Forensic Investigation Process Flashcards
7 cards from real CHFI practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Forensic Investigation Process flashcards as text
During a post-incident forensic review, investigators find that logs were overwritten before collection. Which process failure does this represent?
Answer: Inadequate evidence identification
Overwritten logs indicate a failure in the identification phase — critical evidence sources were not identified quickly enough for preservation.
What distinguishes a 'bit-stream image' from a simple file backup in digital forensics?
Answer: A bit-stream image captures every bit including deleted files and slack space
A bit-stream (forensic) image captures an exact sector-by-sector copy including deleted files, slack space, and unallocated regions.
An investigator needs to analyze a suspect's smartphone without triggering remote wipe commands. What is the best immediate action?
Answer: Remove the SIM card and place the phone in a Faraday bag
Placing the device in a Faraday bag isolates it from all wireless signals, preventing remote wipe commands while preserving its powered state.
In a corporate investigation, HR asks a forensic investigator to monitor an employee's email without a warrant. This is legally permissible primarily because:
Answer: The company owns the email system and employees have notice of monitoring policies
Employers can monitor company-owned systems when employees have been notified through acceptable-use policies, making a warrant unnecessary.
Which type of forensic investigation scope specifically covers crimes involving networked systems across multiple geographic locations?
Answer: Network forensics
Network forensics focuses on capturing and analyzing network traffic and logs to investigate crimes spanning multiple systems or locations.
When an investigator testifies in court about forensic findings, what role does the investigator serve?
Answer: Expert witness
A forensic investigator testifies as an expert witness, allowed to provide opinions and interpretations based on specialized knowledge.
What is the purpose of the 'Locard's Exchange Principle' in digital forensics?
Answer: Every contact leaves a trace, meaning attackers always leave digital evidence
Locard's Exchange Principle states that every contact leaves a trace, meaning attackers leave behind digital footprints such as logs, files, or registry entries.