CHFI Computer Forensics Fundamentals and Process Practice Question
In the context of e-discovery, which THREE of the following are key steps in the Electronic Discovery Reference Model (EDRM)? (Select THREE)
⚠ Common exam trap
The CHFI exam often tests the distinction between 'Preservation' and 'Collection' as separate steps, and candidates mistakenly think 'Investigation' or 'Prosecution' are part of the EDRM when they are actually post-discovery legal actions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Preservation
Preservation (A) is a core EDRM step that focuses on safeguarding potentially relevant electronically stored information (ESI) once a duty to preserve is triggered, preventing spoliation before collection occurs. Production (B) is the EDRM phase in which responsive, non-privileged ESI is delivered to the requesting party in an agreed-upon format, often with load files and metadata, completing the exchange. Collection (C) is the EDRM step that gathers the identified and preserved ESI using forensically sound methods so that its integrity and chain of custody are maintained for later processing and review. The other options do not belong: Prosecution (D) is a legal litigation activity, not an EDRM phase, and Investigation (E) is a general fact-finding process that is not one of the nine EDRM stages (Identification, Preservation, Collection, Processing, Review, Analysis, Production, Presentation, and Information Governance).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Preservation
Why this is correct
In the EDRM, preservation is the planned, proactive act of placing a litigation hold on all potentially relevant electronically stored information (ESI) once legal action is reasonably anticipated. It ensures that data remains intact and unaltered, thereby preventing spoliation and associated sanctions. Preservation is distinct from collection in that it imposes a legal duty to maintain the status quo, rather than performing the physical extraction of data.
- ✓
Production
Why this is correct
Production is the EDRM stage in which responsive, non-privileged data is formally delivered to the requesting party, typically in a negotiated format such as native files, TIFF images, or processed PDFs with extracted metadata. It requires rigorous quality checks, redaction of privileged content, and often a privilege log to identify withheld materials. This step completes the discovery obligation, and failure to produce in an appropriate format can result in motions to compel or exclusion of evidence.
- ✓
Collection
Why this is correct
Collection involves the forensically sound acquisition of potentially relevant ESI from identified sources, such as hard drives, email servers, cloud applications, or mobile devices, while maintaining the integrity of metadata and a defensible chain of custody. Practitioners use write-blockers, hash values, and audited copying methods to ensure the data is unaltered and admissible. Unlike preservation, which is a legal notice to hold, collection is the technical act of taking possession of the data itself.
- ✗
Prosecution
Why it's wrong here
Prosecution is a criminal-law concept referring to the formal charging and trying of a defendant by a government attorney, and it has no place in the EDRM framework. The EDRM is a civil litigation discovery workflow consisting of nine defined stages, from identification through presentation. Confusing prosecution with 'production' or even 'presentation' is a common mistake, but those steps are about disclosing or showing evidence in civil matters, not instituting a criminal case.
- ✗
Investigation
Why it's wrong here
Investigation is not a distinct stage in the EDRM; rather, its processes are subsumed under the 'analysis' step, where reviewers and attorneys examine collected data to identify responsive, privileged, and key evidence. In broader forensic practice, investigation is a holistic inquiry, but in EDRM, analysis specifically focuses on evaluating the logical and metadata context of ESI to support claims and defenses. The term is therefore excluded from the formal model to avoid overlap with the standardized discovery process.
Go deeper
Related to this question
Learn chapter
Legal and Ethical Issues in Digital Forensics
Key term
Chain of custody
Chain of custody is a documented process that tracks the handling, transfer, and possession of evidence or digital assets from the moment they are collected until they are presented in court or used in an investigation.
Key term
Evidence Admissibility
Evidence admissibility is the legal and technical standard that determines whether digital evidence can be used in a court of law.
About these practice questions
Courseiva writes every CHFI question from scratch — 745 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.