CHFI Computer Forensics Fundamentals and Process Practice Question

Locard's exchange principle in digital forensics states that:

⚠ Common exam trap

EC-Council often tests whether candidates confuse procedural concepts (like chain of custody) with the foundational scientific principle of trace evidence transfer, leading them to pick Option A instead of D.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Every contact leaves a trace, and digital evidence is no exception

Locard's exchange principle, originally from forensic science, asserts that whenever two objects come into contact, a transfer of material occurs. In digital forensics, this translates to the fact that digital devices and systems inevitably leave traces of their interactions—such as log entries, metadata, file artifacts, or network packets—making it possible to reconstruct events. Option D correctly captures this core idea that every contact leaves a trace, and digital evidence is no exception.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The chain of custody must be documented for all evidence
Why it's wrong here
Chain of custody documentation is a foundational practice in forensic investigations to establish authenticity and admissibility of evidence, but it concerns legal provenance rather than the scientific principle of material exchange. Locard's exchange principle posits that whenever two objects interact, a transfer of microtraces occurs; in digital forensics, this maps to residual data left by system processes, file operations, or network communications. Thus, while chain of custody is critical, it is not the principle in question.
✗
Digital evidence is always stored in the cloud
Why it's wrong here
Digital evidence may reside on a variety of local media—hard disk drives, solid-state drives, USB devices, or volatile memory—and is not inherently cloud-based. Locard's principle in digital context focuses on the persistence of transactional artifacts (e.g., registries, prefetch files, or audit logs) created by device interaction, not on where data is stored. Therefore, this option misattributes the principle to storage architecture.
✗
Only the forensic examiner can handle evidence
Why it's wrong here
Forensic investigations often require multiple authorized personnel to handle evidence at various stages, such as collection, transport, and analysis, each following strict procedures. Locard's principle is about the inevitable transfer of trace material—like file system metadata or network connection logs—when contact occurs, not about restricting who may handle evidence. Thus, this option conflates access control with trace evidence dynamics.
✓
Every contact leaves a trace, and digital evidence is no exception
Why this is correct
This is a direct application of Locard's exchange principle to digital media: any interaction with a computer system—opening a file, sending an email, or connecting a peripheral—leaves persistent remnants such as file system timestamps, RAM fragments, or log entries. Even when a user attempts to delete data, copies may survive in slack space, unallocated sectors, or shadow copies, demonstrating that contact with digital evidence leaves traces. This principle underpins digital forensic methodologies for reconstructing user activity.

Go deeper

CHFI Computer Forensics Fundamentals and Process Practice Question

Why each option matters

Option-by-option breakdown

Related to this question