CHFI Computer Forensics Investigation Process Practice Question
During a forensic investigation, an analyst discovers that the suspect's hard drive was encrypted using BitLocker. The analyst has obtained the recovery key. Which of the following is the best next step to ensure data integrity?
⚠ Common exam trap
EC-Council often tests the principle that forensic imaging must occur before any decryption or analysis to preserve evidence integrity, and candidates mistakenly believe decryption first is acceptable because they have the key.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a forensic image of the encrypted drive, then decrypt the image.
Creating a forensic image of the encrypted drive before decryption preserves the original evidence in its pristine, unaltered state. Decrypting the image later using the recovery key ensures that the original encrypted data remains intact and verifiable, maintaining data integrity throughout the investigation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Decrypt the drive using the recovery key and then create a forensic image.
Why it's wrong here
Applying the recovery key to decrypt the original drive in place is destructive from an evidentiary perspective: the controller performs writes that alter sector-level plaintext, encrypted metadata, filesystem journal, and access timestamps, contaminating the very evidence you must preserve. You also lose the pristine encrypted snapshot, which may be needed to prove how the encryption was configured, and any imaging afterward captures artifacts introduced by the decryption process. Always image the encrypted medium first and decrypt only a forensic clone.
- ✗
Run a live analysis tool to extract encryption keys from memory.
Why it's wrong here
Running a live tool to pull keys from memory can produce useful decryption credentials, but it does not produce a forensic image of the encrypted disk, and it involves executing code on the live system, changing memory state and potentially triggering anti-forensic or FDE lockdown routines. Even if key extraction succeeds, you still need a separate disk image to analyze user data; without an image, the keys are only a means to decrypt evidence you failed to collect. Volatile memory acquisition should be performed as a supplementary step — never as a substitute for imaging the disk.
- ✓
Create a forensic image of the encrypted drive, then decrypt the image.
Why this is correct
Creating a bit-for-bit forensic image of the encrypted drive before any decryption preserves the original evidence in its native state, capturing the full encrypted volume, partition table, free space, and deleted data remnants. The analyst can then decrypt that image on a write-protected or isolated forensic workstation using the known recovery key or extracted keys, leaving the original exhibit untouched and maintaining chain of custody. This workflow is the accepted standard for full-disk-encrypted evidence because it separates acquisition from decryption and permits multiple independent analyses.
- ✗
Boot the suspect computer and copy files to an external drive.
Why it's wrong here
Booting the suspect computer to copy files is a textbook contamination scenario: the boot process writes to the registry, prefetch, event logs, hibernation file, and filesystem metadata, and it can overwrite unallocated areas where deleted evidence resides. Manually copying selected files also snatches only active, visible data; you lose deleted files, slack space, and partition-level artifacts, creating an incomplete and legally indefensible evidentiary collection. The correct, non-invasive approach is to acquire a full disk image with the system powered off using a hardware write-blocker.
Go deeper
Related to this question
Learn chapter
Forensic Tools and Laboratory Setup
Key term
EnCase Forensic
EnCase Forensic is a digital forensics software suite used by investigators to acquire, analyze, and report on data from computers and mobile devices in a legally admissible way.
Key term
Evidence Admissibility
Evidence admissibility is the legal and technical standard that determines whether digital evidence can be used in a court of law.
About these practice questions
Courseiva writes every CHFI question from scratch — 745 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.