Computer Forensics Lab practice questions

During a forensic investigation, an analyst needs to acquire data from a live Windows system without altering the system's state. Which tool should the analyst use to capture the contents of RAM?

Trap 1: dd

dd is used for disk imaging, not RAM capture.

Trap 2: EnCase

EnCase is a comprehensive forensic suite but not ideal for live RAM capture without system alteration.

Trap 3: WinHex

WinHex can capture RAM but may alter the system state.

A
dd
Why wrong: dd is used for disk imaging, not RAM capture.
B
FTK Imager Lite
FTK Imager Lite is designed to capture RAM from a live system without altering the system's state.
C
EnCase
Why wrong: EnCase is a comprehensive forensic suite but not ideal for live RAM capture without system alteration.
D
WinHex
Why wrong: WinHex can capture RAM but may alter the system state.

Question 2hardmultiple choice

A forensic lab is designing a network architecture to ensure the integrity of evidence during acquisition. What is the most critical design consideration?

Trap 1: Deploy multiple forensic workstations to parallelize tasks

Parallelization improves efficiency, not integrity.

Trap 2: Use a segmented network to isolate forensic tools

Segmentation helps but does not directly ensure integrity.

Trap 3: Encrypt all data in transit over the network

Encryption protects confidentiality, not integrity.

A
Deploy multiple forensic workstations to parallelize tasks
Why wrong: Parallelization improves efficiency, not integrity.
B
Use a segmented network to isolate forensic tools
Why wrong: Segmentation helps but does not directly ensure integrity.
C
Encrypt all data in transit over the network
Why wrong: Encryption protects confidentiality, not integrity.
D
Implement hardware write-blockers on all acquisition stations
Write-blockers prevent any writes to the source drive, ensuring integrity.

Question 3easymultiple choice

A forensic analyst is troubleshooting a write-blocker that is not working correctly. The analyst connected the write-blocker between the suspect drive and the forensic workstation, but the workstation still shows the drive as writable. What is the most likely cause?

Trap 1: The write-blocker does not have external power

Most write-blockers are powered via USB or external adapter.

Trap 2: The suspect drive uses SATA but the write-blocker is USB-only

If the write-blocker supports SATA, this is not an issue.

Trap 3: The write-blocker is connected to the suspect drive's output port

The write-blocker should be between the workstation and the drive.

A
The suspect drive was connected before the write-blocker was powered on
Connecting the drive before powering the write-blocker can bypass the write-block.
B
The write-blocker does not have external power
Why wrong: Most write-blockers are powered via USB or external adapter.
C
The suspect drive uses SATA but the write-blocker is USB-only
Why wrong: If the write-blocker supports SATA, this is not an issue.
D
The write-blocker is connected to the suspect drive's output port
Why wrong: The write-blocker should be between the workstation and the drive.

Question 4mediummultiple choice

A forensic lab is establishing a chain of custody procedure. Which practice is considered best according to CHFI guidelines?

Trap 1: Require biometric authentication for all lab personnel

Biometrics control access, not track custody.

Trap 2: Store evidence in a secure room with limited access

Physical security is important but does not document custody.

Trap 3: Use encryption to protect evidence files

Encryption protects confidentiality, not chain of custody.

A
Require biometric authentication for all lab personnel
Why wrong: Biometrics control access, not track custody.
B
Store evidence in a secure room with limited access
Why wrong: Physical security is important but does not document custody.
C
Use encryption to protect evidence files
Why wrong: Encryption protects confidentiality, not chain of custody.
D
Document every transfer of evidence with signatures and timestamps
Documentation is key to maintaining chain of custody.

Question 5hardmulti select

Which TWO of the following are essential components of a computer forensics lab according to CHFI best practices?

Trap 1: Server farm for data processing

Not essential; can be outsourced.

Trap 2: Public-facing website for case management

Not an essential lab component.

Trap 3: Coffee machine for staff convenience

Not essential.

A
Server farm for data processing
Why wrong: Not essential; can be outsourced.
B
Evidence storage area with controlled access
Critical for evidence integrity.
C
Public-facing website for case management
Why wrong: Not an essential lab component.
D
Coffee machine for staff convenience
Why wrong: Not essential.
E
Forensic workstation with specialized software
Required for analysis.

Question 6mediummulti select

Which THREE of the following are recommended practices for maintaining the integrity of digital evidence in a forensics lab?

Trap 1: Perform regular backups of all evidence

Backups are for preservation, not integrity.

Trap 2: Run antivirus scans on evidence before analysis

Antivirus software may modify files.

A
Maintain a detailed chain of custody log
Documents handling and prevents tampering.
B
Generate cryptographic hashes of evidence files
Hashes verify that evidence has not been altered.
C
Use hardware write-blockers during acquisition
Prevents modification of source drive.
D
Perform regular backups of all evidence
Why wrong: Backups are for preservation, not integrity.
E
Run antivirus scans on evidence before analysis
Why wrong: Antivirus software may modify files.

Question 7easymultiple choice

You are a forensic analyst in a corporate lab. A compromised server was taken offline and brought to the lab. The server runs Windows Server 2019 with a RAID 5 array of three 1TB SATA drives. The drives are hot-swappable. The server was shut down properly before removal. The lab has a forensic workstation with write-blockers, a hardware RAID controller, and imaging software. The analyst needs to acquire a forensic image of the RAID array. What is the correct course of action?

Trap 1: Send the drives to a vendor for specialized RAID recovery

Outsourcing risks chain of custody and is not necessary.

Trap 2: Image each drive individually using a write-blocker and then…

Individual images lack RAID metadata and cannot be combined correctly.

Trap 3: Connect all drives to the forensic workstation and use a software…

Software RAID may not correctly parse hardware RAID metadata.

A
Reconstruct the RAID array using the same controller model in the lab, then image the logical volume via a write-blocker
This preserves the logical structure and ensures integrity.
B
Send the drives to a vendor for specialized RAID recovery
Why wrong: Outsourcing risks chain of custody and is not necessary.
C
Image each drive individually using a write-blocker and then combine the images in software
Why wrong: Individual images lack RAID metadata and cannot be combined correctly.
D
Connect all drives to the forensic workstation and use a software RAID tool to assemble the array
Why wrong: Software RAID may not correctly parse hardware RAID metadata.

Question 8mediummultiple choice

A forensic lab manager is setting up a new lab and must decide on the physical security measures. Which of the following is the MOST important to implement first?

Trap 1: Construct Faraday cages around the evidence storage area

Faraday cages are specific to preventing wireless signals and not a general security measure.

Trap 2: Deploy CCTV cameras covering all entry points

CCTV is for monitoring and evidence collection, not for preventing unauthorized access.

Trap 3: Install a gas-based fire suppression system

Fire suppression is important but not the most immediate security measure; access control is foundational.

A
Construct Faraday cages around the evidence storage area
Why wrong: Faraday cages are specific to preventing wireless signals and not a general security measure.
B
Deploy CCTV cameras covering all entry points
Why wrong: CCTV is for monitoring and evidence collection, not for preventing unauthorized access.
C
Install a gas-based fire suppression system
Why wrong: Fire suppression is important but not the most immediate security measure; access control is foundational.
D
Implement a biometric access control system
Biometric access control prevents unauthorized entry, which is the first line of defense.

Question 9hardmultiple choice

Refer to the exhibit. A forensic examiner is analyzing a Windows system and sees the above NTFS file metadata. The user claims the file was last accessed at 09:15. Which of the following best explains the discrepancy?

Exhibit

Refer to the exhibit.

=== File System Analysis Report ===
Drive: /dev/sda1 (NTFS)
Inode: 2345
File: critical_data.docx
Creation Time: 2024-03-10 09:15:00 UTC
Last Modified: 2024-03-10 09:20:00 UTC
Last Access: 2024-03-10 09:25:00 UTC
$LogFile Sequence Number: 123456
$UsnJrnl: Entry 7890
=== End of Report ===

Trap 1: The system has disabled last access time updates, so the reported…

If disabled, the last access time would not change; here it changed to 09:25, so updates are enabled.

Trap 2: The creation time is earlier than the last access, indicating the…

Creation time being earlier than last access is normal; no indication of copying.

Trap 3: The $LogFile sequence number indicates a transaction rollback that…

$LogFile is for file system transactions, not for timestamp adjustments.

A
The $UsnJrnl entry shows the file was modified, and the last access time was updated by the system when the file was opened for reading
The $UsnJrnl records changes; the last access time is updated on read operations, explaining the later timestamp.
B
The system has disabled last access time updates, so the reported times are unreliable
Why wrong: If disabled, the last access time would not change; here it changed to 09:25, so updates are enabled.
C
The creation time is earlier than the last access, indicating the file was copied from another volume
Why wrong: Creation time being earlier than last access is normal; no indication of copying.
D
The $LogFile sequence number indicates a transaction rollback that reset the timestamps
Why wrong: $LogFile is for file system transactions, not for timestamp adjustments.

Question 10easymulti select

Which TWO of the following are essential requirements for a computer forensics lab according to best practices?

Trap 1: Offsite cloud storage for all case files

Cloud storage without proper encryption and compliance may breach confidentiality.

Trap 2: Shared workstations to reduce hardware costs

Shared workstations can lead to cross-contamination of evidence.

Trap 3: Open wireless network for flexibility

Open wireless networks are insecure; wired networks are recommended.

A
Uninterruptible power supply (UPS) and surge protectors
Clean power is critical to protect forensic equipment and prevent data loss.
B
Offsite cloud storage for all case files
Why wrong: Cloud storage without proper encryption and compliance may breach confidentiality.
C
Shared workstations to reduce hardware costs
Why wrong: Shared workstations can lead to cross-contamination of evidence.
D
Restricted access with visitor logs and biometric authentication
Access control ensures only authorized individuals handle evidence.
E
Open wireless network for flexibility
Why wrong: Open wireless networks are insecure; wired networks are recommended.

Question 11mediummulti select

A forensic examiner is setting up a new lab. Which THREE of the following practices are essential for maintaining the integrity of digital evidence?

Trap 1: Perform regular backups of the forensic workstation’s operating…

Incorrect: While good practice, this does not directly affect evidence integrity.

Trap 2: Disable write-blocking when imaging drives to improve speed.

Incorrect: Disabling write-blocking can alter evidence and is not a best practice.

A
Perform regular backups of the forensic workstation’s operating system.
Why wrong: Incorrect: While good practice, this does not directly affect evidence integrity.
B
Disable write-blocking when imaging drives to improve speed.
Why wrong: Incorrect: Disabling write-blocking can alter evidence and is not a best practice.
C
Use write-blocking devices when acquiring data from suspect drives.
Correct: Write-blockers prevent alteration of original evidence.
D
Implement a chain-of-custody procedure for all evidence.
Correct: Chain-of-custody is fundamental to evidence integrity.
E
Store evidence in a secure, access-controlled environment.
Correct: Secure storage prevents tampering or loss.

Question 12hardmultiple choice

Refer to the exhibit. The FTK Imager output shows a disk with an NTFS partition. The examiner notes that the $MFT mirror is at cluster 2. What is the logical size of the $MFT mirror in bytes?

Exhibit

Refer to the exhibit.

FTK Imager command output:

Sector size: 512
Total sectors: 625142448
Partition start: 2048
Partition end: 625139712
Partition type: NTFS (07)

Flags: 0x80 (Bootable)

File system: NTFS
Volume label: EVIDENCE_DRIVE
Serial number: 1234-5678

$MFT mirror: cluster 2
$MFT: cluster 0
Clusters per record: 1
Bytes per cluster: 4096

Trap 1: 320 GB

Incorrect: This is the total disk capacity, not the $MFT mirror size.

Trap 2: 512 bytes

Incorrect: 512 bytes is the sector size, not the $MFT mirror size.

Trap 3: 8192 bytes

Incorrect: This would be two clusters, but the output shows clusters per record = 1.

A
320 GB
Why wrong: Incorrect: This is the total disk capacity, not the $MFT mirror size.
B
512 bytes
Why wrong: Incorrect: 512 bytes is the sector size, not the $MFT mirror size.
C
4096 bytes
Correct: The $MFT mirror occupies one cluster (4096 bytes) when clusters per record = 1.
D
8192 bytes
Why wrong: Incorrect: This would be two clusters, but the output shows clusters per record = 1.

Read the full NAT/PAT explanation →

Question 13easymultiple choice

You are a forensic examiner at a corporate security firm. You receive a laptop from the HR department that belonged to a terminated employee. The laptop was used for company business and is suspected of containing unauthorized file-sharing software. The laptop is running Windows 10 with BitLocker drive encryption enabled. Before shutdown, the employee was logged into the system. HR claims the laptop was shut down properly and then handed over within an hour. You are asked to acquire a forensic image of the hard drive for analysis. However, when you boot the laptop, you are prompted for the BitLocker recovery key. HR does not have the key, and the employee refuses to cooperate. The laptop also has a TPM chip. Which of the following is the most appropriate course of action to acquire the data?

Trap 1: Contact IT to obtain the BitLocker recovery key from Active…

Incorrect: This is a valid option if normal boot fails, but not the first step because the TPM should work.

Trap 2: Perform a cold boot attack to extract the BitLocker key from memory.

Incorrect: This is a complex and invasive technique that should only be used if normal boot fails.

Trap 3: Boot from a Linux live USB and use tools to bypass BitLocker.

Incorrect: Without the key, Linux cannot decrypt the drive.

A
Contact IT to obtain the BitLocker recovery key from Active Directory.
Why wrong: Incorrect: This is a valid option if normal boot fails, but not the first step because the TPM should work.
B
Perform a cold boot attack to extract the BitLocker key from memory.
Why wrong: Incorrect: This is a complex and invasive technique that should only be used if normal boot fails.
C
Boot from a Linux live USB and use tools to bypass BitLocker.
Why wrong: Incorrect: Without the key, Linux cannot decrypt the drive.
D
Boot the laptop normally and let BitLocker unlock the drive using the TPM.
Correct: Since the laptop was shut down properly and has TPM, normal boot should unlock the drive without the recovery key.

Question 14mediumdrag order

Drag and drop the steps to recover deleted files using Recuva into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 15mediummatching