How should I use these Computer Forensics Investigation Process practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

CHFI · topic practice

Computer Forensics Investigation Process practice questions

Q: Can I practise just Computer Forensics Investigation Process questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Computer Forensics Investigation Process domain.

Practise Computer Hacking Forensic Investigator CHFI Computer Forensics Investigation Process practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

10 questionsDomain: Computer Forensics Investigation Process

Practice 10 questions Browse domain →

What the exam tests

What to know about Computer Forensics Investigation Process

Computer Forensics Investigation Process questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Computer Forensics Investigation Process exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Computer Forensics Investigation Process questions

10 questions · select your answer, then reveal the explanation

Question 1easymultiple choice

Read the full Computer Forensics Investigation Process explanation →

During a forensic investigation, an analyst discovers that the suspect's hard drive was encrypted using BitLocker. The analyst has obtained the recovery key. Which of the following is the best next step to ensure data integrity?

Trap 1: Decrypt the drive using the recovery key and then create a forensic…

Decrypting first modifies the drive, potentially altering evidence.

Trap 2: Run a live analysis tool to extract encryption keys from memory.

This does not address the need for a forensic image and may alter memory.

Trap 3: Boot the suspect computer and copy files to an external drive.

Booting modifies the system and does not preserve the full drive image.

Study all Computer Forensics Investigation Process common traps →

A
Decrypt the drive using the recovery key and then create a forensic image.
Why wrong: Decrypting first modifies the drive, potentially altering evidence.
B
Run a live analysis tool to extract encryption keys from memory.
Why wrong: This does not address the need for a forensic image and may alter memory.
C
Create a forensic image of the encrypted drive, then decrypt the image.
This preserves the original encrypted state and allows analysis of the decrypted image.
D
Boot the suspect computer and copy files to an external drive.
Why wrong: Booting modifies the system and does not preserve the full drive image.

Full breakdown with real-world context →

Question 2mediummultiple choice

Read the full Computer Forensics Investigation Process explanation →

A CHFI analyst is called to investigate a suspected data breach. The IT team has already shut down the server. Which of the following is the most appropriate order of actions to preserve evidence?

Trap 1: Immediately power on the server to check for running processes.

Powering on modifies evidence and is not recommended.

Trap 2: Copy all files from the server to an external USB drive.

Copying files does not preserve deleted data or metadata; imaging is required.

Trap 3: Run antivirus scan to ensure no malware is present before imaging.

Running software on the evidence drive alters it.

Study all Computer Forensics Investigation Process common traps →

A
Immediately power on the server to check for running processes.
Why wrong: Powering on modifies evidence and is not recommended.
B
Copy all files from the server to an external USB drive.
Why wrong: Copying files does not preserve deleted data or metadata; imaging is required.
C
Run antivirus scan to ensure no malware is present before imaging.
Why wrong: Running software on the evidence drive alters it.
D
Secure the scene, photograph the setup, document connections, remove hard drives, and create forensic images using a write-blocker.
This follows proper forensic procedure: secure, document, collect, image with write-blocker.

Full breakdown with real-world context →

Question 3hardmultiple choice

Read the full Computer Forensics Investigation Process explanation →

An incident responder has acquired a forensic image of a Linux server suspected of being compromised. The image was taken using 'dd' with no compression. The analyst needs to verify the integrity of the image. Which command should be used and what should be compared?

Trap 1: Use 'cmp' to compare the image byte-by-byte with the original drive.

This is impractical and would modify the original drive if connected.

Trap 2: Use 'md5sum image.dd' and compare with the original file's MD5 hash…

MD5 is weaker and the original hash may not be trustworthy.

Trap 3: Run 'fsck' on the image to check for filesystem errors.

fsck checks filesystem consistency, not image integrity.

Study all Computer Forensics Investigation Process common traps →

A
Use 'cmp' to compare the image byte-by-byte with the original drive.
Why wrong: This is impractical and would modify the original drive if connected.
B
Use 'md5sum image.dd' and compare with the original file's MD5 hash provided by the system administrator.
Why wrong: MD5 is weaker and the original hash may not be trustworthy.
C
Run 'fsck' on the image to check for filesystem errors.
Why wrong: fsck checks filesystem consistency, not image integrity.
D
Use 'sha256sum image.dd' and compare with the hash computed during acquisition from the source device.
SHA-256 is strong and comparing with the hash from the source verifies integrity.

Full breakdown with real-world context →

Question 4mediummulti select

Read the full Computer Forensics Investigation Process explanation →

Which TWO of the following are considered essential steps in the computer forensics investigation process according to EC-Council guidelines?

Trap 1: Data recovery from damaged media

This is a specific technique, not a universal step.

Trap 2: Deletion of irrelevant data

Deleting data would destroy evidence.

Trap 3: Public disclosure of findings

Findings are confidential and disclosed only as required.

Study all Computer Forensics Investigation Process common traps →

A
Identification of potential evidence
Identification is the first step in the forensic process.
B
Data recovery from damaged media
Why wrong: This is a specific technique, not a universal step.
C
Deletion of irrelevant data
Why wrong: Deleting data would destroy evidence.
D
Preservation of the integrity of evidence
Preservation is critical to maintain chain of custody.
E
Public disclosure of findings
Why wrong: Findings are confidential and disclosed only as required.

Full breakdown with real-world context →

Question 5mediummultiple choice

Read the full Computer Forensics Investigation Process explanation →

An analyst executed the commands shown in the exhibit on a Windows system to prepare a forensic image for analysis. What is the most likely reason for the error message from e2fsck?

Exhibit

Refer to the exhibit.

C:\> fsutil volume dismount C:

C:\> diskpart
DISKPART> select volume 1
DISKPART> attribute volume clear readonly
DISKPART> exit

C:\> e2fsck -fn image.dd

e2fsck 1.45.6 (20-Mar-2020)
Pass 1: Checking inodes, blocks, and sizes
Pass 2: Checking directory structure
Pass 3: Checking directory connectivity
Pass 4: Checking reference counts
Pass 5: Checking group summary information
image.dd: ********** WARNING: Filesystem still has errors **********

Trap 1: The forensic image was not acquired with a write-blocker, causing…

While possible, the commands show diskpart operations, not acquisition.

Trap 2: The image file contains an NTFS filesystem, but e2fsck is designed…

If it were NTFS, e2fsck would likely fail to recognize it, not show ext-specific errors.

Trap 3: The e2fsck command syntax is incorrect; it should be 'e2fsck -f -n'…

The syntax is valid; -fn is equivalent to -f -n.

Study all Computer Forensics Investigation Process common traps →

A
The analyst failed to properly dismount the source volume before imaging, leading to filesystem inconsistencies.
The fsutil dismount command was run on C:, but the image was taken later, possibly without ensuring the volume was cleanly unmounted.
B
The forensic image was not acquired with a write-blocker, causing data corruption.
Why wrong: While possible, the commands show diskpart operations, not acquisition.
C
The image file contains an NTFS filesystem, but e2fsck is designed for ext filesystems.
Why wrong: If it were NTFS, e2fsck would likely fail to recognize it, not show ext-specific errors.
D
The e2fsck command syntax is incorrect; it should be 'e2fsck -f -n' instead.
Why wrong: The syntax is valid; -fn is equivalent to -f -n.

Full breakdown with real-world context →

Question 6hardmultiple choice

Read the full Computer Forensics Investigation Process explanation →

You are a CHFI analyst responding to a security incident at a medium-sized financial firm. The IT team reports that an employee's workstation (Windows 10, single SSD) was used to access sensitive customer data without authorization. The workstation is still running, and the employee is currently logged in. The IT team has isolated the machine from the network but has not powered it off. You have been called to perform forensic acquisition. The company policy requires preservation of volatile data and a full disk image. The machine has 16 GB RAM and a 512 GB SSD. You have a forensic toolkit including FTK Imager, win32dd (for memory acquisition), and a write-blocker. Which of the following is the best course of action?

Trap 1: Perform a graceful shutdown via the operating system, then remove…

Graceful shutdown modifies the disk (writes log files, etc.) and loses memory evidence.

Trap 2: Boot the workstation from a forensic live CD, then use 'dd' to…

Booting from a live CD will overwrite some memory and may not capture the current state of running processes.

Trap 3: Immediately shut down the workstation by unplugging the power cord,…

Unplugging loses volatile memory and may cause filesystem damage; also, memory evidence is lost.

Study all Computer Forensics Investigation Process common traps →

A
Use win32dd to capture the contents of RAM to an external drive, then use FTK Imager to create a physical image of the SSD over the network to a secure share.
This captures memory first (volatile data) and then acquires a disk image while the system is still running, preserving evidence.
B
Perform a graceful shutdown via the operating system, then remove the SSD and image it using a hardware write-blocker.
Why wrong: Graceful shutdown modifies the disk (writes log files, etc.) and loses memory evidence.
C
Boot the workstation from a forensic live CD, then use 'dd' to image the SSD to an external USB drive.
Why wrong: Booting from a live CD will overwrite some memory and may not capture the current state of running processes.
D
Immediately shut down the workstation by unplugging the power cord, remove the SSD, and create a forensic image using a write-blocker on a forensic workstation.
Why wrong: Unplugging loses volatile memory and may cause filesystem damage; also, memory evidence is lost.

Full breakdown with real-world context →

Question 7mediumdrag order

Read the full Computer Forensics Investigation Process explanation →

Drag and drop the steps to perform forensic imaging of a hard drive using FTK Imager into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 8mediumdrag order

Read the full Computer Forensics Investigation Process explanation →

Drag and drop the steps to perform a forensic analysis of a PDF file for hidden data or malicious content into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 9mediummatching

Read the full Computer Forensics Investigation Process explanation →

Match each forensic tool to its primary purpose.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Acquisition and preview of disk images

Forensic analysis and evidence processing

Memory forensics and analysis

Network packet capture and analysis

Open-source file system analysis

Question 10mediummatching

Read the full Computer Forensics Investigation Process explanation →

Match each email forensic artifact to its source.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Message source (RFC 5322 headers)

Microsoft Outlook personal folder

Microsoft Exchange server

Unix-based email clients

Individual email message export

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Computer Forensics Investigation Process sessions

Start a Computer Forensics Investigation Process only practice session

Every question in these sessions is drawn from the Computer Forensics Investigation Process domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Computer Forensics Investigation Process questions →Mixed CHFI session

Frequently asked questions

What does the CHFI exam test about Computer Forensics Investigation Process?: Computer Forensics Investigation Process questions test whether you can apply the concept in context, not just recognise a definition.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Computer Forensics Investigation Process questions in a focused session?: Yes — the session launcher on this page draws every question from the Computer Forensics Investigation Process domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other CHFI topics?: Use the topic links above to move to related areas, or go back to the CHFI question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the CHFI exam covers. They are not copied from any real exam or dump site.

Computer Forensics Investigation Process only

10 questions 20 questions 30 questions 50 questions

Mixed CHFI session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All CHFI questions Computer Forensics Investigation Process domain overview CHFI exam guide

Exam traps to avoid

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Computer Forensics Investigation Process practice questions

What to know about Computer Forensics Investigation Process

Common Computer Forensics Investigation Process exam traps

Computer Forensics Investigation Process questions

During a forensic investigation, an analyst discovers that the suspect's hard drive was encrypted using BitLocker. The analyst has obtained the recovery key. Which of the following is the best next step to ensure data integrity?

A CHFI analyst is called to investigate a suspected data breach. The IT team has already shut down the server. Which of the following is the most appropriate order of actions to preserve evidence?

An incident responder has acquired a forensic image of a Linux server suspected of being compromised. The image was taken using 'dd' with no compression. The analyst needs to verify the integrity of the image. Which command should be used and what should be compared?

Which TWO of the following are considered essential steps in the computer forensics investigation process according to EC-Council guidelines?

An analyst executed the commands shown in the exhibit on a Windows system to prepare a forensic image for analysis. What is the most likely reason for the error message from e2fsck?

Exhibit

Drag and drop the steps to perform forensic imaging of a hard drive using FTK Imager into the correct order.

Drag and drop the steps to perform a forensic analysis of a PDF file for hidden data or malicious content into the correct order.

Match each forensic tool to its primary purpose.

Match each email forensic artifact to its source.

Track your progress over time

Start a Computer Forensics Investigation Process only practice session

Related CHFI topic practice pages