CHFI - Computer Hacking Forensic Investigator Forensic Investigation Process Questions and Answers — Questions and Answers
Question 1: A forensic investigator arrives at a scene to collect evidence from a computer that is still powered on. According to the order of volatility, which of the following data types should be collected FIRST to prevent its loss?
- Data on archival media
- Temporary file systems
- CPU registers and cache (Correct answer)
- Data on hard disks
Correct answer: CPU registers and cache
The order of volatility dictates that the most transient data be collected first. CPU registers and cache are extremely volatile and change within nanoseconds. Therefore, this information must be captured before any other data, as even the act of running a collection tool can alter it.
Question 2: An investigator is preparing a final report after analyzing a compromised system. Which phase of the forensic investigation process involves creating a detailed record of the findings, including the methods used and the evidence discovered?
- Preservation
- Identification
- Analysis
- Documentation and Reporting (Correct answer)
Correct answer: Documentation and Reporting
The Documentation and Reporting phase is where the investigator formally records all actions taken, methodologies used for analysis, and the conclusions drawn from the evidence. This report is crucial for legal proceedings and must be clear, concise, and defensible.
Question 3: What is the primary purpose of maintaining a strict Chain of Custody for digital evidence?
- To ensure the investigator understands the technical details of the evidence.
- To track the cost of the investigation and the tools used.
- To prove the integrity and authenticity of the evidence and show it has not been tampered with. (Correct answer)
- To speed up the analysis phase by pre-categorizing the evidence.
Correct answer: To prove the integrity and authenticity of the evidence and show it has not been tampered with.
The Chain of Custody is a chronological paper trail that documents the seizure, custody, control, transfer, analysis, and disposition of evidence. Its main purpose is to ensure the integrity of the evidence, proving that it has not been altered or tampered with, which is critical for its admissibility in court.
Question 4: During a digital forensics investigation, an analyst creates a bit-for-bit copy of a suspect's hard drive. This process is a crucial part of which investigation phase?
- Preservation/Acquisition (Correct answer)
- Presentation
- Identification
- Analysis
Correct answer: Preservation/Acquisition
Creating a forensic image (a bit-for-bit copy) of the original media is a fundamental step in the Preservation and Acquisition phase. This ensures that the original evidence is left untouched and unaltered, while the analysis is performed on the identical copy, thus maintaining the integrity of the original evidence.
Question 5: A CHFI is called to investigate a potential data breach. The first step taken is to interview stakeholders, identify potentially affected systems (laptops, servers, mobile devices), and define the scope of the investigation. Which phase of the forensic process does this activity represent?
- Analysis
- Reporting
- Identification (Correct answer)
- Preservation
Correct answer: Identification
The Identification phase is the initial step in the digital forensic process. It involves recognizing and determining what evidence is present, where it is stored, and what format it is in. This includes identifying all potential sources of digital evidence like computers, mobile devices, and cloud storage.
Question 6: Which of the following actions would be performed during the Analysis phase of a digital forensic investigation?
- Testifying in court as an expert witness.
- Creating a forensic image of a hard drive.
- Searching for keywords, recovering deleted files, and building a timeline of events. (Correct answer)
- Documenting who has handled the evidence and when.
Correct answer: Searching for keywords, recovering deleted files, and building a timeline of events.
The Analysis phase involves using various techniques and tools to examine the collected data. This includes activities like recovering deleted files, performing keyword searches, examining system logs, and reconstructing event timelines to draw conclusions about the incident.
CHFI - Computer Hacking Forensic Investigator Forensic Investigation Process Questions and Answers
A forensic investigator arrives at a scene to collect evidence from a computer that is still powered on.
According to the order of volatility, which of the following data types should be collected FIRST to prevent its loss?