Courseiva

CCNA Chfi Fundamentals Process Questions

75 of 128 questions · Page 1/2 · Chfi Fundamentals Process topic · Answers revealed

Practice these questionsExam hubAll questions
1
MCQhard

An organization receives a legal hold notice regarding a pending lawsuit. The IT department is instructed to preserve all relevant electronically stored information (ESI). Which of the following actions must be taken FIRST?

A.Perform a full forensic analysis of all systems
B.Notify all employees to delete personal files
C.Immediately suspend any automated data deletion policies
D.Delete all emails older than 30 days to reduce storage
AnswerC

Automated data deletion policies—such as email retention schedules, log rotation, or scripted file cleanup—can irretrievably destroy ESI that is subject to the legal hold, often without human intervention. Immediately suspending those routines stops the clock and preserves the current state of all potentially relevant data, which is the foundational step of a valid litigation hold. This suspension should be documented and disseminated to IT staff to prevent any scheduled jobs from running overnight or at the next backup cycle.

Why this answer

When a legal hold notice is issued, the first priority is to preserve all potentially relevant ESI by immediately suspending any automated data deletion policies (e.g., retention schedules, auto-archiving, or purge scripts). This prevents spoliation of evidence before any collection or analysis begins. Failure to do so could result in sanctions for destroying discoverable data.

Exam trap

EC-Council often tests the misconception that forensic analysis or data collection should be the immediate step, when in fact the legal hold requires first stopping any automated destruction mechanisms to preserve the current state of ESI.

How to eliminate wrong answers

Option A is wrong because a full forensic analysis is a later step in the e-discovery process, not the first action; performing it prematurely could alter data or waste resources before the scope of preservation is defined. Option B is wrong because notifying employees to delete personal files contradicts the legal hold's purpose and could be construed as intentional spoliation; employees should be instructed to preserve all potentially relevant data, not delete anything. Option D is wrong because deleting emails older than 30 days would destroy potentially relevant evidence and directly violate the duty to preserve ESI under the legal hold.

Practice this question →
2
Multi-Selecthard

Which THREE of the following are steps in the forensic investigation process? (Select three.)

Select 3 answers
A.Analysis
B.Sentencing
C.Reporting
D.First response
E.Deletion of irrelevant data
AnswersA, C, D

Analysis is the systematic examination of digital evidence after acquisition, where the investigator correlates data, recovers deleted artifacts, validates hash values, and tests hypotheses to reconstruct the incident. In the forensic process, this phase transforms raw data into actionable intelligence, applying techniques like keyword searching, timeline analysis, and file signature verification. It is a core investigative step, distinct from later reporting, because its output forms the evidentiary basis for conclusions.

Why this answer

In the forensic investigation process, First response (D) is the initial step where the investigator secures the scene, preserves volatile evidence, and documents the state of systems to prevent contamination. Analysis (A) follows, where the collected data is examined using validated tools and techniques to reconstruct events and identify artifacts relevant to the incident. Reporting (C) is the final phase, where findings, methods, and conclusions are documented in a clear, defensible manner suitable for legal or administrative proceedings.

Sentencing (B) is a judicial action that occurs after a trial, not part of the forensic investigation itself, and Deletion of irrelevant data (E) is not a recognized step—forensic examiners preserve all potential evidence and may filter for relevance during analysis, but never delete data as part of the process.

Exam trap

EC-Council often tests the distinction between the forensic investigation process and the broader legal or judicial process, leading candidates to mistakenly include post-investigation actions like sentencing as a forensic step.

Practice this question →
3
MCQmedium

A security analyst arrives at a suspected computer crime scene. The computer is on and a user is logged in. The analyst needs to preserve volatile data. According to first responder duties, what should the analyst do FIRST?

A.Immediately unplug the power cord to prevent data alteration
B.Create a forensic image of the hard drive using a write blocker
C.Photograph the scene and document everything
D.Capture volatile data such as running processes and network connections
AnswerD

Volatile data must be captured before powering off because it is lost when the system loses power.

Why this answer

The first responder's priority is to preserve volatile data, which is lost when the system is powered off. Volatile data includes running processes, network connections, and memory contents, which must be captured before any other action. This aligns with the order of volatility (RFC 3227) and standard forensic procedures.

Exam trap

The CHFI exam often tests the misconception that preserving the hard drive (Option A or B) is the top priority, but the trap is that volatile data is more fragile and must be captured first to avoid losing critical evidence like active network connections or malware in memory.

How to eliminate wrong answers

Option A is wrong because immediately unplugging the power cord destroys volatile data in RAM and active network connections, violating the order of volatility. Option B is wrong because creating a forensic image of the hard drive is a non-volatile data acquisition step that should occur after volatile data capture, and using a write blocker is irrelevant for volatile data. Option C is wrong because while photographing and documenting the scene is important, it is not the first action; volatile data must be captured immediately before it is lost.

Practice this question →
4
MCQmedium

A first responder arrives at a scene where a computer is suspected to contain evidence of fraud. The computer is turned on and a file is open. Which of the following actions should the responder AVOID?

A.Photographing the screen and documenting open windows.
B.Double-clicking the open file to fully view its contents.
C.Noting the time and date from the system clock.
D.Using a hardware write blocker to image the hard drive after shutdown.
AnswerB

Double-clicking the open file is a direct violation of forensic preservation principles. The OS will update the file's last-accessed timestamp, and potentially its last-modified metadata, while the associated application may spawn temporary files, alter the file's content, or trigger network activity. Any such change destroys the original state and taints the evidence, making later analysis and court presentation unreliable.

Why this answer

Double-clicking the open file alters its last accessed timestamp and may modify file metadata (e.g., NTFS $STANDARD_INFORMATION or $FILE_NAME attributes), potentially destroying volatile evidence. It also risks executing malicious code or changing the file's content if the application auto-saves. The first responder must preserve the current state and capture a forensic image before any interaction with active data.

Exam trap

The CHFI exam often tests the misconception that 'viewing' an open file is harmless, when in fact any interaction with the file system (even a double-click) changes metadata and risks evidence spoliation.

How to eliminate wrong answers

Option A is wrong because photographing the screen and documenting open windows is a standard first step to capture volatile evidence (e.g., running processes, open files) without altering the system state. Option C is wrong because noting the time and date from the system clock is essential for establishing a timeline and comparing against network logs or other sources; it does not modify evidence. Option D is wrong because using a hardware write blocker to image the hard drive after a controlled shutdown is a proper forensic procedure that preserves the integrity of the storage media.

Practice this question →
5
MCQmedium

A forensic examiner needs to verify the integrity of a forensic image after acquisition. Which of the following methods is the MOST reliable for ensuring the image has not been altered?

A.Opening the image in a hex editor and visually inspecting the first few bytes.
B.Using the 'dir' command to list files and compare timestamps.
C.Calculating and comparing hash values (e.g., MD5 or SHA-1) of the original and the image.
D.Comparing file sizes of the original drive and the image.
AnswerC

Calculating and comparing cryptographic hash values (e.g., MD5 or SHA-1) is the forensic standard for verifying that an acquired image is bit-for-bit identical to the original source. A hash function processes the entire data stream and produces a fixed-size digest; any change to even a single bit in the source will produce a drastically different hash value. This provides strong assurance of integrity (though not authenticity) and is the accepted method in forensic imaging tools such as FTK Imager, EnCase, and dd with hash options.

Why this answer

Cryptographic hash functions like MD5 or SHA-1 produce a fixed-size digest that is uniquely tied to the data content. By comparing the hash of the original drive (or its bit-for-bit copy) with the hash of the forensic image, any single bit change in the image will result in a completely different hash value, providing mathematically strong integrity verification. This is the standard method recommended in forensic best practices (e.g., NIST SP 800-86) and is far more reliable than any metadata or size comparison.

Exam trap

The CHFI exam often tests the misconception that file metadata or size comparisons are sufficient for integrity verification, when in fact only cryptographic hashing provides content-level assurance against tampering.

How to eliminate wrong answers

Option A is wrong because visually inspecting the first few bytes in a hex editor only checks a tiny fraction of the data; any alteration elsewhere in the image would go undetected. Option B is wrong because the 'dir' command lists file metadata (names, timestamps, sizes) from the filesystem, which does not verify the underlying raw data integrity; timestamps can be modified without changing the actual file content, and the command does not examine unallocated space or slack space. Option D is wrong because comparing file sizes only ensures the total byte count matches; an attacker could replace data with different content of the same size (e.g., swapping files or padding data) without changing the size, so size alone provides no cryptographic assurance.

Practice this question →
6
MCQmedium

During a forensic investigation, an analyst uses a hardware write blocker to connect a suspect hard drive to a forensic workstation. What is the primary purpose of using a hardware write blocker?

A.To prevent the operating system from writing to the source drive
B.To speed up the data transfer rate during imaging
C.To compress the forensic image to save storage space
D.To automatically hash the drive contents for integrity verification
AnswerA

A hardware write blocker is an inline forensic bridge that sits between the source drive and the host system, filtering every ATA/SCSI command. It permits read requests to reach the drive while silently discarding or blocking write commands, so the operating system cannot modify file metadata, timestamps, directory entries, or any other data. This read-only enforcement at the physical interface level is the fundamental legal and technical guarantee of evidence preservation during acquisition.

Why this answer

A hardware write blocker physically intercepts the write commands from the forensic workstation to the suspect drive, ensuring that no data can be altered on the source drive during acquisition. This preserves the evidentiary integrity of the original media, which is a foundational requirement in digital forensics to maintain a chain of custody and admissibility in court.

Exam trap

The trap here is that candidates often confuse the purpose of a write blocker with other forensic tools or features, such as hashing or compression, which are separate software functions, not hardware-level protections.

How to eliminate wrong answers

Option B is wrong because hardware write blockers do not speed up data transfer rates; they may even introduce a slight latency due to the bridge circuitry. Option C is wrong because compression of the forensic image is a software feature (e.g., EnCase or FTK Imager options), not a function of a hardware write blocker. Option D is wrong because hashing for integrity verification is performed by imaging software (e.g., using MD5 or SHA-1) after acquisition, not by the hardware write blocker itself.

Practice this question →
7
MCQmedium

A first responder arrives at a suspected data breach scene. The system is powered on and a user is logged in. Which of the following actions should the responder take FIRST to preserve volatile data?

A.Document the scene and take photographs, then proceed to interview witnesses.
B.Immediately disconnect the network cable and power off the computer.
C.Collect volatile data such as RAM, network connections, and running processes using appropriate tools.
D.Use a hardware write-blocker to create a forensic image of the hard drive.
AnswerC

This is the correct first step because the order of volatility dictates that data stored in memory and system state is the most short-lived and must be captured before any other activity. Using forensic tools such as a memory acquisition utility (e.g., DumpIt, win32dd, or LiME), netstat for active connections, and ps/tasklist for running processes preserves the live view of the incident. This collection must be performed on the running system, and all tool binaries should be loaded from a trusted read-only medium to avoid altering the very evidence being gathered.

Why this answer

Volatile data (RAM, network connections, running processes) is lost when power is removed. The first responder must capture this data using tools like FTK Imager, WinPmem, or netstat before any shutdown or disconnection. This aligns with the order of volatility (RFC 3227), which prioritizes memory and network state over disk imaging.

Exam trap

The EC-Council CHFI exam often tests the misconception that immediate power-off or network disconnection is the safest first step, but the trap is that this destroys volatile data critical for proving the attack timeline and identifying the attacker's tools.

How to eliminate wrong answers

Option A is wrong because documentation and witness interviews, while important, do not preserve volatile data that will be lost if the system is powered down or the network state changes. Option B is wrong because immediately disconnecting the network cable and powering off the computer destroys volatile data (RAM, network connections, running processes) and may also trigger anti-forensic mechanisms or encryption key loss. Option D is wrong because using a hardware write-blocker to image the hard drive is a non-volatile data acquisition step that should occur after volatile data collection, not first.

Practice this question →
8
Multi-Selectmedium

Which TWO of the following are essential steps that a first responder should take when arriving at a digital crime scene? (Select TWO)

Select 2 answers
A.Capture volatile data from running systems
B.Immediately start the forensic imaging process
C.Install forensic software on the suspect's computer
D.Interview all witnesses without documentation
E.Photograph and document the scene
AnswersA, E

Volatile data resides only in memory and other transient system states that vanish when the system loses power; capturing it first is imperative. As a first responder, collect RAM contents, active network connections, and running processes before powering down, using trusted forensic utilities from external media. This preserves ephemeral evidence such as encryption keys, attacker command lines, and in-memory malware that would otherwise be permanently lost.

Why this answer

Option A is correct because volatile data such as RAM contents, running processes, network connections, and open files will be lost on shutdown or reboot, so a first responder must capture it using tools like memory dumps or live-response utilities before powering down the system. Option E is correct because photographing and documenting the scene preserves the original state and chain of custody, recording the physical layout, cable connections, and system status before any evidence is altered. Option B is not an essential first-responder step because forensic imaging is typically performed later by a forensic examiner after volatile data is secured and the scene is documented, and imaging a running system prematurely can destroy volatile evidence.

Option C is wrong because installing software on the suspect's computer modifies the system and contaminates evidence, violating the principle of least intrusion. Option D is wrong because witness interviews must be documented to maintain an accurate and admissible record; undocumented interviews are unreliable and not an essential first-responder action.

Exam trap

EC-Council often tests the misconception that imaging the hard drive is the first priority, but the trap here is that volatile data (RAM, network state) must be captured first to prevent permanent loss.

Practice this question →
9
MCQmedium

During a forensic examination of a Windows system, the investigator finds a file named 'notes.txt' that contains a list of passwords. The file's last modified timestamp is before the incident date, but its last accessed timestamp is during the incident. Which type of evidence is this file considered?

A.Circumstantial evidence
B.Best evidence
C.Hearsay evidence
D.Direct evidence
AnswerA

Circumstantial evidence: The access timestamp is circumstantial because it only supports an inference that the file was opened or read, without directly proving who performed the action or under what circumstances. Other processes—such as antivirus scans, Windows Search indexing, or backup software—can update the Last Access Time without any user actually opening the file. Thus, the timestamp alone requires additional corroboration to establish a fact, making it inherently indirect and therefore circumstantial evidence.

Why this answer

The file 'notes.txt' has a last modified timestamp before the incident but a last accessed timestamp during the incident. This indicates the file was opened or read during the incident, but not modified. Such indirect evidence suggests the attacker may have viewed the passwords, but does not directly prove the act of using them.

Therefore, it is circumstantial evidence because it requires inference to connect the file access to the incident.

Exam trap

EC-Council often tests the distinction between direct and circumstantial evidence by presenting timestamp data that shows access without modification, leading candidates to mistakenly classify it as direct evidence because they assume 'accessed during incident' equals 'used in the incident'.

How to eliminate wrong answers

Option B (Best evidence) is wrong because best evidence refers to the original or primary source of evidence (e.g., the original file on disk), not the type of inference drawn from timestamps. Option C (Hearsay evidence) is wrong because hearsay applies to out-of-court statements offered for their truth, not to file system metadata like timestamps. Option D (Direct evidence) is wrong because direct evidence would prove a fact without inference (e.g., a video of the attacker typing the passwords), whereas the timestamp only shows access, not the action of using the passwords.

Practice this question →
10
MCQmedium

A forensic investigator is required to testify in court about the findings of a digital investigation. Which of the following roles does the investigator fulfill?

A.Expert witness
B.Lay witness
C.Character witness
D.Fact witness
AnswerA

An expert witness is permitted to offer opinion testimony under Federal Rule of Evidence 702 if their scientific, technical, or other specialized knowledge will help the trier of fact understand the evidence. A forensic investigator testifying about digital evidence analysis qualifies because they apply accepted forensic methodologies like write-blocking, hashing, and timeline analysis to form conclusions. The court recognizes the investigator's expertise and allows them to opine on the significance of the evidence, making this the correct classification.

Why this answer

A is correct because a forensic investigator who testifies about their analysis and conclusions—such as interpreting file system artifacts, registry data, or network logs—qualifies as an expert witness under Federal Rule of Evidence 702. The investigator’s testimony goes beyond mere fact recitation; it applies specialized knowledge, training, and experience to form opinions about the digital evidence, which is the hallmark of an expert witness.

Exam trap

The trap here is that candidates confuse 'fact witness' with 'expert witness,' assuming that any testimony about digital evidence is factual, but the key distinction is whether the testimony involves opinion or interpretation based on specialized knowledge—if it does, the investigator is an expert witness.

How to eliminate wrong answers

Option B is wrong because a lay witness can only testify to facts within their personal knowledge (e.g., 'I saw the suspect at the computer'), not to technical interpretations or conclusions derived from forensic analysis. Option C is wrong because a character witness testifies about a person’s reputation or moral traits, not about digital evidence or investigative findings. Option D is wrong because a fact witness (also called a percipient witness) merely recounts what they directly observed or experienced, without offering expert opinions or technical analysis of forensic data.

Practice this question →
11
MCQmedium

Which of the following tools is specifically designed for forensic imaging and can create compressed, segmented, or E01 format images?

A.dd
B.Nmap
C.FTK Imager
D.Wireshark
AnswerC

FTK Imager is a GUI-based forensic imaging tool from AccessData (now Exterro) specifically built for lawful evidence acquisition. It natively supports acquisition in multiple formats, including raw (DD), E01 (Expert Witness), and the AFF format, and allows compression and segmentation of images for practical storage and transfer. The tool also generates MD5 and SHA1 hashes for integrity verification, supports read-only mounting of images for analysis, and is widely accepted in courts as a forensically sound imaging platform.

Why this answer

FTK Imager is specifically designed for forensic imaging and supports creating compressed, segmented, and E01 (Expert Witness Format) images. Unlike generic tools, it provides a GUI and built-in validation (e.g., MD5/SHA1 hashing) tailored for forensic acquisition, making it the correct choice for this question.

Exam trap

The trap here is that candidates often confuse dd's ability to create raw images with forensic imaging capabilities, overlooking that dd lacks native support for compression, segmentation, and E01 format, which are hallmarks of dedicated forensic tools like FTK Imager.

How to eliminate wrong answers

Option A is wrong because dd is a Unix/Linux command-line tool for bit-for-bit copying, but it does not natively support compressed, segmented, or E01 format images without additional wrappers or scripts. Option B is wrong because Nmap is a network scanning tool used for port discovery and service enumeration, not for forensic imaging. Option D is wrong because Wireshark is a network protocol analyzer used for packet capture and analysis, not for creating forensic disk images.

Practice this question →
12
MCQhard

An organization receives a litigation hold notice regarding an ongoing lawsuit. The IT administrator is instructed to preserve all relevant electronic records. Which of the following actions is MOST consistent with proper legal hold implementation?

A.Reboot all servers to ensure they are running the latest patches.
B.Immediately delete all emails older than 90 days to reduce data volume.
C.Place a hold on all data that may be relevant by suspending routine deletion and notifying custodians.
D.Encrypt all data and change access passwords to prevent unauthorized access.
AnswerC

The correct first step is to issue legal hold notices and suspend all routine deletion, retention-policy enforcement, and any automated purging processes for data that could plausibly relate to the litigation. This ensures the organization preserves electronically stored information (ESI) in its current form, maintains a defensible preservation process, and places custodians on notice of their obligation not to alter or destroy relevant data. A comprehensive litigation hold must also involve forensically preserving the data and identifying all sources (email, documents, databases, cloud systems) to satisfy discovery obligations.

Why this answer

A litigation hold (also known as a legal hold) requires suspending routine data deletion and preservation of potentially relevant electronically stored information (ESI). The IT administrator must notify custodians and implement a hold that prevents automated purging (e.g., via retention policies in Exchange or file servers) to comply with the duty to preserve evidence under FRCP Rule 37(e).

Exam trap

The CHFI exam often tests the misconception that data preservation means securing data through encryption or access control, rather than the core requirement of suspending deletion and notifying custodians to prevent spoliation.

How to eliminate wrong answers

Option A is wrong because rebooting servers for patching is a routine maintenance action that does not preserve data and could alter system state or logs, potentially spolating evidence. Option B is wrong because deleting emails older than 90 days violates the preservation obligation by destroying potentially relevant ESI, which could lead to spoliation sanctions. Option D is wrong because encrypting all data and changing passwords may render evidence inaccessible to forensic examiners and legal teams, and does not ensure preservation of the original data in a forensically sound manner.

Practice this question →
13
MCQhard

A forensic examiner is presented with evidence that a suspect's computer was used to commit a fraud. The defense argues that the evidence was obtained without a warrant. Which US Constitutional Amendment is MOST relevant to this argument?

A.Fourth Amendment
B.First Amendment
C.Sixth Amendment
D.Fifth Amendment
AnswerA

The Fourth Amendment prohibits unreasonable searches and seizures and mandates that warrants issue only upon probable cause, describing the place to be searched and items to be seized. In a forensic context, evidence obtained through a warrantless or warrant-invalid search is subject to suppression under the exclusionary rule. Consequently, the Fourth Amendment is the precise constitutional provision that determines whether the defendant's evidence is legally admissible despite potential exceptions such as inevitable discovery.

Why this answer

The Fourth Amendment protects against unreasonable searches and seizures and requires warrants supported by probable cause.

Practice this question →
14
MCQmedium

A forensic analyst is creating a forensic image of a suspect's hard drive using a write blocker. Which of the following BEST describes the purpose of using a hardware write blocker?

A.To ensure that no data is written to the source drive during imaging
B.To increase the speed of data acquisition
C.To encrypt the forensic image for secure storage
D.To allow the suspect drive to be booted without altering data
AnswerA

A hardware write blocker sits between the suspect drive and the forensic workstation, intercepting every ATA/SCSI/NVMe command and allowing only read-only commands (e.g., READ SECTOR, IDENTIFY) to pass through while suppressing destructive commands like WRITE and DELETE. This preserves the bit-for-bit original state, so hash values calculated on the source remain valid and the evidence is admissible in court.

Why this answer

A hardware write blocker is a device placed between the suspect drive and the forensic workstation that intercepts and blocks any write commands from the operating system or imaging software. Its primary purpose is to guarantee that the source drive remains completely unaltered during acquisition, preserving the integrity of the evidence for legal and forensic purposes. This is achieved by allowing only read commands to pass through, while all write commands are physically or logically blocked at the hardware level.

Exam trap

The CHFI exam often tests the misconception that a write blocker's purpose is to protect the destination drive or to speed up imaging, rather than its core function of write-protecting the source drive to maintain forensic integrity.

How to eliminate wrong answers

Option B is wrong because a write blocker does not increase acquisition speed; in fact, it may introduce a slight overhead due to command filtering and does not affect the transfer rate of the drive interface. Option C is wrong because encryption of the forensic image is a separate process performed by imaging software (e.g., FTK Imager, dd with encryption) or hardware encryptors, not by a write blocker. Option D is wrong because booting a suspect drive would inherently write temporary system files, logs, and swap data to the drive, which a write blocker is designed to prevent; a write blocker cannot allow booting without altering data because the operating system must write to the drive during boot.

Practice this question →
15
MCQmedium

During a forensic investigation, an analyst uses a hardware write blocker to connect a suspect hard drive to a forensic workstation. Which of the following is the PRIMARY reason for using a write blocker?

A.To allow the suspect drive to be mounted as read-write for analysis
B.To decrypt the drive automatically without the key
C.To prevent any modification to the suspect drive during acquisition
D.To speed up the imaging process by caching writes
AnswerC

A hardware write blocker intercepts and blocks write commands at the interface level, so the drive remains unaltered while the analyst images it. This preserves evidential integrity, satisfying the forensic requirement that acquisition never modify the suspect drive's original content.

Why this answer

The primary reason for using a hardware write blocker is to ensure that the suspect drive is connected in a read-only manner, preventing any write operations from the forensic workstation from reaching the drive. This preserves the integrity of the evidence by guaranteeing that no data is altered, added, or deleted during the acquisition process, which is a fundamental requirement for admissibility in legal proceedings.

Exam trap

EC-Council often tests the misconception that write blockers are used to speed up imaging or that they provide some form of decryption, when in fact their sole purpose is write prevention for evidence integrity.

How to eliminate wrong answers

Option A is wrong because a write blocker forces the drive to be read-only, not read-write; mounting as read-write would risk modifying evidence. Option B is wrong because write blockers do not perform decryption; they only block write commands at the hardware level and have no capability to decrypt drives without the key. Option D is wrong because write blockers do not cache writes or speed up imaging; in fact, they add a slight overhead by intercepting and blocking write commands, and caching writes would contradict the goal of preventing modification.

Practice this question →
16
MCQmedium

During a forensic investigation, an analyst creates a forensic image using `dcfldd` with the command: `dcfldd if=/dev/sda of=image.dd hash=sha256 hashwindow=10M`. What is the purpose of the `hashwindow` parameter?

A.It limits the total amount of data to hash to 10 MB
B.It creates a hash for every 10 MB block of data
C.It sets the hash algorithm to SHA-256
D.It enables error correction for every 10 MB
AnswerB

With `hashwindow=10M`, dcfldd computes an independent hash value for every 10 MB block of input, allowing the analyst to verify each segment individually rather than relying solely on a single whole-file digest. This block-wise hashing is crucial for large forensic images because it pinpoints exactly which 10 MB region has changed or become corrupted, enabling targeted re-acquisition or analysis. It does not alter the total data processed, and the root hash over the entire stream may still be generated simultaneously if requested.

Why this answer

The `hashwindow` parameter in `dcfldd` specifies the size of the data chunks for which individual hash values are computed. With `hashwindow=10M`, the tool generates a SHA-256 hash for every 10 MB block of the input data, allowing verification of integrity on a per-block basis rather than only a single hash for the entire image. This is useful for detecting corruption or tampering in specific segments of large forensic images.

Exam trap

EC-Council often tests the distinction between parameters that set the hash algorithm (`hash=`) versus those that control hash granularity (`hashwindow`), leading candidates to confuse `hashwindow` with limiting the total data or enabling error correction.

How to eliminate wrong answers

Option A is wrong because `hashwindow` does not limit the total amount of data to hash; it defines the block size for per-block hashing, and the entire input is still processed. Option C is wrong because the hash algorithm is set by the `hash=sha256` parameter, not by `hashwindow`. Option D is wrong because `hashwindow` does not enable error correction; it only controls the granularity of hash computation, and `dcfldd` does not provide built-in error correction for data blocks.

Practice this question →
17
MCQeasy

A first responder arrives at a crime scene where a computer is running. According to standard forensic procedure, what should the responder do FIRST?

A.Photograph the scene and secure the area
B.Connect a write blocker and create a forensic image immediately
C.Immediately shut down the computer to prevent data alteration
D.Pull the power cord to ensure the system does not shut down normally
AnswerA

Documenting the scene through photographs and establishing a secure perimeter is the mandatory first step in digital forensics, as it creates a verifiable record of the original state of the computer, cables, and peripherals before any interaction. Securing the area prevents unauthorized personnel from touching the machine, which could alter timestamps, memory contents, or other volatile evidence. This step also grounds the chain of custody by showing exactly what was present when first responders arrived, and it should precede any hardware or software actions on the system.

Why this answer

The first priority at a live crime scene is to preserve the integrity of the scene and all potential evidence. Standard forensic procedure (e.g., from NIST SP 800-86 and ACPO guidelines) mandates that the first responder must photograph the scene to document the state of the computer (including screen contents, cables, and peripherals) and secure the area to prevent unauthorized access or tampering. Only after this documentation and scene stabilization can the responder proceed to handle the live system, such as capturing volatile data or creating a forensic image.

Exam trap

The trap here is that candidates often confuse the urgency of preserving volatile data with the need to immediately perform a live acquisition or shut down the system, forgetting that scene documentation and security are the foundational first steps in any forensic investigation.

How to eliminate wrong answers

Option B is wrong because connecting a write blocker and creating a forensic image immediately is a later step in the forensic process; the first responder must first document the scene and secure it to preserve the chain of custody and prevent evidence contamination. Option C is wrong because immediately shutting down the computer can destroy volatile data (e.g., RAM contents, network connections, running processes) and may trigger anti-forensic mechanisms or cause file system corruption; proper live acquisition should be performed first if the system is running. Option D is wrong because pulling the power cord (hard power-off) can cause data loss, file system corruption, and loss of volatile memory, and it bypasses the need to document the system state and capture live data; it should only be considered as a last resort when the system is actively being used to destroy evidence.

Practice this question →
18
MCQmedium

A forensic investigator is documenting evidence for a case. What is the PRIMARY purpose of maintaining an unbroken chain of custody for digital evidence?

A.To track the storage location of the evidence.
B.To prove that the evidence has not been altered or tampered with.
C.To speed up the investigation process.
D.To assign responsibility for the evidence to a single individual.
AnswerB

An unbroken chain of custody records every transfer, handler and storage location of the evidence from seizure to court. This documentation proves the evidence has not been altered or tampered with, satisfying the requirement to demonstrate its integrity and admissibility throughout the investigation.

Why this answer

The primary purpose of maintaining an unbroken chain of custody is to establish the integrity and authenticity of digital evidence by documenting every person who handled it, every transfer, and every access event. This documentation allows the court to verify that the evidence has not been altered, tampered with, or corrupted from the moment of seizure through analysis and presentation. Without a provable chain of custody, the evidence may be deemed inadmissible under rules like Federal Rule of Evidence 901 or similar standards in other jurisdictions.

Exam trap

EC-Council often tests the distinction between the operational benefit (tracking location) and the legal purpose (proving integrity), so candidates mistakenly choose Option A because they focus on the logistical aspect rather than the evidentiary admissibility requirement.

How to eliminate wrong answers

Option A is wrong because tracking the storage location is only a secondary benefit of chain-of-custody documentation, not its primary legal purpose; the core goal is to prove integrity, not merely to log physical or logical locations. Option C is wrong because maintaining a rigorous chain of custody often slows down the investigation process due to required documentation, logging, and verification steps; it is designed for legal admissibility, not speed. Option D is wrong because chain of custody does not assign responsibility to a single individual; it documents every individual who handled the evidence, ensuring multiple points of accountability and preventing a single point of failure or bias.

Practice this question →
19
MCQeasy

A first responder arrives at a scene where a computer is turned on and a user is logged in. What is the FIRST action the responder should take to preserve volatile evidence?

A.Photograph the screen and then shut down the system normally
B.Immediately unplug the power cord to prevent data alteration
C.Remove the hard drive immediately for forensic imaging
D.Collect volatile data such as RAM contents and running processes
AnswerD

Volatile data, by definition, vanishes the instant power is lost, so it must be captured first—RAM contents, running processes, active network connections, open files, and logged-on users. A responder should use statically linked, trusted forensic tools from внешней media to dump memory to a forensically sound image, record output, and preserve the system state in a documented chain of custody before any power-down or disk removal.

Why this answer

Volatile data (e.g., RAM contents, running processes, network connections) is lost when power is removed. The first responder must collect this data before any shutdown or hardware removal, following the order of volatility (RFC 3227). This preserves critical evidence that cannot be recovered later.

Exam trap

EC-Council often tests the order of volatility (RFC 3227) and the misconception that immediate shutdown or hardware removal is safer, when in fact the priority is capturing volatile data first to avoid permanent loss.

How to eliminate wrong answers

Option A is wrong because shutting down the system normally allows the OS to write data to disk (e.g., pagefile.sys, temporary files), potentially overwriting evidence, and destroys volatile data. Option B is wrong because immediately unplugging the power cord causes an abrupt loss of all volatile data (RAM, network state) and may corrupt the file system, making forensic analysis harder. Option C is wrong because removing the hard drive without first capturing volatile data loses all RAM-based evidence, and hot-swapping a running system can cause data corruption or loss of encryption keys in memory.

Practice this question →
20
MCQeasy

What is the primary goal of the chain of custody in a digital forensic investigation?

A.To maintain the integrity and admissibility of evidence
B.To encrypt the evidence during transport
C.To speed up the forensic analysis process
D.To ensure that the forensic tools used are properly licensed
AnswerA

Documenting every transfer, handler and access point creates an unbroken audit trail proving the evidence was not altered or contaminated. This preserved integrity is what allows the artefact to be admitted as reliable in court or disciplinary proceedings.

Why this answer

The chain of custody is a documented chronological record that tracks the seizure, custody, control, transfer, analysis, and disposition of digital evidence. Its primary goal is to maintain the integrity and admissibility of evidence by proving that the evidence has not been tampered with or altered from the moment it was collected until it is presented in court. This is critical because any break in the chain can lead to evidence being deemed inadmissible under rules like the Federal Rules of Evidence (FRE) or the Daubert standard.

Exam trap

EC-Council often tests the misconception that chain of custody is about physical security or tool licensing, when in fact it is solely about maintaining a verifiable, unbroken record of evidence handling to ensure legal admissibility.

How to eliminate wrong answers

Option B is wrong because encrypting evidence during transport is a security measure to protect confidentiality, not a goal of the chain of custody, which focuses on integrity and accountability through documentation. Option C is wrong because the chain of custody does not speed up analysis; in fact, it adds procedural steps that can slow the process but are necessary for legal admissibility. Option D is wrong because ensuring forensic tools are properly licensed is a matter of tool validation and legal compliance, unrelated to the chain of custody's purpose of tracking evidence handling.

Practice this question →
21
Multi-Selecthard

Which THREE of the following are best practices for a first responder when arriving at a computer crime scene?

Select 3 answers
A.Photograph the entire scene, including the computer screen and connections
B.Disconnect the computer from the network to prevent remote tampering
C.Turn off the computer immediately to prevent remote access
D.Boot the computer from a forensic CD to preview the hard drive
E.Collect volatile data such as RAM if the computer is on
AnswersA, B, E

Photographing the entire scene before touching anything creates a permanent visual record of the computer's physical location, orientation, visible screen contents, LEDs, and all cable connections to peripherals and the network. This documentation preserves transient configuration details that can never be recreated later, and it supports chain-of-custody by showing exactly the state in which the device was found. Thorough scene photography is a foundational first-responder step.

Why this answer

Option A is correct because photographing the entire scene—including the screen contents, cable connections, and peripheral devices—creates an accurate, tamper-evident visual record of the original state before anything is touched, which is essential for later legal admissibility. Option B is correct because disconnecting the computer from the network (e.g., unplugging the Ethernet cable or disabling Wi-Fi) prevents remote tampering, malware propagation, or remote wipe commands while preserving the local system state. Option E is correct because volatile data such as RAM contents, running processes, network connections, and open files are lost on shutdown, so a first responder should capture this evidence first using accepted order-of-volatility principles.

Option C is not appropriate because powering off the machine destroys volatile evidence and can trigger encryption or anti-forensic routines, and it contradicts the need to preserve RAM. Option D is not appropriate for a first responder because booting from a forensic CD alters the system state and is a later laboratory or examiner step, not an initial scene-response action.

Exam trap

EC-Council often tests the misconception that immediately powering off a computer is a safe first step, when in fact it destroys volatile evidence and can corrupt the file system, making forensic recovery harder.

Practice this question →
22
Multi-Selectmedium

Which TWO of the following are essential components of a proper chain of custody documentation? (Select TWO.)

Select 2 answers
A.The name of the suspect
B.Date and time of each evidence transfer
C.Signature of each person who handled the evidence
D.The operating system version of the suspect's computer
E.The IP address of the forensic workstation
AnswersB, C

Recording the date and time of every evidence transfer establishes an auditable timeline proving continuous custody from seizure to presentation. This satisfies the chain of custody requirement by demonstrating that no unaccounted gap permitted tampering.

Why this answer

Option B is correct because chain of custody documentation must record the date and time of every transfer of evidence, establishing an auditable timeline that proves the evidence was continuously accounted for from seizure to presentation. Option C is correct because each person who handled or transferred the evidence must sign for it, creating individual accountability and showing an unbroken sequence of custody. Together, these entries let investigators demonstrate that the evidence was not tampered with or substituted.

Option A is not essential to the chain of custody itself, since the suspect's identity does not establish who controlled the evidence. Option D is irrelevant because the OS version of the suspect's computer is a technical artifact detail, not a custody record. Option E is likewise irrelevant, as the forensic workstation's IP address does not document the handling or transfer of evidence.

Exam trap

EC-Council often tests the misconception that technical details about the evidence (like OS version or IP address) are part of chain of custody, when in fact the chain only tracks who handled the evidence and when, not the evidence's configuration.

Practice this question →
23
MCQmedium

During a forensic investigation, an analyst acquires a hard drive using a hardware write blocker. Which of the following is the PRIMARY reason for using a hardware write blocker?

A.To increase the transfer speed of the imaging process.
B.To bypass the drive's password protection.
C.To compress the data during imaging.
D.To ensure that the operating system does not mount the drive as writable.
AnswerD

The forensic purpose of a write blocker is to prevent the host operating system from mounting the evidence drive with write access. Without a write blocker, merely connecting a drive to a forensic workstation can cause the OS to automatically mount it read-write, creating files, updating last-accessed timestamps, or writing to the filesystem journal—all of which modify the evidence and invalidate its cryptographic hash. A hardware write blocker sits between the drive and the host and intercepts ATA/SCSI commands, allowing read commands to pass while blocking write commands at the firmware level. This guarantees that the original evidence drive remains bit-for-bit unchanged, preserving its forensic integrity and admissibility in court.

Why this answer

The primary reason for using a hardware write blocker is to physically intercept the SATA/IDE bus between the suspect drive and the forensic workstation, ensuring that only read commands (e.g., ATA READ DMA) are passed through while blocking any write commands (e.g., ATA WRITE DMA). This prevents the operating system from mounting the drive as writable, which would otherwise cause automatic writes (e.g., timestamp updates, journaling, or prefetch creation) that alter evidence and break the chain of custody.

Exam trap

The trap here is that candidates confuse the write blocker's purpose with performance features (speed, compression) or assume it can bypass security mechanisms, when in fact its sole forensic function is to guarantee read-only access at the hardware interface level.

How to eliminate wrong answers

Option A is wrong because hardware write blockers do not increase transfer speed; they operate at the bus speed and may even introduce slight latency due to filtering logic. Option B is wrong because bypassing drive password protection is not a function of a write blocker; that requires specialized tools like forensic drive unlockers or ATA security commands. Option C is wrong because compression is a software feature of imaging tools (e.g., dd with gzip, FTK Imager, EnCase) and is unrelated to the hardware write blocker's role of write prevention.

Practice this question →
24
Multi-Selecthard

In the context of e-discovery, which THREE of the following are key steps in the Electronic Discovery Reference Model (EDRM)? (Select THREE)

Select 3 answers
A.Preservation
B.Production
C.Collection
D.Prosecution
E.Investigation
AnswersA, B, C

In the EDRM, preservation is the planned, proactive act of placing a litigation hold on all potentially relevant electronically stored information (ESI) once legal action is reasonably anticipated. It ensures that data remains intact and unaltered, thereby preventing spoliation and associated sanctions. Preservation is distinct from collection in that it imposes a legal duty to maintain the status quo, rather than performing the physical extraction of data.

Why this answer

Preservation (A) is a core EDRM step that focuses on safeguarding potentially relevant electronically stored information (ESI) once a duty to preserve is triggered, preventing spoliation before collection occurs. Production (B) is the EDRM phase in which responsive, non-privileged ESI is delivered to the requesting party in an agreed-upon format, often with load files and metadata, completing the exchange. Collection (C) is the EDRM step that gathers the identified and preserved ESI using forensically sound methods so that its integrity and chain of custody are maintained for later processing and review.

The other options do not belong: Prosecution (D) is a legal litigation activity, not an EDRM phase, and Investigation (E) is a general fact-finding process that is not one of the nine EDRM stages (Identification, Preservation, Collection, Processing, Review, Analysis, Production, Presentation, and Information Governance).

Exam trap

The CHFI exam often tests the distinction between 'Preservation' and 'Collection' as separate steps, and candidates mistakenly think 'Investigation' or 'Prosecution' are part of the EDRM when they are actually post-discovery legal actions.

Practice this question →
25
MCQhard

During a forensic examination, an analyst uses the command 'dd if=/dev/sda of=/mnt/evidence/image.dd bs=4096 conv=noerror,sync'. What is the primary purpose of the 'conv=noerror,sync' option in this context?

A.To split the image into multiple smaller files
B.To skip bad sectors and continue imaging, padding the output with zeros
C.To compress the output image file
D.To verify the image integrity using a hash
AnswerB

The `noerror` flag lets dd continue past read errors instead of aborting, while `sync` pads each failed block with zero bytes so block alignment and offsets stay intact. This satisfies the forensic requirement of acquiring a complete, verifiable image from a failing drive without losing positional correspondence to the source.

Why this answer

The 'conv=noerror,sync' option tells dd to continue reading even when it encounters read errors (noerror) and to pad the output with zeros (sync) to maintain the correct offset alignment, ensuring the image remains a bit-for-bit copy of the source drive despite bad sectors. This is critical in forensic imaging to preserve the integrity of the data stream and avoid truncation or corruption of the output file.

Exam trap

The trap here is that candidates often confuse 'conv=noerror,sync' with error correction or data recovery, when in fact it simply allows the imaging to proceed past bad sectors by padding with zeros, not by recovering the lost data.

How to eliminate wrong answers

Option A is wrong because splitting an image into multiple files is achieved with options like 'split' or 'bs' combined with 'count', not with 'conv=noerror,sync'. Option C is wrong because compression is not a function of dd's conv parameter; compression requires piping through gzip or using a separate tool. Option D is wrong because hash verification is done with separate commands like 'md5sum' or 'sha256sum', not with the conv parameter of dd.

Practice this question →
26
MCQeasy

Which of the following is the PRIMARY purpose of using a write blocker in computer forensics?

A.To speed up the imaging process by caching writes.
B.To convert the hard drive interface from SATA to USB.
C.To encrypt the forensic image for secure transport.
D.To prevent any modification to the original evidence drive during acquisition.
AnswerD

A hardware write blocker's primary purpose is to preserve the forensic integrity of the original evidence drive by intercepting the command stream between the host computer and the suspect drive, filtering out any write, erase, or reset commands while allowing read-only access. This ensures that the acquisition process does not alter data, timestamps, or metadata, allowing the resulting forensic image to match the original bit-for-bit and be verified via hashing. By enforcing read-only access at the hardware interface level, it provides a court-defensible mechanism for evidence preservation.

Why this answer

A write blocker ensures that no data is written to the original evidence drive during acquisition, maintaining its integrity.

Practice this question →
27
MCQeasy

According to Locard's exchange principle, which of the following is MOST relevant to digital forensics?

A.The chain of custody must be maintained for all evidence
B.When a person interacts with a digital device, they leave digital traces that can be recovered
C.Every crime scene contains at least one latent fingerprint
D.Digital evidence is always stored in non-volatile memory
AnswerB

This is the direct digital adaptation of Locard's exchange principle: every interaction with a digital device leaves residual traces, such as file metadata changes, prefetch cache entries, registry modification times, network connection logs, or remnants in RAM. Those traces may be volatile or persistent, but their existence is the foundational premise of digital forensics. Because user actions necessarily alter the device's state, examiners can reconstruct activity by identifying and analyzing these digital footprints. Therefore, this statement accurately reflects how Locard's principle applies to digital investigations.

Why this answer

Locard's exchange principle states that every contact leaves a trace. In digital forensics, this translates to the fact that when a person interacts with a digital device (e.g., opening a file, browsing a website, or typing a command), they leave digital traces such as log entries, metadata, temporary files, or registry artifacts. These traces can be recovered and analyzed to reconstruct user activity, making option B the most relevant application of the principle in this context.

Exam trap

The CHFI exam often tests the misconception that Locard's exchange principle applies only to physical evidence (like fingerprints or DNA), leading candidates to incorrectly choose option C, when in fact the principle is equally valid for digital traces such as log entries, file metadata, and memory artifacts.

How to eliminate wrong answers

Option A is wrong because the chain of custody is a procedural requirement for evidence admissibility, not a direct application of Locard's exchange principle, which focuses on the transfer of traces rather than documentation. Option C is wrong because Locard's principle does not guarantee that every crime scene contains a latent fingerprint; it states that every contact leaves a trace, but the trace may be digital, biological, or physical, and not necessarily a fingerprint. Option D is wrong because digital evidence is not always stored in non-volatile memory; volatile memory (RAM) contains evidence such as running processes, network connections, and encryption keys, which are lost on power loss, and Locard's principle applies to both volatile and non-volatile traces.

Practice this question →
28
MCQeasy

Which of the following is the BEST definition of computer forensics?

A.The application of investigative and analytical techniques to gather and preserve evidence from digital devices suitable for presentation in a court of law.
B.The use of software tools to scan for malware on a computer system.
C.The process of recovering deleted files from a hard drive.
D.The process of securing a computer network from unauthorized access.
AnswerA

The application of investigative and analytical techniques to gather and preserve evidence from digital devices suitable for presentation in a court of law is the full-scope definition. It encompasses the entire forensic process: identification, acquisition, preservation, analysis, and documentation while maintaining a strict chain of custody. Every action must be reproducible and defensible in legal proceedings, ensuring that the evidence is authentic, unaltered, and admissible. This distinguishes computer forensics from unrelated practices like malware scanning or network hardening.

Why this answer

Computer forensics is fundamentally the application of investigative and analytical techniques to collect, preserve, and analyze digital evidence in a manner that maintains its integrity and admissibility in a court of law. This definition encompasses the entire forensic process, from acquisition through chain of custody to presentation, aligning with the CHFI framework's emphasis on legal and procedural rigor.

Exam trap

EC-Council often tests the distinction between a narrow technical task (like file recovery or malware scanning) and the full legal and procedural scope of computer forensics, causing candidates to confuse a single step with the entire discipline.

How to eliminate wrong answers

Option B is wrong because it describes malware scanning, which is a security or incident response task, not the comprehensive legal and investigative process of computer forensics. Option C is wrong because it focuses solely on file recovery, which is only one small technical step within the broader forensic methodology, ignoring evidence preservation, analysis, and legal presentation. Option D is wrong because it defines network security (e.g., firewalls, access controls), not the post-incident forensic examination of digital evidence for legal proceedings.

Practice this question →
29
MCQhard

During an investigation, an analyst uses `dd if=/dev/sdb of=evidence.img bs=4k conv=noerror,sync`. What is the purpose of the `conv=noerror,sync` option?

A.It hashes each block to verify integrity.
B.It enables synchronous writing to ensure data integrity.
C.It compresses the output image to save space.
D.It skips read errors and pads the output with zeros to maintain block alignment.
AnswerD

When used as conv=noerror,sync, dd will continue reading a source device after encountering bad sectors because noerror suppresses the usual abort-on-error behavior, while sync pads each incomplete or unreadable block with zeros up to the full input block size. This zero-filling preserves the original logical block offsets and keeps the image's partition layout aligned, which is critical for later forensic analysis. The result is a complete-sized image in which damaged areas are marked as zero-filled blocks rather than causing the output to shrink or lose alignment.

Why this answer

The `conv=noerror,sync` option in `dd` instructs the tool to continue processing even when a read error is encountered (`noerror`) and to pad the output block with zeros (`sync`) to maintain the original block alignment. This ensures that the resulting image file remains the same size as the source device, preserving the forensic integrity of the data layout despite hardware-level read failures.

Exam trap

EC-Council often tests the misconception that `sync` in `conv=noerror,sync` refers to synchronous I/O or write caching, when in fact it means padding output blocks with zeros to maintain alignment after read errors.

How to eliminate wrong answers

Option A is wrong because `conv=noerror,sync` does not perform hashing; hashing is done separately with options like `hash=md5` or via a pipe to `sha256sum`. Option B is wrong because synchronous writing is controlled by the `oflag=sync` or `conv=fsync` option, not `conv=noerror,sync`; the `sync` in `conv` refers to padding with zeros, not write synchronization. Option C is wrong because `dd` does not compress data; compression requires piping through `gzip` or using `conv=lz4` or similar, and `conv=noerror,sync` has no compression effect.

Practice this question →
30
MCQhard

An organization in the UK suspects an employee of data theft. The IT manager wants to search the employee's company-issued laptop without consent. Which law primarily governs this action?

A.Police and Criminal Evidence Act 1984 (PACE)
B.Computer Misuse Act 1990
C.GDPR (General Data Protection Regulation)
D.Human Rights Act 1998
AnswerC

GDPR (General Data Protection Regulation) covers data protection and privacy, but it is not the primary law governing the act of searching a laptop without consent in this context.

Why this answer

The primary law governing an employer's search of an employee's company-issued laptop without consent is the GDPR/UK Data Protection Act, as the search involves processing the employee's personal data and workplace privacy. The Computer Misuse Act 1990 primarily addresses unauthorized access to computer systems; it is not the most applicable law when the IT manager is acting with the employer's authority on company-owned equipment. PACE 1984 applies to police searches, and the Human Rights Act 1998 sets out broader privacy principles but is not the primary law for this internal employer action.

Practice this question →
31
MCQmedium

An investigator needs to testify in court as an expert witness. Which of the following qualifications is MOST important for the court to accept their testimony?

A.They have a certification in computer forensics.
B.They have published articles in peer-reviewed journals on digital forensics.
C.They can demonstrate knowledge, skill, experience, training, or education that will assist the trier of fact.
D.They have been employed as a forensic analyst for over 10 years.
AnswerC

This option reflects the exact language of Federal Rule of Evidence 702, which establishes that a witness may qualify as an expert by virtue of knowledge, skill, experience, training, or education, provided the testimony will assist the trier of fact. The court serves as a gatekeeper and must determine that the proposed expert's qualifications are directly relevant to the technical or scientific issues in dispute and that their testimony is both reliable and helpful to the jury. This standard is deliberately broad and flexible, allowing the court to consider practical experience, formal education, certifications, and publications collectively rather than relying on any single credential.

Why this answer

Under the Federal Rules of Evidence (FRE) Rule 702, a witness qualified as an expert by knowledge, skill, experience, training, or education may testify if their specialized knowledge will assist the trier of fact. Option C directly mirrors this legal standard, making it the most critical qualification for admissibility. Certifications, publications, or years of service are supporting factors but not independently sufficient under the Daubert or Frye standards.

Exam trap

EC-Council often tests the misconception that a certification or years of experience alone qualifies someone as an expert witness, but the legal standard under FRE 702 requires the witness to demonstrate that their knowledge, skill, experience, training, or education will actually assist the trier of fact.

How to eliminate wrong answers

Option A is wrong because a certification alone does not guarantee that the court will accept the testimony; the court must assess whether the witness's actual knowledge and experience will assist the trier of fact, and certifications are not a substitute for demonstrated competence. Option B is wrong because published articles in peer-reviewed journals are a factor under the Daubert standard but are not the most important qualification; the witness must still show that their expertise directly aids the court in understanding the evidence. Option D is wrong because 10 years of employment as a forensic analyst does not automatically qualify someone as an expert; the court evaluates the substance of their experience and whether it logically applies to the specific digital evidence in question.

Practice this question →
32
MCQmedium

In a UK-based investigation, which legal framework governs the search and seizure of digital evidence?

A.Electronic Communications Privacy Act
B.PACE (Police and Criminal Evidence Act)
C.Fourth Amendment
D.GDPR
AnswerB

The Police and Criminal Evidence Act 1984 (PACE) is the primary legal framework for police powers in England and Wales, covering stop and search, arrest, detention, and the seizure of evidence. Its Codes of Practice, particularly Code B, set out detailed procedures for searching premises and seizing property, including digital devices, to ensure lawfulness and admissibility. In a UK-based investigation, PACE is the correct framework for authorising and conducting searches and seizures, and it also provides exclusionary powers under section 78.

Why this answer

The Police and Criminal Evidence Act 1984 (PACE) provides the legal framework for police powers, including search and seizure of digital evidence in the UK.

Practice this question →
33
MCQhard

A company's legal department issues a legal hold notice for electronically stored information (ESI) related to a pending lawsuit. The IT department is tasked with preserving data. Which of the following actions is MOST likely to violate the legal hold requirements?

A.Notifying all employees to preserve documents related to the lawsuit.
B.Suspending routine deletion of emails older than 30 days.
C.Continuing to run a script that deletes temporary files older than 24 hours.
D.Taking a forensic image of the relevant servers.
AnswerC

Continuing to run the 24-hour temp-file deletion script violates the legal hold because the script operates as an ongoing, automated erosion of potentially relevant ESI. Temporary files are not categorically immaterial; they may contain fragments, cached versions, or undelivered drafts of emails and documents that fall within the scope of the lawsuit. By allowing a routine housekeeping process to persist unchecked, the company risks spoliation and sanctions, regardless of the files' temporary designation.

Why this answer

Continuing to run a script that deletes temporary files older than 24 hours directly destroys ESI that may be relevant to the lawsuit, violating the legal hold requirement to preserve all potentially relevant data. Legal hold mandates the suspension of any automated or manual processes that could alter or delete ESI, including temporary files that might contain fragments of relevant documents or metadata. Unlike suspending routine email deletion (Option B), which is a preservation action, the script actively purges data and thus breaches the hold.

Exam trap

EC-Council often tests the misconception that only 'obvious' data like emails or documents need preservation, but the trap here is that temporary files and caches are also ESI and must be preserved under a legal hold, making their automated deletion a violation.

How to eliminate wrong answers

Option A is wrong because notifying employees to preserve documents is a standard and necessary step to implement a legal hold, ensuring awareness and compliance. Option B is wrong because suspending routine deletion of emails older than 30 days is a proper preservation action that stops the destruction of potentially relevant ESI. Option D is wrong because taking a forensic image of relevant servers is a best-practice preservation technique that captures a point-in-time snapshot of data without altering it, fully compliant with legal hold requirements.

Practice this question →
34
MCQhard

A forensic analyst is examining a hard drive that was imaged using a software write blocker. Which of the following is a potential disadvantage of using a software write blocker compared to a hardware write blocker?

A.It cannot be used with USB drives
B.It may be susceptible to operating system or driver vulnerabilities
C.It does not support hashing algorithms for integrity
D.It is more expensive than hardware write blockers
AnswerB

Software write blockers enforce read-only access by relying on the operating system kernel, storage drivers, and the blocker's own filter driver. If any of those trusted components has a vulnerability—for example, a privilege escalation bug or a flaw in the way the filter processes IOCTL requests—an attacker on the system could submit write commands directly to the storage device, bypassing the blocker. Because the blocker runs at the same privilege level as the code it is trying to protect against, it inherits the OS's security weaknesses. This inherent trust dependency is why hardware write blockers are often preferred for forensic soundness in hostile or unknown environments.

Why this answer

A software write blocker operates at the operating system level, intercepting write commands before they reach the storage device. Because it relies on the OS and its drivers, any vulnerability in the OS kernel, storage driver stack, or the blocker's own filter driver could be exploited, potentially allowing unintended writes to the evidence. In contrast, a hardware write blocker physically prevents write signals from reaching the drive at the bus level, offering a more robust isolation that is independent of the host OS's security state.

Exam trap

EC-Council often tests the misconception that software write blockers are functionally equivalent to hardware blockers, but the trap here is that candidates overlook the OS-layer dependency and vulnerability surface of software blockers, assuming they are just as reliable as physical write-blocking hardware.

How to eliminate wrong answers

Option A is wrong because software write blockers can be used with USB drives; they intercept write commands at the OS level regardless of the interface (SATA, USB, etc.), though some may require specific driver support. Option C is wrong because software write blockers do not inherently prevent hashing; hashing algorithms like SHA-256 are applied to the acquired image by forensic tools (e.g., FTK Imager, dd with sha256sum) independently of the write blocker. Option D is wrong because software write blockers are generally less expensive than hardware write blockers, often being free or low-cost tools (e.g., built-in OS features or open-source utilities), while hardware blockers involve dedicated electronic components.

Practice this question →
35
MCQhard

In the context of e-discovery, what does the 'best evidence rule' require regarding digital documents?

A.That the original electronic file or a reliable duplicate be produced.
B.That all evidence be authenticated by a witness.
C.That only paper copies of digital documents are admissible.
D.That metadata is preserved in all copies.
AnswerA

Under Fed. R. Evid. 1002, proving a document's content requires the original; for ESI, FRE 1001(d) defines an original as any printout or other readable output that accurately reflects the information. A reliable duplicate—such as a forensic image with a matching SHA-256 hash or a native file produced with verified integrity—is admissible whenever there is no genuine question about the original's authenticity or unfairness from using the copy. In practice, producing the native file or load-file images with hash-verified integrity satisfies the rule.

Why this answer

The best evidence rule, codified in Federal Rule of Evidence 1002, requires the original writing, recording, or photograph to prove its content unless otherwise provided. In e-discovery, an original electronic file or a reliable duplicate (e.g., a bit-for-bit forensic image verified by a hash such as MD5 or SHA-1) satisfies this rule because the duplicate is functionally equivalent to the original for evidentiary purposes.

Exam trap

EC-Council often tests the misconception that the best evidence rule requires the 'original' in a physical sense, leading candidates to reject reliable duplicates, when in fact digital duplicates verified by hash are legally equivalent to the original under FRE 1003.

How to eliminate wrong answers

Option B is wrong because the best evidence rule does not mandate authentication by a witness; authentication is a separate requirement under FRE 901, which can be satisfied through testimony or circumstantial evidence like hash values. Option C is wrong because the rule does not require paper copies; in fact, paper copies of digital documents are often considered duplicates and may be admissible if they accurately reflect the original, but the rule prefers the original or a reliable duplicate, not exclusively paper. Option D is wrong because while metadata preservation is a best practice in forensics, the best evidence rule itself does not explicitly require metadata preservation in all copies; it focuses on the content of the document, not its metadata.

Practice this question →
36
MCQhard

An analyst runs 'dcfldd if=/dev/sdb of=/evidence/disk.dd hash=sha256 hashlog=/evidence/hash.log' on a Linux system. What is the primary advantage of using dcfldd over plain dd for forensic imaging?

A.It can acquire memory dumps from live systems
B.It supports compression of the output image
C.It automatically creates a write-blocked connection
D.It can compute hashes on-the-fly and log them
AnswerD

dcfldd computes hash values (MD5, SHA-1, SHA-256, etc.) as it reads data, allowing verification without a separate pass. It can log these hashes to a separate file (e.g., using the 'hashlog' or 'hashlog-md5' parameters) and display verified status for each segment. This is a key forensic feature because it ensures the acquired image is a true copy and provides an audit trail of the imaging process.

Why this answer

D is correct because dcfldd is a specialized forensic version of dd that can compute cryptographic hashes (e.g., SHA-256) on-the-fly while writing the image, and log those hashes to a separate file (hashlog). This ensures data integrity verification without requiring a separate post-imaging hashing pass, which is a critical requirement in forensic imaging to prove the acquired image is an exact bit-for-bit copy of the source.

Exam trap

The trap here is that candidates may confuse dcfldd's on-the-fly hashing with other features like compression or memory acquisition, or assume that dd itself can perform hashing, when in fact plain dd has no built-in hash computation capability.

How to eliminate wrong answers

Option A is wrong because dcfldd is designed for disk imaging, not memory acquisition; tools like LiME or fmem are used for live memory dumps. Option B is wrong because dcfldd does not natively support compression; compression must be done via piping to gzip or using other tools like ewfacquire. Option C is wrong because dcfldd does not create a write-blocked connection; write-blocking is a hardware or software layer (e.g., using a hardware write-blocker or the Linux kernel's read-only mount) that must be established before running the imaging command.

Practice this question →
37
MCQmedium

After collecting digital evidence from a suspect's computer, the forensic examiner creates a forensic image using FTK Imager. The examiner then computes the MD5 hash of the original drive and the image file. Which of the following BEST describes the purpose of this hashing?

A.To verify that the image is an exact bit-for-bit copy of the original.
B.To encrypt the data for secure storage.
C.To index the files for faster searching.
D.To reduce the storage size of the image.
AnswerA

A cryptographic hash algorithm such as SHA-256 produces a fixed-size digest that uniquely identifies the data contents of a file or device. By computing the hash of the original evidence and comparing it with the hash of the acquired image, an investigator can verify the image is an exact bit-for-bit clone. If even a single bit in the image differs, the hash digest will change, providing strong mathematical evidence that no data was altered, added, or lost during acquisition.

Why this answer

Hashing with MD5 (or SHA-1/SHA-256) produces a unique fixed-size digest of the data. By comparing the hash of the original drive to the hash of the forensic image, the examiner can confirm that the image is an exact bit-for-bit copy, ensuring the integrity of the evidence and that no data has been altered during acquisition.

Exam trap

EC-Council often tests the misconception that hashing is used for encryption or compression, leading candidates to confuse integrity verification with confidentiality or storage optimization.

How to eliminate wrong answers

Option B is wrong because hashing is a one-way function that does not encrypt data; encryption (e.g., AES) is used for secure storage, not hashing. Option C is wrong because hashing does not index files; indexing for faster searching is done by tools like Windows Search or forensic suites using file metadata and content parsing. Option D is wrong because hashing does not reduce storage size; forensic images are often compressed using algorithms like EWF (Expert Witness Format) or AFF, but hashing itself adds a small fixed-size digest without affecting the image size.

Practice this question →
38
MCQmedium

A forensic examiner needs to acquire an image of a suspect's laptop hard drive. The laptop is running, and the examiner wants to capture volatile data first. According to best practices, which order of steps should the examiner follow?

A.Unplug the laptop, remove the drive, and boot the drive in a forensic workstation.
B.Immediately remove the hard drive, then capture RAM from the drive.
C.Create a full disk image over the network while the laptop is running.
D.Capture volatile data, then shut down normally, remove the drive, and image with a write blocker.
AnswerD

Collecting RAM first preserves evidence of running processes, encryption keys, and open network connections before they vanish at power-down. A normal shutdown lets the OS flush journaled filesystems and VSS snapshots, avoiding the inconsistency caused by hard cuts. Removing the drive afterward and attaching it to a forensic write blocker ensures that all writes are blocked, then tooling such as FTK Imager or dc3dd creates a bit-identical image verified with SHA-256; this is the accepted order of operations in NIST/CHFI guidance.

Why this answer

Forensic best practices mandate capturing volatile data (e.g., RAM, network connections, running processes) first, as this data is lost on power loss. After capturing volatile data, the examiner should perform a graceful shutdown to preserve file system integrity, then remove the drive and acquire a forensic image using a write blocker to prevent any modification to the original evidence.

Exam trap

The trap here is that candidates may think immediate power-off (Option A) preserves the disk state, but they forget that volatile data is lost and an unclean shutdown can corrupt the filesystem, making the image less reliable.

How to eliminate wrong answers

Option A is wrong because unplugging the laptop immediately destroys volatile data (RAM contents, encryption keys, network state) and may cause file system corruption from an unclean shutdown. Option B is wrong because removing the hard drive while the system is running is physically dangerous and technically impossible without first powering off; moreover, capturing RAM from the drive is nonsensical—RAM is volatile memory, not stored on the hard drive. Option C is wrong because creating a full disk image over the network while the laptop is running modifies the system state (network traffic, open files, timestamps) and violates the principle of maintaining evidence integrity; network imaging should only be used when a write-blocked local acquisition is impossible, and even then volatile data must be captured first.

Practice this question →
39
MCQeasy

Locard's exchange principle in digital forensics states that:

A.The chain of custody must be documented for all evidence
B.Digital evidence is always stored in the cloud
C.Only the forensic examiner can handle evidence
D.Every contact leaves a trace, and digital evidence is no exception
AnswerD

This is a direct application of Locard's exchange principle to digital media: any interaction with a computer system—opening a file, sending an email, or connecting a peripheral—leaves persistent remnants such as file system timestamps, RAM fragments, or log entries. Even when a user attempts to delete data, copies may survive in slack space, unallocated sectors, or shadow copies, demonstrating that contact with digital evidence leaves traces. This principle underpins digital forensic methodologies for reconstructing user activity.

Why this answer

Locard's exchange principle, originally from forensic science, asserts that whenever two objects come into contact, a transfer of material occurs. In digital forensics, this translates to the fact that digital devices and systems inevitably leave traces of their interactions—such as log entries, metadata, file artifacts, or network packets—making it possible to reconstruct events. Option D correctly captures this core idea that every contact leaves a trace, and digital evidence is no exception.

Exam trap

EC-Council often tests whether candidates confuse procedural concepts (like chain of custody) with the foundational scientific principle of trace evidence transfer, leading them to pick Option A instead of D.

How to eliminate wrong answers

Option A is wrong because the chain of custody is a procedural requirement for maintaining evidence integrity, not a statement of Locard's exchange principle. Option B is wrong because digital evidence can reside on local storage (e.g., hard drives, SSDs, RAM) as well as in the cloud; the principle applies regardless of storage location. Option C is wrong because multiple authorized personnel (e.g., first responders, investigators, analysts) may handle evidence under proper protocols, not exclusively the forensic examiner.

Practice this question →
40
MCQeasy

Which of the following principles states that when two objects come into contact, there is a transfer of material between them?

A.The best evidence rule
B.Locard's exchange principle
C.The chain of custody
D.The hearsay rule
AnswerB

Locard's exchange principle states that whenever two objects come into contact, there is a cross-transfer of trace material; in forensic computing, this translates to the persistence of artifacts such as filesystem metadata, unallocated slack space, and cache/log entries even after user attempts at deletion. This principle forms the foundation of digital trace recovery, guiding examiners to preserve volatile memory and hard drive remains because every interaction necessarily leaves some discoverable residue.

Why this answer

Locard's exchange principle is a foundational concept in forensic science stating that whenever two objects come into contact, there is a transfer of material between them. In digital forensics, this principle applies to the transfer of digital artifacts (e.g., file fragments, metadata, network traces) when systems interact, such as when a suspect's device connects to a server or when data is copied between storage media.

Exam trap

The CHFI exam often tests the distinction between legal rules (best evidence, hearsay, chain of custody) and forensic principles (Locard's exchange), so candidates mistakenly choose a legal term that sounds related to evidence handling rather than the actual transfer concept.

How to eliminate wrong answers

Option A is wrong because the best evidence rule is a legal standard requiring original evidence (e.g., original hard drive or bit-for-bit image) rather than copies, not a principle about material transfer upon contact. Option C is wrong because the chain of custody is a procedural documentation process that tracks evidence handling from collection to court presentation, not a principle of material exchange. Option D is wrong because the hearsay rule is an evidentiary rule that excludes out-of-court statements offered for the truth of the matter, not a forensic transfer principle.

Practice this question →
41
MCQmedium

A security analyst responds to a suspected data breach. The analyst documents the scene, photographs the computer, and labels the cables. Which phase of the forensic investigation process is being performed?

A.Collection
B.First response
C.Examination
D.Reporting
AnswerB

First response is correct because it comprises the initial, time-critical actions: securing the scene, identifying the scope of compromise, preserving volatile evidence (memory, running processes, network sockets), and documenting the exact system state and time. These actions prevent further data loss and ensure that fleeting digital artifacts are not destroyed by powering down or by ongoing attacker activity. Framework guidance such as NIST SP 800-86 and ISO 27037 explicitly places scoping and preservation at the outset, before any formal collection or analysis. Thus, the first step in a suspected breach is the first response, not a later forensic phase.

Why this answer

The actions described—documenting the scene, photographing the computer, and labeling cables—are part of the First Response phase. This phase occurs immediately after an incident is detected and focuses on preserving the integrity of the scene and evidence before any collection or analysis begins. In the CHFI methodology, First Response includes securing the area, creating a detailed log of the initial state, and ensuring no unauthorized changes occur.

Exam trap

EC-Council often tests the distinction between First Response and Collection, where candidates mistakenly think that any hands-on action (like labeling cables) is part of Collection, but Collection specifically refers to the technical acquisition of data, not scene preservation.

How to eliminate wrong answers

Option A is wrong because Collection involves the actual acquisition of digital evidence (e.g., creating bit-for-bit forensic images using tools like dd or FTK Imager), not the initial scene documentation and labeling. Option C is wrong because Examination is the in-depth analysis of acquired data (e.g., file carving, registry analysis, timeline reconstruction), which occurs after evidence has been collected and preserved. Option D is wrong because Reporting is the final phase where findings are documented and presented, not the initial response activities.

Practice this question →
42
MCQmedium

During a forensic investigation, an analyst creates a bit-for-bit copy of a suspect's hard drive using the 'dd' command with the following parameters: dd if=/dev/sda of=/evidence/image.dd bs=4k conv=noerror,sync. What is the purpose of 'conv=noerror,sync'?

A.To hash the output image
B.To ensure the command runs with superuser privileges
C.To ignore read errors and pad with zeros
D.To compress the output image
AnswerC

This is correct. conv=noerror instructs dd to continue after encountering read errors, while sync pads each short or errored read block with zeros to maintain the expected block size. Together they ensure the output image file remains complete and exactly sized, even when the source device has bad sectors—making them essential for forensic imaging of damaged media.

Why this answer

'conv=noerror,sync' tells dd to continue reading even when encountering read errors (noerror) and to pad the output with zeros (sync) to maintain the same total size as the original drive. This ensures a complete forensic image is created despite bad sectors, preserving the integrity of the acquisition for analysis.

Exam trap

The CHFI exam often tests the misconception that 'sync' refers to flushing disk caches (like the sync command) rather than its actual function of padding output with null bytes on read errors.

How to eliminate wrong answers

Option A is wrong because hashing is not performed by the conv parameter; hashing requires separate tools like sha256sum or md5sum, or using dd with piped output to a hash function. Option B is wrong because superuser privileges are obtained via sudo or running as root, not through conv parameters; conv controls data conversion, not permissions. Option D is wrong because compression is not a function of conv; compression requires piping dd output through gzip or using a separate tool like dc3dd with built-in compression.

Practice this question →
43
MCQeasy

Which of the following BEST defines the chain of custody in digital forensics?

A.The legal authority required to seize evidence
B.The order in which forensic tools are applied to evidence
C.The physical security measures used to store evidence
D.The chronological documentation of evidence handling, transfer, and analysis
AnswerD

Chain of custody records who handled evidence, when, and how it moved between parties. This chronological documentation proves integrity from seizure through analysis, satisfying the requirement to show uncontaminated, unbroken possession of digital evidence in court.

Why this answer

The chain of custody is a formal, chronological record that documents every instance of evidence handling, transfer, and analysis from the moment of seizure through its entire lifecycle. This documentation is critical to prove that evidence has not been tampered with, altered, or corrupted, thereby maintaining its admissibility in legal proceedings under rules such as Federal Rule of Evidence 901.

Exam trap

The CHFI exam often tests the distinction between the physical security of evidence (Option C) and the procedural documentation of its handling (Option D), leading candidates to confuse storage controls with the chain of custody itself.

How to eliminate wrong answers

Option A is wrong because legal authority to seize evidence (e.g., a search warrant or subpoena) is a prerequisite for lawful collection, not the ongoing tracking of evidence after seizure. Option B is wrong because the order of forensic tool application (e.g., using FTK Imager before Autopsy) is a procedural workflow choice, not a documentation requirement for evidentiary integrity. Option C is wrong because physical security measures (e.g., locked safes, access logs) are part of evidence storage controls, but they do not constitute the chronological documentation of handling and transfer that defines chain of custody.

Practice this question →
44
MCQeasy

Which principle states that every contact leaves a trace?

A.Locard's exchange principle
B.Chain of custody
C.Best evidence rule
D.Hearsay rule
AnswerA

Locard's exchange principle, articulated by French forensic scientist Edmond Locard, holds that every contact between a person and an environment results in a mutual transfer of material. This foundational axiom means a perpetrator both leaves trace evidence at a scene and carries trace evidence away, enabling forensic examiners to link individuals to locations. It is the scientific basis for analyzing fibers, hair, glass, soil, biological fluids, and even digital residues.

Why this answer

Locard's exchange principle is the foundational forensic concept stating that whenever two objects come into contact, there is a transfer of material between them. In computer forensics, this means that digital activity—such as accessing a file, sending a packet, or connecting to a network—inevitably leaves traces in logs, memory, registry entries, or file metadata. This principle underpins the entire discipline of digital evidence recovery.

Exam trap

EC-Council often tests the distinction between a forensic principle (Locard's) and legal or procedural rules (chain of custody, best evidence, hearsay), so candidates mistakenly select a legal term that sounds related to evidence handling rather than the core scientific concept.

How to eliminate wrong answers

Option B (Chain of custody) is wrong because it is a procedural documentation process that tracks the handling of evidence from collection to court presentation, not a principle about trace evidence. Option C (Best evidence rule) is wrong because it is a legal rule requiring original evidence (e.g., original hard drive rather than a copy) to be presented in court, not a statement about contact leaving traces. Option D (Hearsay rule) is wrong because it is a legal rule excluding out-of-court statements offered for the truth of the matter, unrelated to physical or digital trace evidence.

Practice this question →
45
MCQhard

An investigator creates a forensic image using dcfldd with the following command: dcfldd if=/dev/sdb of=image.dd hash=sha256 hashwindow=10M hashlog=hash.txt. What is the effect of the 'hashwindow=10M' parameter?

A.It divides the output into 10 MB chunks and hashes each chunk, logging the results
B.It sets the input buffer size to 10 MB for performance
C.It verifies the hash of the input device in 10 MB windows before copying
D.It causes the tool to hash the entire image only after completion
AnswerA

The hashwindow parameter in dcfldd instructs the tool to compute a cryptographic hash (e.g., MD5 or SHA-256) for every 10 MiB segment of the data stream as it copies, logging each segment's hash to a designated hash log. This piecewise hashing enables examiners to verify specific portions of an acquired image independently rather than relying solely on a single hash for the entire output, which is especially critical for very large forensic images. It is specified alongside hash= and hashlog= options to produce a record of per-window hashes during acquisition.

Why this answer

The `hashwindow=10M` parameter in dcfldd instructs the tool to compute a SHA-256 hash for every 10 MB segment (window) of the input data as it is being copied, and then log each segment's hash to the specified hashlog file. This allows the investigator to verify the integrity of individual chunks of the forensic image, which is useful for detecting corruption or tampering in specific regions of the image without rehashing the entire file.

Exam trap

The CHFI exam often tests the distinction between 'hashing during acquisition' and 'hashing after completion' — the trap here is that candidates may assume `hashwindow` is for performance tuning (buffer size) or for pre-copy verification, rather than understanding it as a segmentation feature for incremental hashing and logging.

How to eliminate wrong answers

Option B is wrong because `hashwindow` does not control the input buffer size; dcfldd uses separate parameters (e.g., `bs=`) for block size and buffer settings, and `hashwindow` is specifically for segment-based hashing. Option C is wrong because `hashwindow` does not cause the tool to verify the hash of the input device before copying; it computes hashes of the output chunks during the copy process, not as a pre-copy verification step. Option D is wrong because `hashwindow=10M` causes hashing to occur incrementally during the imaging process, not only after completion; the `hashlog` file is populated as each 10 MB window is processed.

Practice this question →
46
MCQeasy

During a forensic investigation, the first responder arrives at a scene where a computer is powered on and a user is logged in. Which of the following is the MOST appropriate initial action?

A.Immediately power off the computer to prevent data alteration
B.Begin collecting data by copying all files to an external drive
C.Disconnect the computer from the network and take a photograph of the screen
D.Ask the user to save their work and then shut down normally
AnswerC

Disconnecting the network cable isolates the machine from live remote control, stops exfiltration, and prevents a remote actor from remotely wiping or modifying the evidence. Taking a photograph of the screen before any interaction preserves the visible state of running applications, chat windows, encryption banners, and console output, which would be lost immediately upon shutdown or further user activity. This staged approach follows the order of volatility while simultaneously documenting the live scene.

Why this answer

Securing the scene and documenting everything is the first priority to preserve evidence and ensure chain of custody. Powering off or accessing the system without proper documentation can lead to evidence spoliation.

Practice this question →
47
MCQmedium

A forensic analyst needs to collect evidence from a running Windows system without altering the system state. Which tool should they use to acquire volatile memory?

A.Wireshark
B.dd
C.DumpIt
D.Tableau write blocker
AnswerC

DumpIt is a memory acquisition tool for Windows that creates a raw physical memory dump (typically a .raw or .bin file) from a running system. It uses undocumented Windows kernel structures and the \\.\PhysicalMemory interface to read RAM without requiring a full installation, making it ideal for incident response. DumpIt preserves volatile evidence such as running processes, open network connections, and loaded kernel modules, which is exactly what the analyst needs.

Why this answer

DumpIt is a lightweight memory acquisition tool designed specifically for capturing the contents of volatile memory (RAM) on a running Windows system. It minimizes interaction with the system to avoid altering the memory state, making it ideal for forensic collection of live evidence.

Exam trap

EC-Council often tests the distinction between volatile memory acquisition and disk imaging, leading candidates to confuse tools like dd (for disks) with memory-specific tools like DumpIt.

How to eliminate wrong answers

Option A is wrong because Wireshark is a network protocol analyzer used for capturing and inspecting network traffic, not for acquiring volatile memory from a running system. Option B is wrong because dd is a disk imaging tool typically used for creating bit-for-bit copies of storage devices, not for capturing RAM contents, and it does not handle Windows memory structures natively. Option D is wrong because a Tableau write blocker is a hardware device used to prevent writes to storage media during acquisition, but it does not acquire volatile memory; it is used for forensic imaging of hard drives or SSDs.

Practice this question →
48
MCQmedium

In a corporate investigation, legal counsel issues a litigation hold to preserve electronically stored information (ESI) relevant to a lawsuit. Which of the following is the BEST description of a litigation hold?

A.A form of encryption used to protect evidence during transport.
B.A notice to employees to preserve all relevant ESI and cease routine deletion.
C.A technique used to acquire forensic images without altering the source.
D.A court order authorizing law enforcement to seize computers.
AnswerB

A litigation hold is an official notice, typically issued by legal counsel, directing employees and other custodians to suspend normal deletion and retention schedules so that all potentially relevant electronically stored information (ESI) is preserved. Once litigation is reasonably anticipated, the duty attaches, and failure to implement the hold can lead to spoliation sanctions. The notice must be specific enough for custodians to understand what to keep and how to preserve it.

Why this answer

A litigation hold is a legal notice issued to employees and data custodians instructing them to preserve all relevant electronically stored information (ESI) and to suspend any routine deletion, archiving, or destruction policies. This ensures that potentially discoverable data remains intact and unaltered for the duration of the legal proceeding, directly supporting the duty to preserve evidence under the Federal Rules of Civil Procedure (FRCP Rule 37(e)).

Exam trap

The trap here is that candidates confuse a litigation hold with a technical preservation method (like write-blocking or encryption) or with a court order, when in fact it is a legal notice to employees to stop routine deletion of ESI.

How to eliminate wrong answers

Option A is wrong because encryption is a security measure for protecting data confidentiality during transport or storage, not a legal preservation directive; a litigation hold has nothing to do with cryptographic algorithms like AES or RSA. Option C is wrong because it describes a forensic acquisition technique (e.g., using a write blocker or dd command to create a bit-for-bit copy), which is a technical procedure, not a legal notice or hold. Option D is wrong because a court order authorizing seizure is a search warrant or seizure order, typically issued under probable cause, whereas a litigation hold is a civil preservation notice issued by legal counsel without requiring judicial approval.

Practice this question →
49
MCQeasy

What is the primary goal of computer forensics?

A.To prevent future cyber attacks
B.To identify and prosecute cybercriminals
C.To preserve and analyze digital evidence in a legally admissible manner
D.To recover deleted files from a hard drive
AnswerC

The primary goal is to apply a structured, legally defensible process that identifies, collects, preserves, examines and analyzes digital evidence while maintaining a provable chain of custody and verifying data integrity through techniques such as hashing and write-blocking. The ultimate objective is admissibility and reliability in a legal or administrative proceeding, not merely extracting data from a device. Every action, from seizure to reporting, must withstand scrutiny about how evidence was acquired and handled.

Why this answer

The primary goal of computer forensics is to preserve and analyze digital evidence in a manner that is legally admissible in court.

Practice this question →
50
MCQhard

During a forensic examination, an analyst runs the following command: 'dd if=/dev/sda of=/mnt/evidence/image.dd bs=4k conv=noerror,sync'. The source drive has bad sectors. What is the effect of the 'conv=noerror,sync' option?

A.It stops the imaging process when an error is encountered.
B.It skips the bad sectors and compresses the output.
C.It retries reading the bad sector multiple times before giving up.
D.It fills the bad sectors with zeros in the output image, allowing the imaging to complete without errors.
AnswerD

With `conv=noerror,sync`, `dd` treats any read error as a non-fatal event and continues copying the remainder of the source device, but it also pads the failed block with zeros so that the output image is the exact same size as the original media. This means the image contains placeholders for the unreadable sectors, preserving partition offsets and file system layout. It does not recover the original data in those sectors, but it lets the imaging finish and produces a valid forensic image.

Why this answer

The 'conv=noerror,sync' option in dd instructs the tool to continue reading even when encountering read errors (noerror) and to pad the output with zeros (sync) to maintain the original block size alignment. This ensures the forensic image is a complete bit-for-bit copy of the source drive, with bad sectors replaced by zeros, allowing the imaging process to finish without halting on errors.

Exam trap

The trap here is that candidates confuse 'sync' with 'synchronization' or 'skip' rather than understanding it as a padding mechanism that fills bad sectors with zeros to maintain block alignment and allow the imaging to complete.

How to eliminate wrong answers

Option A is wrong because 'conv=noerror' explicitly tells dd to NOT stop on errors; it continues processing. Option B is wrong because dd does not compress output; compression requires a separate tool or pipe (e.g., gzip), and 'sync' pads with zeros, not skips. Option C is wrong because dd does not retry reads; it simply moves to the next block after an error, and retry behavior would require additional options like 'conv=noerror,notrunc' or a separate script.

Practice this question →
51
MCQeasy

What is the primary purpose of maintaining a chain of custody during a forensic investigation?

A.To document the handling of evidence from collection to presentation in court
B.To reduce the size of evidence for easier storage
C.To analyze the evidence for hidden data
D.To encrypt the evidence to prevent unauthorized access
AnswerA

The chain of custody is a legal and administrative record that creates an unbroken chronological log of every individual who collected, handled, transferred, or stored a piece of evidence. This documentation is critical because it demonstrates that the evidence has not been altered, substituted, or contaminated, thereby establishing the authenticity and integrity required for the evidence to be admissible in a court of law. Without a proper chain of custody, the opposing counsel can challenge the evidence's reliability, potentially leading to its exclusion.

Why this answer

The primary purpose of maintaining a chain of custody is to create a documented, unbroken record of every person who handled the evidence, from the moment it is collected until it is presented in court. This documentation is critical to establish the authenticity and integrity of the evidence, ensuring it has not been tampered with or altered, which is a foundational requirement for admissibility under legal standards like the Federal Rules of Evidence (FRE) 901. Without a proper chain of custody, the evidence can be challenged as inadmissible due to lack of trustworthiness.

Exam trap

EC-Council often tests the distinction between the chain of custody's documentation purpose and other forensic activities like analysis or security, so candidates mistakenly choose options that describe evidence handling steps (e.g., encryption or analysis) rather than the core legal documentation requirement.

How to eliminate wrong answers

Option B is wrong because reducing the size of evidence for easier storage is not a forensic goal; it would actually destroy or compress data, potentially losing critical metadata and violating the principle of maintaining evidence in its original state. Option C is wrong because analyzing evidence for hidden data is a separate investigative step (e.g., using tools like FTK or EnCase for steganography detection), not the purpose of the chain of custody, which is purely about documenting handling. Option D is wrong because encrypting evidence to prevent unauthorized access is a security measure, not a documentation process; encryption can even complicate chain of custody if the key is not properly managed, and the chain of custody itself does not involve cryptographic operations.

Practice this question →
52
MCQmedium

A forensic analyst is testifying as an expert witness in court. The opposing counsel challenges the analyst's testimony based on the Frye standard. What does the Frye standard require for scientific evidence to be admissible?

A.The evidence must have been obtained with a warrant.
B.The evidence must be relevant and more probative than prejudicial.
C.The evidence must have been peer-reviewed and published.
D.The evidence must be based on techniques generally accepted in the scientific community.
AnswerD

Under the Frye standard, scientific evidence is admissible only when the methodology or technique on which it is based has achieved general acceptance within the relevant scientific community. This standard, established in Frye v. United States, does not require universal agreement but rather substantial consensus among experts in the applicable field. It is a threshold test for the admissibility of novel scientific evidence, separate from rules about relevance, prejudice, or constitutional procedure.

Why this answer

The Frye standard requires that scientific evidence be based on principles and methods that are generally accepted by the relevant scientific community.

Practice this question →
53
MCQeasy

Which of the following BEST describes the chain of custody in digital forensics?

A.The software tool used to image the hard drive.
B.A log of all personnel who have accessed the evidence, along with timestamps and reasons.
C.The process of encrypting evidence to prevent unauthorized access.
D.The physical lock and key used to secure the evidence locker.
AnswerB

This is exactly the chain of custody: a formal record that establishes the identity of every individual who handled the evidence, the duration of possession, and the purpose. It ensures that the evidence can be accounted for at every stage, preventing tampering or unauthorized alteration. This documentation is critical to prove that the evidence presented in court is the same as that originally collected.

Why this answer

The chain of custody is a documented chronological record that tracks the seizure, custody, control, transfer, analysis, and disposition of digital evidence. It must include every person who handled the evidence, the date and time it was accessed, the purpose of access, and any changes made, ensuring the evidence's integrity and admissibility in court under rules like Federal Rule of Evidence 901.

Exam trap

The CHFI exam often tests the misconception that chain of custody is about physical security (like locks or encryption) rather than the documented audit trail of personnel access, leading candidates to pick options C or D.

How to eliminate wrong answers

Option A is wrong because the software tool used to image the hard drive (e.g., FTK Imager, dd) is a forensic acquisition tool, not a record of evidence handling; the chain of custody is a procedural log, not a tool. Option C is wrong because encrypting evidence (e.g., using BitLocker or VeraCrypt) is a security measure to protect confidentiality, but it does not document who accessed the evidence or when; encryption alone cannot prove integrity or custody history. Option D is wrong because the physical lock and key securing the evidence locker is a physical access control mechanism, not a documented log of personnel access with timestamps and reasons; chain of custody requires a written or electronic audit trail, not just physical security.

Practice this question →
54
MCQmedium

A first responder arrives at a suspected intrusion scene. A desktop computer is powered on and logged in. The user claims they saw suspicious files being copied to a USB drive. Which of the following should the first responder do FIRST?

A.Capture volatile data such as memory and running processes.
B.Power off the computer immediately to prevent further data loss.
C.Photograph the scene and document everything in a notebook.
D.Create a forensic image of the hard drive using a write blocker.
AnswerA

Volatile data must be collected first because RAM, active network connections, and running processes exist only while the system is powered. A memory dump can recover encryption keys, injected malicious code, and open handles, while a process listing and netstat output capture attacker activity that would vanish at shutdown. This follows the order of volatility, moving from the most ephemeral evidence to the least ephemeral evidence.

Why this answer

In a live intrusion where a USB transfer is in progress, volatile data (memory, running processes, network connections) is the most ephemeral and will be lost if the system is powered down. Capturing this data first preserves evidence of the malicious activity, such as the process that initiated the copy and any network connections, which is critical for reconstructing the attack. This follows the order of volatility (RFC 3227), which mandates capturing volatile data before non-volatile data.

Exam trap

The CHFI exam often tests the principle of the order of volatility, and the trap here is that candidates mistakenly prioritize preserving the hard drive (non-volatile) over capturing volatile data, thinking that powering off or imaging the drive first prevents evidence tampering.

How to eliminate wrong answers

Option B is wrong because powering off the computer immediately destroys volatile evidence (e.g., memory contents, running processes, network connections) and may trigger anti-forensic mechanisms that wipe or encrypt data. Option C is wrong because photographing and documenting the scene, while important, is a secondary step that should occur after volatile data capture to avoid losing transient evidence. Option D is wrong because creating a forensic image of the hard drive is a non-volatile acquisition step that should be performed after volatile data has been secured, and doing it first risks overwriting or losing memory-resident evidence.

Practice this question →
55
Multi-Selectmedium

Which TWO of the following are essential components of chain of custody documentation?

Select 2 answers
A.Every person who handled the evidence must sign and date the form
B.A detailed description of the evidence including make, model, and serial number
C.The forensic tool used to analyze the evidence
D.The evidence must be stored in a fireproof safe
E.The final analysis report
AnswersA, B

Each individual who takes custody of the evidence must record their name, the date, and the time on the chain-of-custody form. This creates a chronological audit trail proving that the item was continuously controlled, so a court can presume no tampering occurred. If a single transfer lacks a signature and date, the chain is broken and the evidence may be excluded as lacking authenticity.

Why this answer

Option A is correct because chain of custody requires an unbroken, auditable record of possession, so every individual who handled the evidence must sign and date the form to establish accountability and continuity. Option B is correct because the evidence must be uniquely and precisely identified—including make, model, and serial number—so it can be distinguished from similar items and matched to the custody entries. Option C is not essential to chain of custody itself; the forensic tool used belongs to the analysis methodology and is documented in the examination report, not the custody log.

Option D is not required; evidence must be secured against tampering, but a fireproof safe is a storage recommendation, not a chain-of-custody component. Option E is not part of chain of custody; the final analysis report documents findings and conclusions, not the chronological transfer and handling of the evidence.

Exam trap

EC-Council often tests the distinction between what belongs in chain of custody documentation versus what belongs in the forensic analysis report or security procedures, leading candidates to mistakenly include analysis tools or storage specifications.

Practice this question →
56
MCQeasy

What is the PRIMARY purpose of a chain of custody document in a forensic investigation?

A.To provide a chronological record of who handled the evidence, when, and why.
B.To document the tools used during the investigation.
C.To list all the files found on the suspect's computer.
D.To authorize the search and seizure of digital evidence.
AnswerA

The chain of custody document exists to create a verifiable, chronological account of every individual who came into possession of evidence, along with the specific timestamps and reasons for each transfer. This unbroken record is what establishes the item's integrity and continuity from collection through courtroom presentation, assuring the fact-finder that the evidence was not altered, substituted, or contaminated. Without a defensible chain of custody, even forensically sound evidence may be ruled inadmissible.

Why this answer

The chain of custody document is the foundational record that ensures evidence integrity and admissibility in court. Its primary purpose is to create a chronological, unbroken log of every person who handled the evidence, the exact time and date of each transfer, and the reason for the transfer. This directly supports the legal requirement to prove that the evidence has not been tampered with or altered from the moment of seizure to its presentation in court.

Exam trap

EC-Council often tests the distinction between the chain of custody (which tracks handling history) and the search warrant (which grants legal authority), causing candidates to mistakenly choose the authorization option.

How to eliminate wrong answers

Option B is wrong because documenting the tools used during the investigation is a separate activity, typically recorded in a forensic workstation log or case notes, not in the chain of custody form. Option C is wrong because listing files found on a suspect's computer is the output of forensic analysis (e.g., a file listing from a tool like FTK Imager or EnCase), not the purpose of the chain of custody document. Option D is wrong because authorization for search and seizure is obtained via a legal warrant or consent form, not through the chain of custody; the chain of custody begins after the evidence has been legally seized.

Practice this question →
57
MCQhard

An analyst performs forensic imaging using the command: dcfldd if=/dev/sda of=image.dd hash=sha256 hashlog=hash.txt bs=4096 conv=noerror,sync. What is the PRIMARY purpose of the 'hash=sha256' and 'hashlog=hash.txt' parameters?

A.To encrypt the image file to prevent unauthorized access.
B.To compress the image to save disk space.
C.To ensure the image is an exact bit-for-bit copy and provide an integrity check.
D.To split the image into smaller chunks for easier transport.
AnswerC

The hash option in dcfldd calculates a cryptographic digest of every bit read from the source device, creating a unique digital fingerprint of the acquired data. Hashing ensures that the resulting image is a bit-for-bit copy and allows the examiner to later run the same algorithm to confirm the image has not been modified, which is essential for maintaining evidence integrity in legal proceedings.

Why this answer

The `hash=sha256` parameter instructs dcfldd to compute a SHA-256 hash of the input data as it is read, and `hashlog=hash.txt` writes that hash value to a separate file. This allows the analyst to later verify that the forensic image (`image.dd`) is an exact bit-for-bit copy of the source (`/dev/sda`) by recomputing the hash and comparing it to the stored value, ensuring data integrity and admissibility in court.

Exam trap

EC-Council often tests the distinction between hashing (integrity) and encryption (confidentiality), so the trap here is that candidates confuse the purpose of a hash algorithm with that of an encryption cipher, leading them to incorrectly select Option A.

How to eliminate wrong answers

Option A is wrong because hashing (SHA-256) is a one-way cryptographic function used for integrity verification, not encryption; it does not protect the image from unauthorized access. Option B is wrong because dcfldd does not compress data; the `conv=noerror,sync` parameter handles error recovery, and hashing adds no compression—disk space is not saved. Option D is wrong because dcfldd does not split the output into chunks; the `of=image.dd` writes a single contiguous file, and splitting would require additional parameters like `split=...` or a separate tool.

Practice this question →
58
MCQmedium

A forensic investigator uses the 'dd' command to create a forensic image. The original drive has a SHA-256 hash of a1b2c3... and the image produces the same hash. Which rule of evidence does this satisfy?

A.Reliability
B.Authenticity
C.Completeness
D.Admissibility
AnswerB

Authenticity in digital forensics means proving that the evidence is what it purports to be and has not been modified during acquisition or handling. When the hash computed from the original source matches the hash computed from the dd image, it demonstrates the image is a bit-for-bit copy with no data altered, added, or removed. This cryptographic match directly supports the authenticity/integrity of the evidence.

Why this answer

The SHA-256 hash of the original drive matches the hash of the forensic image, proving that the image is an exact, unaltered copy of the original. This satisfies the rule of authenticity, which requires that evidence be shown to be the same as what was originally seized and not tampered with. The hash acts as a digital fingerprint, and matching hashes confirm the integrity and origin of the evidence.

Exam trap

The trap here is that candidates confuse authenticity (proving the copy is identical to the original) with reliability (the tool's consistency), leading them to choose Option A instead of B.

How to eliminate wrong answers

Option A is wrong because reliability refers to the trustworthiness of the evidence collection process and tools, not the verification of an exact copy via hash matching. Option C is wrong because completeness requires that all data from the original source is captured, which is a separate concern from proving the copy is identical via hash verification. Option D is wrong because admissibility is a legal determination made by a court based on multiple factors (e.g., relevance, chain of custody), not a specific rule satisfied by matching hashes.

Practice this question →
59
MCQmedium

In the context of the UK Police and Criminal Evidence Act (PACE), which of the following is a key requirement for the admissibility of digital evidence?

A.The evidence must be stored on a write-protected medium
B.The evidence must be reviewed by an independent third party
C.The evidence must be encrypted at all times
D.The evidence must be obtained lawfully and without oppression
AnswerD

The correct principle is that evidence must be lawfully obtained and free from oppression, because PACE s.76 specifically excludes confessions obtained by oppression or unreliable means, and s.78 gives the court discretion to exclude evidence if its admission would cause unfairness. For digital evidence, any breach of PACE Codes of Practice during seizure or examination can trigger exclusion. This reflects the Act's core aim of regulating police conduct while preserving fairness in the criminal process.

Why this answer

PACE requires that evidence is not obtained through oppression or in violation of legal procedures, ensuring reliability and fairness.

Practice this question →
60
MCQmedium

An investigator needs to acquire data from a suspect's hard drive without altering any data. Which tool is MOST appropriate to ensure write-blocking at the hardware level?

A.Tableau Forensic Bridge (hardware write-blocker)
B.FTK Imager (software write-blocker)
C.dd command with 'iflag=noatime'
D.EnCase software acquisition module
AnswerA

A Tableau Forensic Bridge is a dedicated hardware write-blocker physically interposed between the forensic workstation and the suspect drive; it intercepts and discards all write commands at the bus level (e.g., SATA, IDE, or USB) using its own firmware and logic, rather than relying on the operating system. This makes it impossible for the OS, forensic software, or malicious code to alter the evidence drive, because write operations are terminated at the hardware interface before reaching the storage medium. Hardware write-blocking is the forensic gold standard and is the most defensible method for maintaining a pristine image.

Why this answer

A hardware write-blocker like the Tableau Forensic Bridge sits between the suspect drive and the forensic workstation at the physical layer, intercepting and blocking any write commands (e.g., ATA WRITE DMA, SCSI WRITE) before they reach the drive. This ensures that no data—including metadata, timestamps, or file system artifacts—is altered during acquisition, which is critical for maintaining evidentiary integrity. Software-based blockers can be bypassed by the OS or a malicious driver, making hardware-level blocking the gold standard in forensic acquisition.

Exam trap

EC-Council often tests the misconception that a software write-blocker (like FTK Imager’s built-in blocker) provides the same level of protection as a hardware write-blocker, when in fact only hardware-level blocking can prevent all write operations—including those from the OS, BIOS, or malicious firmware—from reaching the drive.

How to eliminate wrong answers

Option B (FTK Imager software write-blocker) is wrong because software write-blockers operate at the OS or driver level and can be circumvented by a compromised kernel, a buggy driver, or a direct hardware access command (e.g., via ATA passthrough), so they do not guarantee true hardware-level write protection. Option C (dd command with 'iflag=noatime') is wrong because 'iflag=noatime' only prevents the OS from updating access timestamps on the source file during a dd read, but it does not block write commands at the hardware interface—any write issued by the OS or a misconfigured tool could still reach the drive. Option D (EnCase software acquisition module) is wrong because, while EnCase can use a hardware write-blocker, its software acquisition module alone relies on the OS’s read-only mount or driver-level filtering, which is not a hardware-level write-block and can be overridden by direct disk writes or firmware commands.

Practice this question →
61
MCQmedium

An organization receives a legal hold notice regarding pending litigation. The IT department is instructed to preserve all relevant electronically stored information. What is the primary action the IT department should take?

A.Place a hold on relevant data and suspend routine deletion policies
B.Ignore the notice and continue normal operations
C.Create a forensic image of all servers immediately
D.Permanently delete all emails older than 30 days to reduce storage
AnswerA

A legal hold triggers a duty to preserve all potentially relevant data in their native form, so you must place a litigation hold on the specific systems, files, email mailboxes, and backups that could contain responsive information. This includes actively suspending any automated deletion, archival, or retention policies that would destroy or alter that data, ensuring it remains intact and available for later discovery without necessarily needing forensic duplication.

Why this answer

The primary action is to place a legal hold on relevant data and suspend routine deletion policies. This ensures that all potentially relevant electronically stored information (ESI) is preserved in its current state, preventing spoliation and compliance with the legal hold notice. Suspending deletion policies stops automated processes like email purge jobs or document retention schedules from destroying evidence, which is a foundational step in the e-discovery process.

Exam trap

EC-Council often tests the misconception that the immediate response to a legal hold is to create forensic images of all systems, but the correct first step is to suspend deletion policies to prevent data loss before any imaging or collection occurs.

How to eliminate wrong answers

Option B is wrong because ignoring the notice and continuing normal operations would constitute spoliation of evidence, violating the legal hold and potentially leading to severe legal sanctions, including adverse inference instructions or monetary penalties. Option C is wrong because creating a forensic image of all servers immediately is an overreaction and not the first step; imaging is a preservation technique but should be targeted and performed after identifying the scope of relevant data, not indiscriminately across all servers, which is disruptive and unnecessary. Option D is wrong because permanently deleting all emails older than 30 days is the exact opposite of preservation; it would destroy potentially relevant ESI and directly violate the legal hold, risking spoliation charges.

Practice this question →
62
MCQeasy

Which of the following BEST describes Locard's exchange principle as applied to digital forensics?

A.Digital evidence must be collected using a write blocker.
B.The chain of custody must be documented for evidence to be admissible.
C.Volatile data must be collected before powering off a system.
D.Every contact leaves a trace; an attacker will leave digital evidence on the compromised system.
AnswerD

Locard's exchange principle, originally formulated for physical crime scenes, states that every contact, however slight, leaves a trace, and in digital forensics this means an attacker's activities will invariably generate residual data on the compromised system, such as log entries, altered timestamps, prefetch files, or memory remnants. This transferred principle underlies the entire discipline of digital evidence identification because it gives examiners a theoretical basis for expecting to find attacker artifacts even when the intruder attempts to clean up. It is the only option that directly names the exchange principle rather than a forensic procedure, legal rule, or collection ordering strategy.

Why this answer

Locard's exchange principle states that every contact leaves a trace. In digital forensics, this means that when an attacker interacts with a compromised system, they inevitably leave behind digital artifacts such as log entries, modified files, registry changes, or network connection records. Option D correctly captures this core concept as applied to digital forensics.

Exam trap

The trap here is that candidates confuse procedural best practices (write blockers, chain of custody, order of volatility) with the fundamental theoretical principle of trace evidence exchange, leading them to pick a practical step instead of the conceptual definition.

How to eliminate wrong answers

Option A is wrong because using a write blocker is a best practice for preserving the integrity of digital evidence during acquisition, but it is not a description of Locard's exchange principle. Option B is wrong because documenting the chain of custody is a legal and procedural requirement for evidence admissibility, not a statement of the exchange principle. Option C is wrong because collecting volatile data before powering off is a priority in incident response (order of volatility), but it does not describe the trace-leaving nature of Locard's principle.

Practice this question →
63
MCQmedium

Which of the following is a key requirement for digital evidence to be considered admissible in court?

A.The evidence must be authentic and its integrity must be verifiable
B.The evidence must have been collected by a law enforcement officer
C.The evidence must be stored on a write-blocked device
D.The evidence must be encrypted to ensure confidentiality
AnswerA

To be admissible, digital evidence must be authenticated — the proponent must show it is what it claims to be — and its integrity must be verifiable through a demonstrable chain of custody and cryptographic hash values. Courts require these to ensure the evidence has not been altered or corrupted from the time of acquisition to presentation, as a failure to prove authenticity or integrity undermines its reliability and relevance.

Why this answer

Digital evidence must be authentic and its integrity verifiable to meet the legal standard of admissibility, as established by rules such as the Federal Rules of Evidence (FRE 901) and the Daubert standard. Authentication requires proving that the evidence is what it claims to be, typically through a hash value (e.g., MD5, SHA-1, or SHA-256) computed before and after analysis to ensure no tampering occurred. Without verifiable integrity, the evidence could be challenged as altered, making it inadmissible regardless of how it was collected.

Exam trap

EC-Council often tests the misconception that procedural steps like write-blocking or law enforcement involvement are legal requirements, when in fact the core admissibility criterion is the ability to prove authenticity and integrity through verifiable means like hash values and chain of custody documentation.

How to eliminate wrong answers

Option B is wrong because digital evidence can be collected by any qualified forensic examiner, not exclusively a law enforcement officer; private-sector investigators or certified forensic analysts often handle evidence in civil cases. Option C is wrong because while write-blocking is a best practice to preserve evidence integrity, it is not a legal requirement for admissibility; evidence stored on a non-write-blocked device may still be admissible if integrity is otherwise proven (e.g., via hash verification). Option D is wrong because encryption is not a requirement for admissibility; in fact, encrypted evidence may be inadmissible if the decryption key is unavailable or if encryption obscures the evidence's authenticity, and confidentiality is separate from the legal standards of authenticity and integrity.

Practice this question →
64
MCQeasy

Locard's exchange principle is fundamental to forensic science. How does this principle apply to computer forensics?

A.Every action on a digital device leaves some trace of evidence.
B.Digital evidence is always volatile and must be preserved immediately.
C.Evidence must be collected within 24 hours.
D.Only physical evidence, such as fingerprints, can be left at a crime scene.
AnswerA

In digital forensics, Locard's exchange principle translates to the fact that any user or system action modifies the state of the device: opening a file updates access timestamps, running a program creates process artifacts, and network activity generates logs. These traces can reside in filesystem metadata, application history, event logs, unallocated space, or even slack space. Anti-forensic tools themselves leave traces—such as installation footprints, modified timestamps, or leftover logs—so a determined actor cannot act without leaving some recoverable evidence.

Why this answer

Locard's principle states that every contact leaves a trace; in digital forensics, this translates to digital traces left behind when a system is accessed.

Practice this question →
65
MCQmedium

During an investigation, a forensic analyst must preserve a hard drive that is part of a RAID array. Which of the following is the MOST appropriate method to preserve the evidence?

A.Power off the system and remove only the drive with the operating system
B.Disconnect all drives and image a logical volume after the RAID controller
C.Image each physical drive individually using a write blocker
D.Rebuild the array in a different system and then image
AnswerC

Imaging each physical drive individually with a write blocker is the correct forensic method because it guarantees that no write operations reach the source disks, allowing a true bit-for-bit copy of every member, including unallocated space, deleted metadata, and RAID configuration data. With complete images of all drives, the array can be reconstructed offline in a controlled environment using tools like mdadm or specialist RAID recovery software, preserving the original order and stripe parameters. This maintains chain of custody and enables repeatable analysis without modifying evidence.

Why this answer

Imaging each physical drive individually with a write blocker preserves the exact bit-for-bit state of every disk in the RAID array, including metadata, parity, and superblock information. This approach ensures that the logical volume can be reconstructed later in a controlled environment without altering the original evidence, which is critical for maintaining chain of custody and forensic integrity.

Exam trap

EC-Council often tests the misconception that imaging a logical volume or rebuilding the array is acceptable, but the trap here is that any operation that allows the RAID controller or OS to write to the drives (even during a read) can alter evidence, making individual physical imaging with a write blocker the only forensically sound method.

How to eliminate wrong answers

Option A is wrong because removing only the operating system drive from a RAID array destroys the array's configuration and may cause the controller to mark the remaining drives as degraded or foreign, potentially overwriting critical metadata. Option B is wrong because imaging a logical volume after the RAID controller introduces the risk of the controller altering data during read operations (e.g., on-the-fly parity recalculation or bad block remapping), and it does not capture the physical state of each drive, which may be needed for parity analysis or recovery of deleted data. Option D is wrong because rebuilding the array in a different system can trigger automatic synchronization or reconstruction processes that modify data on the drives, thereby contaminating the evidence and violating forensic best practices.

Practice this question →
66
MCQhard

During a forensic investigation, a first responder notices that a computer is running and suspects that volatile data may be present. According to best practices, what should the responder do to preserve the most volatile data first?

A.Perform a graceful shutdown to avoid data corruption
B.Remove the hard drive immediately while the system is running
C.Capture the contents of RAM using a forensic tool, then shut down
D.Immediately unplug the power cord to freeze the system state
AnswerC

This is the correct action because RAM is the most volatile data store and must be captured first per the forensics order of volatility (RFC 3227). A trusted memory acquisition tool — such as FTK Imager, WinPmem, or LiME — creates a bit-for-bit copy of physical memory, which is hashed (e.g., SHA-256) to preserve integrity. After the memory image is securely stored on external media, an administrator-issued shutdown writes only unavoidable OS logs and closes services in a controlled manner, preserving the disk while the critical volatile evidence is already secured.

Why this answer

Volatile data, such as the contents of RAM, is lost when power is removed. The first responder must capture this data using a forensic tool (e.g., FTK Imager, WinPmem, or LiME) before performing a shutdown. This follows the Order of Volatility (RFC 3227), which prioritizes capturing registers, cache, and RAM before any persistent storage.

Exam trap

The trap here is that candidates often confuse 'preserving data integrity' with 'avoiding corruption' and choose a graceful shutdown (Option A), not realizing that the shutdown process itself destroys the most volatile evidence.

How to eliminate wrong answers

Option A is wrong because a graceful shutdown allows the operating system to overwrite or clear volatile data (e.g., memory pages, temporary files, and encryption keys) during the shutdown process, destroying potential evidence. Option B is wrong because removing the hard drive while the system is running can cause electrical damage to the drive and controller, and it does not preserve RAM; the volatile data in memory is lost immediately when power is interrupted. Option D is wrong because immediately unplugging the power cord causes an abrupt loss of power, which destroys all volatile data in RAM and cache, and may also cause filesystem corruption on the hard drive due to incomplete write operations.

Practice this question →
67
MCQhard

During a forensic investigation, an analyst uses the following command: dd if=/dev/sda of=/mnt/evidence/image.dd bs=4096 conv=noerror,sync. What is the effect of the conv=noerror,sync option?

A.It verifies the integrity of the image using a hash algorithm
B.It ignores read errors and pads bad blocks with zeros in the output image
C.It creates a compressed image to save disk space
D.It enables logging of all I/O errors to a separate file
AnswerB

The `noerror` flag instructs `dd` to continue copying when it encounters read errors, while the `sync` flag pads each failed read block with zeros so that the output image retains the same block size and overall length as the source. This prevents the process from aborting and produces a complete, though partially zero-filled, image for analysis. Without these flags, `dd` would terminate on the first read error and leave an incomplete image.

Why this answer

The `conv=noerror,sync` option in `dd` instructs the tool to continue processing even when a read error is encountered (`noerror`) and to pad the output block with zeros (`sync`) to maintain the correct block size and offset alignment. This ensures that the forensic image remains a bit-for-bit copy of the source device in terms of size and structure, with corrupted sectors replaced by zeros rather than causing the imaging process to abort or produce a truncated image.

Exam trap

The CHFI exam often tests the misconception that `conv=noerror,sync` performs error correction or data recovery, when in fact it simply ignores errors and pads with zeros, which can lead to data loss if the analyst assumes the image is pristine.

How to eliminate wrong answers

Option A is wrong because `conv=noerror,sync` does not perform any hash verification; integrity verification is done separately using tools like `md5sum`, `sha1sum`, or `dd` with `conv=noerror` combined with a separate hash calculation. Option C is wrong because `dd` does not compress data; compression requires piping through `gzip` or using `conv=lz4` (if supported) or a separate compression tool. Option D is wrong because `dd` does not have a built-in logging feature for I/O errors; error logging must be implemented by redirecting stderr or using wrapper scripts.

Practice this question →
68
MCQeasy

In the context of the US Fourth Amendment, what is typically required for law enforcement to seize a computer for forensic examination?

A.A subpoena duces tecum
B.No legal authorization is needed if the computer is in plain view
C.Consent of the owner, a warrant, or exigent circumstances
D.Only a warrant issued by a judge
AnswerC

A computer may be lawfully seized under the Fourth Amendment based on (1) a warrant issued by a judge upon probable cause and particularly describing the things to be seized; (2) voluntary and intelligent consent given by the owner or a person with apparent authority, which can be limited in scope; or (3) exigent circumstances, such as imminent destruction of evidence or a threat to safety, that justify immediate action before obtaining a warrant. These are well-established exceptions routinely applied in digital forensics, allowing officers to secure a device while awaiting a warrant or to accept a user's consent to search and seize it. Therefore, this option correctly enumerates the primary situations in which computer seizure is lawful.

Why this answer

The Fourth Amendment requires law enforcement to obtain a warrant based on probable cause, obtain the owner's consent, or demonstrate exigent circumstances before seizing a computer for forensic examination. This protects against unreasonable searches and seizures, and a computer's storage capacity means it can contain vast amounts of personal data, so the same constitutional protections apply as to a physical home or vehicle.

Exam trap

EC-Council often tests the misconception that a warrant is always required, ignoring that consent and exigent circumstances are equally valid legal bases for seizure without a warrant.

How to eliminate wrong answers

Option A is wrong because a subpoena duces tecum compels the production of documents or records, but it does not authorize law enforcement to physically seize a computer for forensic examination; it is a discovery tool, not a search warrant. Option B is wrong because the plain view doctrine only applies if the officer is lawfully present and the incriminating nature of the computer is immediately apparent, but it does not automatically permit seizing the device for a full forensic examination without a warrant or other exception. Option D is wrong because while a warrant is a common method, it is not the only method; consent and exigent circumstances are also valid exceptions under the Fourth Amendment.

Practice this question →
69
MCQeasy

A first responder arrives at a crime scene where a computer is powered on and displaying a desktop. According to best practices, which of the following actions should the responder take FIRST?

A.Press Ctrl+Alt+Del to check for active user sessions.
B.Connect a write blocker and begin imaging the hard drive.
C.Unplug the power cord immediately to preserve volatile data.
D.Photograph the scene and the computer screen.
AnswerD

Photographing the scene and the computer screen is the first and most critical step because it creates a permanent, objective record of the system's exact state before any interaction occurs. The display may contain incriminating messages, open files, or system logs that are purely volatile and would be lost if the computer is touched, rebooted, or powered down. This documentation, including cable connections and visible media, solidifies the chain of custody and provides the contextual integrity that later forensic analysis depends on, which is why it takes precedence over any hardware or software intervention.

Why this answer

The first priority at a live crime scene is to document the state of the system before any interaction. Photographing the screen captures volatile data (e.g., open windows, running processes, time) that would be lost upon any keystroke or power change. This aligns with the order of volatility (RFC 3227) and ensures a legally defensible chain of custody from the outset.

Exam trap

The CHFI exam often tests the misconception that preserving volatile data means immediately pulling the plug, when in fact the correct first step is to document the live state without altering it.

How to eliminate wrong answers

Option A is wrong because pressing Ctrl+Alt+Del alters the system state (e.g., may trigger a secure attention sequence, lock the screen, or launch Task Manager), potentially destroying volatile evidence and violating the principle of non-interference. Option B is wrong because connecting a write blocker and imaging the hard drive requires physical access and software interaction that can modify the system’s memory and state; imaging should only occur after documenting and preserving volatile data. Option C is wrong because unplugging the power cord immediately destroys all volatile data (RAM, network connections, process lists) and can cause file system corruption, which is contrary to the goal of preserving evidence.

Practice this question →
70
Multi-Selecthard

A first responder arrives at a crime scene where a computer is running. Which THREE actions should the first responder take to preserve volatile evidence?

Select 3 answers
A.Collect contents of RAM using a tool like FTK Imager or dd
B.Unplug the power cord immediately
C.Record active network connections using netstat
D.Run a full antivirus scan on the system
E.Photograph the screen to capture current state
AnswersA, C, E

Collecting RAM with FTK Imager or dd is correct because memory holds volatile, ephemeral data—encryption keys, plaintext credentials, running processes, injected code, and evidence of malware that never touches disk. FTK Imager can create a forensic memory dump while dd, if used with a memory-specific driver, also works; both must be executed carefully to avoid altering the state they are capturing. This action preserves the single most fragile category of evidence before it disappears the moment the system loses power or reboots.

Why this answer

Option A is correct because RAM contents are highly volatile and lost on power-off, so capturing memory with a tool like FTK Imager or dd preserves running processes, encryption keys, and other in-memory artifacts. Option C is correct because netstat records active network connections and listening ports, which are volatile and can reveal remote sessions or exfiltration activity before they disappear. Option E is correct because photographing the screen captures the current visual state of the running system, including open windows and displayed data, without altering the machine.

Option B is not appropriate because unplugging the power cord immediately destroys volatile evidence such as RAM and active connections. Option D is not appropriate because running an antivirus scan modifies the system, overwrites volatile data, and can destroy evidence rather than preserve it.

Exam trap

EC-Council often tests the misconception that immediately cutting power is the safest action, but the trap is that this destroys the most volatile evidence (RAM) and can corrupt the filesystem, whereas a proper forensic response prioritizes capturing memory first.

Practice this question →
71
MCQhard

During an internal investigation, an employee is suspected of leaking sensitive data. The security team finds that the employee's computer has been turned off. Which of the following evidence types would be LOST due to the system being powered off?

A.System logs stored in the Event Viewer
B.Files stored on the hard drive
C.Registry hives
D.Contents of RAM and network connections
AnswerD

The contents of RAM and active network connections are the most volatile evidence on a live system. RAM loses all data the instant power is cut, wiping out running processes, open network sockets, and any decrypted data or encryption keys; likewise, the current TCP/UDP connection table, ARP cache, and routing state exist only while the operating system is operational. Consequently, these must be captured using live forensic toolkits before shutdown, as any delay or power loss destroys them irrecoverably.

Why this answer

When a system is powered off, the contents of volatile memory (RAM) are immediately lost because RAM requires constant electrical power to retain data. Similarly, active network connections are terminated and their state is lost, as they are maintained in kernel memory structures that are not persisted to disk. Therefore, any evidence residing only in RAM (e.g., encryption keys, running processes, unencrypted data) or transient network session details (e.g., active TCP/UDP connections, IP addresses) is permanently lost upon shutdown.

Exam trap

The CHFI exam often tests the distinction between volatile and non-volatile evidence, and the trap here is that candidates mistakenly think system logs or registry hives are volatile because they are 'system' data, when in fact they are stored on the hard drive and persist after power-off.

How to eliminate wrong answers

Option A is wrong because system logs stored in the Event Viewer are written to the hard drive (e.g., %SystemRoot%\System32\winevt\Logs\) and persist across reboots; they are not lost when the system is powered off. Option B is wrong because files stored on the hard drive are non-volatile and remain intact after shutdown; they can be imaged and analyzed forensically even after power loss. Option C is wrong because registry hives (e.g., SAM, SYSTEM, SOFTWARE) are stored as files on the hard drive (e.g., C:\Windows\System32\config\) and survive power-off; they are not dependent on RAM for persistence.

Practice this question →
72
MCQmedium

A forensic examiner uses a hardware write blocker when imaging a suspect's hard drive. What is the primary function of a hardware write blocker?

A.To encrypt the data on the suspect drive
B.To prevent any data from being written to the suspect drive
C.To connect the suspect drive via USB
D.To increase the speed of data acquisition
AnswerB

A hardware write blocker is designed to guarantee the integrity of digital evidence by intercepting write commands from the forensic host to the suspect drive. It allows read-only access at the physical interface, ensuring that no bytes are altered on the source media during acquisition or analysis. This preservation of the original evidence is essential for maintaining a chain of custody and for admissibility in court.

Why this answer

A hardware write blocker is a device placed between the suspect drive and the forensic workstation that intercepts and blocks any write commands from the host system. Its primary function is to ensure that no data—such as file system metadata, temporary files, or operating system writes—can be written to the suspect drive, thereby preserving the original evidence in a forensically sound manner. This is critical for maintaining the integrity of the evidence and ensuring it is admissible in court.

Exam trap

EC-Council often tests the distinction between the function of a write blocker (preventing writes) and its physical interface (e.g., USB), leading candidates to mistakenly choose the interface option as the primary function.

How to eliminate wrong answers

Option A is wrong because encrypting the data on the suspect drive would alter the evidence and is not the function of a write blocker; encryption is a separate process typically applied to the forensic image, not the original drive. Option C is wrong because while many hardware write blockers do connect via USB or other interfaces, that is a means of connection, not the primary function; the core purpose is write protection, not the interface type. Option D is wrong because hardware write blockers do not increase acquisition speed; in fact, they may introduce a slight latency, and speed is determined by the drive interface and imaging software, not the blocker itself.

Practice this question →
73
MCQmedium

A company receives a legal hold notice regarding a lawsuit. What immediate action should the company take to comply?

A.Delete all emails older than 30 days to free up storage
B.Immediately format the hard drives of all employees involved
C.Preserve all potentially relevant electronic documents and data
D.Ignore the notice because it is not a court order
AnswerC

The correct action is to implement a litigation hold preserving all potentially relevant electronic documents and data, including emails, attachments, metadata, and backup copies. The organization must notify custodians of their duty and suspend any automated deletion, archiving, or alteration processes. This protects the integrity and provenance of the ESI so it can be produced in discovery without allegations of spoliation.

Why this answer

A legal hold notice triggers a duty to preserve all potentially relevant electronically stored information (ESI). Under the Federal Rules of Civil Procedure (FRCP) Rule 37(e), failure to preserve can lead to spoliation sanctions. The immediate action is to issue a litigation hold notice and suspend routine data deletion policies, ensuring that all relevant emails, documents, and logs are preserved in their current state.

Exam trap

EC-Council often tests the misconception that a legal hold notice is optional or that routine deletion policies can continue, but the trap is that preservation duties begin immediately upon anticipation of litigation, regardless of whether a formal court order has been served.

How to eliminate wrong answers

Option A is wrong because deleting emails older than 30 days violates the preservation obligation and constitutes spoliation, which can result in adverse inference instructions or monetary sanctions. Option B is wrong because formatting hard drives destroys all data, including potentially relevant evidence, and is a textbook example of intentional spoliation. Option D is wrong because a legal hold notice, even if not a formal court order, carries legal weight under FRCP and common law; ignoring it can lead to severe penalties for failure to preserve evidence.

Practice this question →
74
MCQmedium

A security analyst notices that a log file on a Linux server shows repeated failed SSH login attempts from an external IP address, but no successful login from that IP. However, the /var/log/auth.log file has been recently truncated. Which type of evidence is the truncated log file?

A.Hearsay evidence
B.Best evidence
C.Circumstantial evidence
D.Direct evidence
AnswerC

Circumstantial evidence requires a logical inference to connect the evidence to a fact in issue, such as inferring intent from behavior. The truncated log is not the basis for an inference; its tampered state is the very fact at issue and is observable directly. Because no intermediate deduction is needed to see that the file has been altered, it is not merely circumstantial.

Why this answer

The truncated log file is circumstantial evidence. While the truncation itself is a directly observable fact, the conclusion that someone intentionally altered or destroyed the log to conceal failed SSH attempts requires inference. Other explanations (e.g., log rotation, system error) are possible.

Direct evidence proves a fact without inference, such as an eyewitness testimony or a video recording of the tampering. Therefore, the truncated log file is circumstantial evidence.

Exam trap

The trap is to confuse the physical existence of an artifact with direct evidence. Direct evidence must prove the ultimate fact without relying on inference. A truncated file's condition only suggests tampering through reasoning, making it circumstantial.

How to eliminate wrong answers

Option A is wrong because hearsay evidence is an out-of-court statement offered to prove the truth of the matter asserted, and a truncated log file is not a statement but a physical artifact; forensic examiners treat logs as real evidence, not hearsay. Option B is wrong because best evidence refers to the original document or recording when its content is at issue, but here the issue is the state of the log file (truncated), not the content of the log entries; the truncated file itself is the best evidence of tampering, but the term 'best evidence' is a legal rule about proving the content of a writing, not a classification of evidence type. Option C is wrong because circumstantial evidence requires an inference to connect the evidence to a fact (e.g., the truncation implies someone deleted logs), but the truncated log file is direct evidence of the act of truncation itself—no inference is needed to see that the file was truncated.

Practice this question →
75
MCQmedium

Which of the following is the BEST description of Locard's exchange principle as applied to digital forensics?

A.Only original evidence is admissible in court
B.Digital evidence must be collected in a manner that preserves its integrity
C.Every contact leaves a trace; the perpetrator will leave digital traces on the crime scene
D.Evidence must be documented with a chain of custody
AnswerC

Locard's exchange principle states that every contact leaves a trace, and in the digital realm this manifests as persistent or volatile artifacts: log entries, deleted file fragments, browser history, network connections, or metadata on the victim's system. When a perpetrator accesses, copies, or exfiltrates data, they necessarily leave digital traces on the target's storage media, memory, or network infrastructure, just as physical contact transfers fibers. Digital forensics operationalizes this principle by identifying and recovering those traces to reconstruct the crime and link the suspect to the scene, making this the correct description.

Why this answer

Locard's exchange principle states that every contact leaves a trace. In digital forensics, this means that when a perpetrator interacts with a system—whether by accessing files, running commands, or connecting to a network—they inevitably leave digital artifacts such as log entries, registry keys, metadata, or network connection records. Option C correctly captures this core concept of trace transfer in the digital domain.

Exam trap

EC-Council often tests whether candidates confuse Locard's exchange principle with general forensic procedures like chain of custody or evidence integrity, so the trap is picking a correct-sounding but non-specific option (B or D) instead of the precise definition of trace transfer.

How to eliminate wrong answers

Option A is wrong because it misstates admissibility rules; evidence does not have to be original to be admissible—duplicates or copies are often acceptable under rules like Federal Rule of Evidence 1003, provided they are accurate and authentic. Option B is wrong because it describes the general requirement for evidence integrity and proper collection procedures, which is a forensic best practice but not a description of Locard's exchange principle. Option D is wrong because chain of custody is a documentation process to track evidence handling, not a statement about the transfer of traces between a perpetrator and a crime scene.

Practice this question →
Page 1 of 2 · 128 questions totalNext →

Ready to test yourself?

Try a timed practice session using only Chfi Fundamentals Process questions.

Start 20-question session