CHFI Computer Forensics Fundamentals and Process Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  To suspend the deletion of data that may be relevant to upcoming litigation

  Why this is correct

  A legal hold, also known as a litigation hold, is a proactive directive issued to suspend any routine deletion or destruction of data that could be discoverable in pending or reasonably anticipated litigation. It overrides standard data retention policies and disables automatic purging mechanisms so that electronically stored information (ESI) remains intact for ediscovery and potential use as evidence. Implementing a legal hold is a cornerstone of the duty to preserve, and failure to do so can result in spoliation sanctions.

• ✗

  To encrypt data for secure storage

  Why it's wrong here

  Encryption is a confidentiality protection that encodes data using cryptographic algorithms to prevent unauthorized access; it does nothing to control the lifecycle of records, including whether data is retained or purged. A legal hold requires that data be preserved in a readily accessible and unaltered form for potential discovery, but encryption alone neither stops deletion nor ensures data remains authentic. In fact, if encryption keys are lost or escrow is inadequate, encrypted evidence may become inaccessible, potentially violating a discovery obligation rather than fulfilling it.

• ✗

  To obtain a search warrant for digital evidence

  Why it's wrong here

  A search warrant is a court-issued authorization that allows law enforcement or a government agency to search and seize specific evidence; it is coercive and derived from the Fourth Amendment. A legal hold, by contrast, is an internal, self-imposed measure stemming from the common law duty to preserve evidence once litigation is reasonably anticipated, and it requires no judicial approval. While executing a search warrant may result in data collection, it is not the purpose of a legal hold, which operates through private organizational policies and IT retention settings rather than through governmental compulsory process.

• ✗

  To permanently delete irrelevant data

  Why it's wrong here

  A legal hold is inherently a preservation mechanism; its entire objective is to prevent the destruction, alteration, or loss of potentially relevant evidence, not to eliminate data. Permanently deleting irrelevant data may be part of regular records management, but once a legal hold is in place, deletions of even seemingly irrelevant data are halted to avoid any risk of spoliation. Intentionally deleting data under a legal hold would destroy evidence and constitute spoliation, which is the very misconduct the legal hold is designed to prevent.

Go deeper

Related to this question