CHFI Computer Forensics Fundamentals and Process Practice Question
During an investigation, a forensic analyst must preserve a hard drive that is part of a RAID array. Which of the following is the MOST appropriate method to preserve the evidence?
⚠ Common exam trap
EC-Council often tests the misconception that imaging a logical volume or rebuilding the array is acceptable, but the trap here is that any operation that allows the RAID controller or OS to write to the drives (even during a read) can alter evidence, making individual physical imaging with a write blocker the only forensically sound method.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Image each physical drive individually using a write blocker
Imaging each physical drive individually with a write blocker preserves the exact bit-for-bit state of every disk in the RAID array, including metadata, parity, and superblock information. This approach ensures that the logical volume can be reconstructed later in a controlled environment without altering the original evidence, which is critical for maintaining chain of custody and forensic integrity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Power off the system and remove only the drive with the operating system
Why it's wrong here
Powering off and removing only the operating system drive is insufficient because in a hardware RAID array the OS and user data are striped or mirrored across every member disk; isolating one disk omits the stripe segments, parity blocks, and superblock metadata on the other disks that are required to reconstruct the logical volume. The remaining drives also contain unique RAID configuration information, journaling data, and unallocated space that would be lost, thus destroying evidence and preventing a verifiable reassembly of the original array.
- ✗
Disconnect all drives and image a logical volume after the RAID controller
Why it's wrong here
Disconnecting all drives and imaging the logical volume after the RAID controller is flawed because the controller mediates every read and may write its own cache, dirty-page flushes, or metadata updates during access, altering the source state. It also fails to preserve each physical disk's individual free space, hidden sectors, and RAID-specific metadata (e.g., disk order, chunk size, parity rotation), so deleted files and evidence remnants on member disks are never captured. Forensic soundness demands acquiring each physical drive directly with a write blocker rather than a logical abstraction.
- ✓
Image each physical drive individually using a write blocker
Why this is correct
Imaging each physical drive individually with a write blocker is the correct forensic method because it guarantees that no write operations reach the source disks, allowing a true bit-for-bit copy of every member, including unallocated space, deleted metadata, and RAID configuration data. With complete images of all drives, the array can be reconstructed offline in a controlled environment using tools like mdadm or specialist RAID recovery software, preserving the original order and stripe parameters. This maintains chain of custody and enables repeatable analysis without modifying evidence.
- ✗
Rebuild the array in a different system and then image
Why it's wrong here
Rebuilding the array in a different system and then imaging it is unacceptable because the RAID controller will reconstruct or regenerate data, writing parity, updating membership metadata, and potentially overwriting stale or degraded disk contents in the process, thereby mutating the original evidence. The rebuild process also assumes the new controller's parameters match the original, which is rarely true, causing misinterpretation of drive order or stripe layout. Such reconstruction is an alteration, not preservation, and destroys the very artifacts that forensic tools need to validate the image.
Quick reference
RAID Level Comparison
| RAID Level | Min Disks | Fault Tolerance | Read | Write | Usable Capacity |
|---|---|---|---|---|---|
| RAID 0 | 2 | None | Excellent | Excellent | 100% |
| RAID 1 | 2 | 1 disk | Good | Moderate | 50% |
| RAID 5 | 3 | 1 disk | Good | Moderate | 67–94% |
| RAID 6 | 4 | 2 disks | Good | Lower | 50–88% |
| RAID 10 | 4 | 1 disk per mirror | Excellent | Good | 50% |
RAID is not a backup strategy — it protects against disk failure but not against accidental deletion, ransomware, or site-level events.
Go deeper
Related to this question
Learn chapter
Overview of Computer Forensics and Investigation Process
Key term
EnCase Forensic
EnCase Forensic is a digital forensics software suite used by investigators to acquire, analyze, and report on data from computers and mobile devices in a legally admissible way.
Key term
Evidence Admissibility
Evidence admissibility is the legal and technical standard that determines whether digital evidence can be used in a court of law.
About these practice questions
Courseiva writes every CHFI question from scratch — 205 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.