CHFI Forensic Investigation Process 2 — Questions and Answers
Question 1: During a forensic investigation, which principle ensures that evidence collected is admissible in a court of law?
- Chain of custody (Correct answer)
- Data normalization
- Evidence compression
- Log aggregation
Correct answer: Chain of custody
Chain of custody documents every person who handled the evidence, ensuring its integrity and admissibility in court.
Question 2: A forensic investigator discovers volatile data on a running system. According to the order of volatility, what should be collected FIRST?
- Hard disk contents
- CPU registers and cache (Correct answer)
- Optical media
- Network configuration files on disk
Correct answer: CPU registers and cache
CPU registers and cache are the most volatile data and must be collected first as they are lost immediately upon power-off.
Question 3: Which document formally authorizes a forensic investigator to conduct an investigation within an organization?
- Non-disclosure agreement
- Search warrant
- Written authorization or letter of engagement (Correct answer)
- Subpoena
Correct answer: Written authorization or letter of engagement
A written authorization or letter of engagement from the organization legally authorizes the investigator to examine its systems.
Question 4: What is the primary purpose of a forensic investigation report?
- To summarize remediation steps taken
- To document findings in a legally defensible and comprehensible manner (Correct answer)
- To list all tools used during the investigation
- To outline the suspect's criminal history
Correct answer: To document findings in a legally defensible and comprehensible manner
The forensic report must document findings clearly and in a legally defensible way so it can be used in judicial or corporate proceedings.
Question 5: In the CHFI investigation methodology, what is the correct sequence of the initial phases?
- Collection, Preservation, Analysis, Reporting
- Preparation, Detection, Containment, Recovery
- Identification, Preservation, Collection, Examination (Correct answer)
- Acquisition, Authentication, Analysis, Presentation
Correct answer: Identification, Preservation, Collection, Examination
The standard forensic process begins with Identification, then Preservation, then Collection, followed by Examination and Analysis.
Question 6: A forensic examiner uses write-blockers when imaging a hard drive. What is the main reason for using a write-blocker?
- To speed up the imaging process
- To prevent any modification to the original evidence drive (Correct answer)
- To decrypt encrypted partitions
- To verify the hash of the cloned image
Correct answer: To prevent any modification to the original evidence drive
Write-blockers prevent any write operations from reaching the original drive, maintaining its forensic integrity.
Question 7: Which hashing algorithm is most commonly used in CHFI to verify the integrity of forensic disk images?
- MD5 or SHA-1 (Correct answer)
- Base64
- AES-256
- CRC16
Correct answer: MD5 or SHA-1
MD5 and SHA-1 (and increasingly SHA-256) are used to generate hash values that verify a forensic image is an exact copy of the original.
CHFI Forensic Investigation Process 2
During a forensic investigation, which principle ensures that evidence collected is admissible in a court of law?