CHFI Computer Forensics Fundamentals and Process Practice Question
Which THREE of the following are steps in the forensic investigation process? (Select three.)
⚠ Common exam trap
EC-Council often tests the distinction between the forensic investigation process and the broader legal or judicial process, leading candidates to mistakenly include post-investigation actions like sentencing as a forensic step.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Analysis
In the forensic investigation process, First response (D) is the initial step where the investigator secures the scene, preserves volatile evidence, and documents the state of systems to prevent contamination. Analysis (A) follows, where the collected data is examined using validated tools and techniques to reconstruct events and identify artifacts relevant to the incident. Reporting (C) is the final phase, where findings, methods, and conclusions are documented in a clear, defensible manner suitable for legal or administrative proceedings. Sentencing (B) is a judicial action that occurs after a trial, not part of the forensic investigation itself, and Deletion of irrelevant data (E) is not a recognized step—forensic examiners preserve all potential evidence and may filter for relevance during analysis, but never delete data as part of the process.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Analysis
Why this is correct
Analysis is the systematic examination of digital evidence after acquisition, where the investigator correlates data, recovers deleted artifacts, validates hash values, and tests hypotheses to reconstruct the incident. In the forensic process, this phase transforms raw data into actionable intelligence, applying techniques like keyword searching, timeline analysis, and file signature verification. It is a core investigative step, distinct from later reporting, because its output forms the evidentiary basis for conclusions.
- ✗
Sentencing
Why it's wrong here
Sentencing is a judicial function performed by a court after a conviction or guilty plea, determining the penalty imposed on an offender. It is a post-trial legal proceeding, not an investigative procedure, and occurs entirely outside the forensic workflow. Forensic examiners do not sentence—they collect, preserve, analyze, and report evidence, while sentencing falls to the judiciary and is thus incorrect in this list.
- ✓
Reporting
Why this is correct
Reporting is the culminating phase of the forensic process, in which the examiner documents the methods, tools, and findings in a clear, reproducible, and legally admissible format. This step includes generating reports that articulate the Chain of Custody, the analysis performed, and the conclusion without subjective bias. Reporting is vital because it ensures peer review, allows the court to understand the evidence, and remains a core step separating professional investigation from mere data collection.
- ✓
First response
Why this is correct
First response is the initial investigative step where personnel secure the crime scene, identify and protect volatile digital evidence, and document the state of systems before any changes occur. It involves actions such as photographing the scene, isolating the device, preserving memory, and preventing unauthorized access to maintain evidentiary integrity. This step establishes the Chain of Custody and is critical because any error here can invalidate all subsequent forensic findings, making it a core step.
- ✗
Deletion of irrelevant data
Why it's wrong here
Deletion of irrelevant data is not a sanctioned step in forensic investigation and is antithetical to the principle of evidence preservation. While an examiner may choose to focus on specific data, they must never destroy or discard any potential evidence because such deletion could violate legal duties, break the Chain of Custody, or lead to spoliation sanctions. Even 'irrelevant' data can later prove dispositive, so it is maintained securely rather than actively removed.
Go deeper
Related to this question
About these practice questions
This CHFI question is part of Courseiva's 745-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.