answers

Option B is wrong because documenting the tools used during the investigation is a separate activity, typically recorded in a forensic workstation log or case notes, not in the chain of custody form. Option C is wrong because listing files found on a suspect's computer is the output of forensic analysis (e.g., a file listing from a tool like FTK Imager or EnCase), not the purpose of the chain of custody document. Option D is wrong because authorization for search and seizure is obtained via a legal warrant or consent form, not through the chain of custody; the chain of custody begins after the evidence has been legally seized.

Practice this question →
71
MCQhard

An analyst performs forensic imaging using the command: dcfldd if=/dev/sda of=image.dd hash=sha256 hashlog=hash.txt bs=4096 conv=noerror,sync. What is the PRIMARY purpose of the 'hash=sha256' and 'hashlog=hash.txt' parameters?

A.To encrypt the image file to prevent unauthorized access.
B.To compress the image to save disk space.
C.To ensure the image is an exact bit-for-bit copy and provide an integrity check.
D.To split the image into smaller chunks for easier transport.
AnswerC

Hashing calculates a digital fingerprint. If the hash matches later, the image has not been altered.

Why this answer

The `hash=sha256` parameter instructs dcfldd to compute a SHA-256 hash of the input data as it is read, and `hashlog=hash.txt` writes that hash value to a separate file. This allows the analyst to later verify that the forensic image (`image.dd`) is an exact bit-for-bit copy of the source (`/dev/sda`) by recomputing the hash and comparing it to the stored value, ensuring data integrity and admissibility in court.

Exam trap

EC-Council often tests the distinction between hashing (integrity) and encryption (confidentiality), so the trap here is that candidates confuse the purpose of a hash algorithm with that of an encryption cipher, leading them to incorrectly select Option A.

How to eliminate wrong answers

Option A is wrong because hashing (SHA-256) is a one-way cryptographic function used for integrity verification, not encryption; it does not protect the image from unauthorized access. Option B is wrong because dcfldd does not compress data; the `conv=noerror,sync` parameter handles error recovery, and hashing adds no compression—disk space is not saved. Option D is wrong because dcfldd does not split the output into chunks; the `of=image.dd` writes a single contiguous file, and splitting would require additional parameters like `split=...` or a separate tool.

Practice this question →
72
MCQmedium

A forensic investigator uses the 'dd' command to create a forensic image. The original drive has a SHA-256 hash of a1b2c3... and the image produces the same hash. Which rule of evidence does this satisfy?

A.Reliability
B.Authenticity
C.Completeness
D.Admissibility
AnswerB

Authenticity verifies that the evidence has not been altered; identical hashes demonstrate integrity.

Why this answer

Authenticity means evidence is what it purports to be. Matching hashes confirms the image is an exact copy, thus authentic.

Practice this question →
73
MCQmedium

In the context of the UK Police and Criminal Evidence Act (PACE), which of the following is a key requirement for the admissibility of digital evidence?

A.The evidence must be stored on a write-protected medium
B.The evidence must be reviewed by an independent third party
C.The evidence must be encrypted at all times
D.The evidence must be obtained lawfully and without oppression
AnswerD

PACE emphasizes lawful acquisition and prohibits oppression to ensure evidence is admissible.

Why this answer

PACE requires that evidence is not obtained through oppression or in violation of legal procedures, ensuring reliability and fairness.

Practice this question →
74
MCQmedium

In the context of US Fourth Amendment protections, which of the following scenarios would likely require a search warrant for a forensic examiner to legally seize and analyze a computer?

A.The computer is located in a private residence and there is no exigent circumstance
B.The computer is in plain view in a public area and is suspected to contain evidence of a crime
C.The computer's owner gives voluntary consent to search the device
D.The computer is seized from a business during a regulatory inspection with statutory authority
AnswerA

Without consent, warrant, or exigency, seizing and searching a computer in a private home violates the Fourth Amendment.

Why this answer

The Fourth Amendment protects against unreasonable searches and seizures, and a computer located in a private residence generally falls under a heightened expectation of privacy. Without exigent circumstances (e.g., imminent destruction of evidence, hot pursuit), a forensic examiner must obtain a search warrant based on probable cause before seizing and analyzing the device. This ensures that the digital evidence is admissible under the exclusionary rule.

Exam trap

EC-Council often tests the misconception that 'plain view' in a public area automatically justifies seizure and forensic analysis of a computer, but the trap here is that plain view only allows seizure of the item itself, not a full forensic examination, which requires a separate warrant or exception.

How to eliminate wrong answers

Option B is wrong because the plain view doctrine applies only if the incriminating nature of the evidence is immediately apparent and the officer is lawfully present; however, a computer in plain view in a public area does not automatically authorize its seizure for forensic analysis—the Fourth Amendment still requires a warrant or an exception, and mere suspicion of evidence is insufficient. Option C is wrong because voluntary consent is a recognized exception to the warrant requirement; if the owner gives valid consent, a forensic examiner may legally seize and analyze the computer without a warrant. Option D is wrong because a regulatory inspection with statutory authority (e.g., OSHA, FDA) may allow seizure of business records under administrative warrants or specific statutes, but the computer itself is not automatically subject to forensic analysis without a warrant unless the inspection statute explicitly authorizes such searches and the scope is limited.

Practice this question →
75
MCQmedium

An investigator needs to acquire data from a suspect's hard drive without altering any data. Which tool is MOST appropriate to ensure write-blocking at the hardware level?

A.Tableau Forensic Bridge (hardware write-blocker)
B.FTK Imager (software write-blocker)
C.dd command with 'iflag=noatime'
D.EnCase software acquisition module
AnswerA

Tableau is a well-known hardware write-blocker that prevents any write operations to the drive.

Why this answer

A hardware write-blocker like the Tableau Forensic Bridge sits between the suspect drive and the forensic workstation at the physical layer, intercepting and blocking any write commands (e.g., ATA WRITE DMA, SCSI WRITE) before they reach the drive. This ensures that no data—including metadata, timestamps, or file system artifacts—is altered during acquisition, which is critical for maintaining evidentiary integrity. Software-based blockers can be bypassed by the OS or a malicious driver, making hardware-level blocking the gold standard in forensic acquisition.

Exam trap

EC-Council often tests the misconception that a software write-blocker (like FTK Imager’s built-in blocker) provides the same level of protection as a hardware write-blocker, when in fact only hardware-level blocking can prevent all write operations—including those from the OS, BIOS, or malicious firmware—from reaching the drive.

How to eliminate wrong answers

Option B (FTK Imager software write-blocker) is wrong because software write-blockers operate at the OS or driver level and can be circumvented by a compromised kernel, a buggy driver, or a direct hardware access command (e.g., via ATA passthrough), so they do not guarantee true hardware-level write protection. Option C (dd command with 'iflag=noatime') is wrong because 'iflag=noatime' only prevents the OS from updating access timestamps on the source file during a dd read, but it does not block write commands at the hardware interface—any write issued by the OS or a misconfigured tool could still reach the drive. Option D (EnCase software acquisition module) is wrong because, while EnCase can use a hardware write-blocker, its software acquisition module alone relies on the OS’s read-only mount or driver-level filtering, which is not a hardware-level write-block and can be overridden by direct disk writes or firmware commands.

Practice this question →
Page 1 of 3 · 155 questions totalNext →

Ready to test yourself?

Try a timed practice session using only Computer Forensics Fundamentals and Process questions.

Start 20-question session