CHFI General 4 — Questions and Answers
Question 1: Which hashing algorithm is commonly used in CHFI to verify the integrity of forensic disk images?
- MD5 or SHA-1 (Correct answer)
- Base64 encoding
- AES-256
- RSA-2048
Correct answer: MD5 or SHA-1
MD5 and SHA-1 (or SHA-256) hashes are computed before and after acquisition to confirm the image is an exact copy of the original media.
Question 2: What type of investigation focuses on analyzing employee misconduct, policy violations, or internal fraud within an organization?
- Criminal forensics
- Corporate/internal forensics (Correct answer)
- Network intrusion forensics
- eDiscovery
Correct answer: Corporate/internal forensics
Corporate or internal forensics deals with workplace investigations such as data theft, insider threats, and HR policy violations.
Question 3: Which law in the US specifically addresses unauthorized access to computer systems and is frequently cited in cybercrime investigations?
- Digital Millennium Copyright Act (DMCA)
- Computer Fraud and Abuse Act (CFAA) (Correct answer)
- Electronic Communications Privacy Act (ECPA)
- Gramm-Leach-Bliley Act (GLBA)
Correct answer: Computer Fraud and Abuse Act (CFAA)
The CFAA criminalizes unauthorized access to protected computers and is the primary federal statute used in computer crime prosecutions.
Question 4: What is a 'dead box' forensic examination?
- Analyzing a running system while it is connected to a network
- Forensic analysis of a powered-off system using an external boot device (Correct answer)
- Examining network packets captured during an intrusion
- Reviewing cloud storage logs from a remote server
Correct answer: Forensic analysis of a powered-off system using an external boot device
Dead box forensics involves examining a system that has been powered off, typically by booting from forensic media to access the drive.
Question 5: Which tool is widely used by CHFI investigators for comprehensive disk imaging and forensic analysis on Windows systems?
- Wireshark
- FTK (Forensic Toolkit) (Correct answer)
- Nmap
- Metasploit
Correct answer: FTK (Forensic Toolkit)
FTK by AccessData is a comprehensive forensic platform supporting disk imaging, file analysis, password cracking, and evidence management.
Question 6: What is the role of a 'first responder' at a digital crime scene?
- To immediately image all hard drives at the scene
- To secure the scene, document initial state, and preserve volatile data (Correct answer)
- To interview witnesses and document their statements
- To submit a final forensic report to the prosecutor
Correct answer: To secure the scene, document initial state, and preserve volatile data
The first responder must secure the scene, prevent evidence tampering, document the environment, and capture volatile data before shutdown.
Question 7: In mobile device forensics, what does 'logical acquisition' refer to?
- Creating a physical bit-for-bit copy of the device's flash memory
- Extracting data through the device's OS via standard interfaces like USB or Bluetooth (Correct answer)
- Removing and directly reading memory chips from the device
- Accessing data through JTAG or ISP methods
Correct answer: Extracting data through the device's OS via standard interfaces like USB or Bluetooth
Logical acquisition extracts data accessible via the operating system's APIs, yielding files and databases but potentially missing deleted data.
CHFI General 4
Which hashing algorithm is commonly used in CHFI to verify the integrity of forensic disk images?