CHFI Computer Forensics Fundamentals and Process Practice Question

During an e-discovery process, a legal hold is issued. What is the PRIMARY purpose of a legal hold?

⚠ Common exam trap

EC-Council often tests the distinction between preservation (legal hold) and collection (imaging), so candidates mistakenly choose authorization for imaging because they conflate the forensic process with the legal obligation to preserve.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

To prevent the destruction or alteration of potentially relevant evidence

The primary purpose of a legal hold is to preserve all forms of potentially relevant evidence by suspending normal data retention and deletion policies. This ensures that data, including emails, documents, and logs, is not altered or destroyed during the e-discovery process, which is critical for maintaining the integrity of evidence for litigation.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
To authorize forensic examiners to image all company devices
Why it's wrong here
A legal hold is a preservation directive issued when litigation is reasonably anticipated; it does not by itself authorize forensic examiners to image devices. Imaging a company's entire device inventory would be overbroad, disproportionate, and typically requires independent legal authority such as a court order, subpoena, or the custodian's consent. The hold's purpose is to suspend routine deletion and prevent spoliation, not to grant investigative access.
✓
To prevent the destruction or alteration of potentially relevant evidence
Why this is correct
The core purpose of a legal hold is to ensure that potentially relevant electronically stored information (ESI) is preserved in place, preventing its destruction, alteration, or loss during the e-discovery process. It suspends normal document-retention and recycling schedules so that evidence remains intact and authentic for later collection and review. Failure to implement a proper hold can lead to spoliation and severe sanctions, including adverse inference instructions or case-dispositive penalties.
✗
To encrypt all data to prevent unauthorized access during litigation
Why it's wrong here
Encryption is a security control that protects data confidentiality and integrity, but it is not a requirement of a legal hold. The legal hold is focused on preservation—keeping data unchanged—not on restricting access via cryptographic measures. In fact, an uncoordinated encryption deployment during litigation could create discoverability problems, such as key management issues, and may even be viewed as an attempt to hide evidence if not handled transparently.
✗
To notify the opposing party of the intent to use electronic evidence
Why it's wrong here
Notifying the opposing party about intent to use electronic evidence is a separate discovery step, often accomplished through initial disclosures or a discovery plan, not through a legal hold. A legal hold is an internal communication to custodians and IT staff instructing them to retain potentially relevant ESI; it is not served on the adverse party. Confusing the two conflates the preserve obligation with the exchange of evidence, which are distinct phases of litigation.

Go deeper

CHFI Computer Forensics Fundamentals and Process Practice Question

Why each option matters

Option-by-option breakdown

Related to this question