Locard's Exchange Principle in Digital Forensics — Digital Traces
According to Locard's exchange principle, which of the following is TRUE in a digital forensic context?
Quick Answer
The correct answer is that a suspect will always leave traces of their activity on a computer system. This is true because Locard's exchange principle in digital forensics holds that every interaction with a digital environment generates residual data, such as log entries, temporary files, metadata, or registry changes, which serve as digital traces of that contact. On the Computer Hacking Forensic Investigator CHFI exam, this principle tests your understanding that even sophisticated attackers cannot avoid leaving artifacts, making it foundational to forensic methodology. A common trap is assuming that deleting files or using anti-forensic tools erases all evidence, but the principle asserts that traces persist at some level—whether in unallocated space, memory dumps, or system logs. Remember the mnemonic: “Every contact leaves a contract with the disk,” meaning each action writes a record that a forensic examiner can recover.
⚠ Common exam trap
The CHFI exam often tests the misconception that Locard's principle only applies to physical evidence, leading candidates to incorrectly select Option B, when in fact the principle is universally applied to all forms of evidence, including digital.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A suspect will always leave traces of their activity on a computer system.
In a digital forensic context, Locard's exchange principle holds that whenever a suspect interacts with a computer system, they will inevitably leave traces of that activity. This can include artifacts such as registry entries, log files, prefetch files, browser history, or metadata, even if the user attempts to delete or obfuscate their actions. The principle underpins the entire field of digital forensics, asserting that digital interaction always produces residual data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A suspect will always leave traces of their activity on a computer system.
Why this is correct
Locard's principle implies that digital interactions leave residual data that can be recovered.
- ✗
Only physical evidence, not digital evidence, is subject to exchange.
Why it's wrong here
Locard's principle applies to both physical and digital evidence.
- ✗
Digital evidence is always volatile and cannot be preserved.
Why it's wrong here
Some digital evidence is volatile, but not all; Locard's principle does not address volatility.
- ✗
The absence of evidence proves the suspect is innocent.
Why it's wrong here
Absence of evidence does not prove innocence; evidence may be deleted or hidden.
Go deeper
Related to this question
Learn chapter
Overview of Computer Forensics and Investigation Process
Key term
FTK Imager
FTK Imager is a free forensic imaging tool used to create exact copies of computer drives and storage devices for digital evidence analysis.
Key term
Evidence Admissibility
Evidence admissibility is the legal and technical standard that determines whether digital evidence can be used in a court of law.
About these practice questions
This CHFI question is part of Courseiva's 205-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CHFI
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. According to Locard's exchange principle, which of the following is MOST relevant to digital forensics?
easy- A.The chain of custody must be maintained for all evidence
- ✓ B.When a person interacts with a digital device, they leave digital traces that can be recovered
- C.Every crime scene contains at least one latent fingerprint
- D.Digital evidence is always stored in non-volatile memory
Why B: Locard's exchange principle states that every contact leaves a trace. In digital forensics, this translates to the fact that when a person interacts with a digital device (e.g., opening a file, browsing a website, or typing a command), they leave digital traces such as log entries, metadata, temporary files, or registry artifacts. These traces can be recovered and analyzed to reconstruct user activity, making option B the most relevant application of the principle in this context.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.