Forensic Investigation Process Flashcards
7 cards from real CHFI practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Forensic Investigation Process flashcards as text
A forensic investigator receives a hard drive that may contain evidence. Before imaging, the investigator calculates a hash value. After imaging, the same hash is calculated on the image. If both hashes match, this proves:
Answer: The image is an exact bit-for-bit copy of the original
Matching hash values before and after imaging confirm the forensic copy is an exact, unaltered duplicate of the original evidence.
Which of the following best describes the 'first responder' role in a digital forensic investigation?
Answer: The first person on the scene who secures and documents the environment without altering evidence
The first responder secures the scene, documents the environment, and protects evidence from contamination before forensic specialists arrive.
An investigator must examine a live server that cannot be shut down. Which approach is most appropriate?
Answer: Perform live forensic acquisition capturing RAM and volatile data first
Live forensic acquisition captures volatile memory and running process data from a system that must remain operational.
What is the significance of 'metadata' in digital forensic investigations?
Answer: Metadata provides information such as file creation time, author, and modification history
Metadata stores critical information like timestamps, author details, and modification history that can corroborate or contradict a suspect's claims.
In which phase of the forensic investigation process does an investigator reconstruct the timeline of events?
Answer: Examination and Analysis
During the Examination and Analysis phase, investigators correlate artifacts and timestamps to reconstruct the sequence of events.
Which of the following is a legal concern when collecting evidence from a cloud storage provider?
Answer: Jurisdiction and the need for legal process such as subpoenas or mutual legal assistance treaties
Cloud data may reside in foreign jurisdictions, requiring subpoenas, court orders, or mutual legal assistance treaties (MLATs) to obtain legally.
What does the term 'forensic soundness' mean in the context of digital evidence?
Answer: The evidence collection process did not alter the original data and is verifiable
Forensic soundness means the evidence collection process preserved the original data intact and the process can be verified and repeated.