CHFI General 2 — Questions and Answers
Question 1: Which type of evidence is considered the most reliable in a court of law during a digital forensics case?
- Hearsay evidence
- Circumstantial evidence
- Best evidence (Correct answer)
- Demonstrative evidence
Correct answer: Best evidence
Best evidence refers to the original document or data, and courts prefer it over copies or secondary evidence.
Question 2: What does the term 'locard's exchange principle' mean in the context of digital forensics?
- Every crime scene is unique and cannot be replicated
- Every contact leaves a trace between the criminal and the crime scene (Correct answer)
- Digital evidence must be isolated from all physical evidence
- Forensic investigators must not interact with crime scene data
Correct answer: Every contact leaves a trace between the criminal and the crime scene
Locard's Exchange Principle states that any interaction between two entities results in an exchange of material, including digital artifacts.
Question 3: In digital forensics, what is the primary purpose of write blockers?
- To encrypt evidence before analysis
- To speed up data acquisition from storage devices
- To prevent any writes to the evidence media during acquisition (Correct answer)
- To verify hash values of acquired images
Correct answer: To prevent any writes to the evidence media during acquisition
Write blockers prevent the forensic examiner's system from writing data to the evidence drive, preserving its original state.
Question 4: What is 'slack space' in the context of disk forensics?
- Unused partitions on a hard drive
- The space between the end of a file and the end of its allocated cluster (Correct answer)
- Overwritten sectors that still contain recoverable data
- Encrypted regions of a disk not accessible by the OS
Correct answer: The space between the end of a file and the end of its allocated cluster
Slack space is the residual storage area between the end of a file's logical content and the end of the last cluster allocated to it.
Question 5: Which RFC defines the format and structure of email messages and is important for email forensics?
- RFC 1918
- RFC 2616
- RFC 5321
- RFC 2822 (Correct answer)
Correct answer: RFC 2822
RFC 2822 defines the Internet Message Format, specifying how email headers and body content are structured.
Question 6: During a forensic investigation, what does 'chain of custody' documentation primarily ensure?
- That evidence is encrypted during transport
- That evidence has not been tampered with and its handling is traceable (Correct answer)
- That only law enforcement can access the evidence
- That the suspect cannot contest the evidence in court
Correct answer: That evidence has not been tampered with and its handling is traceable
Chain of custody documents every person who handled the evidence and every action taken, ensuring its integrity and admissibility.
Question 7: What forensic technique involves examining the allocated and unallocated areas of a disk to find deleted files?
- Steganography analysis
- File carving (Correct answer)
- Log correlation
- Registry hive parsing
Correct answer: File carving
File carving recovers files by searching for file headers and footers in raw disk data, regardless of filesystem structure.
CHFI General 2
Which type of evidence is considered the most reliable in a court of law during a digital forensics case?