CHFI - Computer Hacking Forensic Investigator Data Acquisition and Duplication Questions and Answers

Question 1

A forensic investigator is tasked with creating a bit-for-bit copy of a suspect's hard drive.
To ensure the integrity of the original evidence, which of the following tools is essential to use during the acquisition process?

Accepted Answer

A write-blocker

Answer

A hashing utility

Answer

A file carving tool

Answer

A network sniffer

Question 2

An investigator has just created a forensic image of a hard drive. To verify that the duplicate is an exact copy of the original, what cryptographic function must be performed on both the original media and the created image file?

Accepted Answer

Hashing

Answer

Encryption

Answer

Steganography

Answer

Compression

Question 3

During a digital forensics investigation, which document provides a chronological paper trail of the seizure, custody, control, transfer, analysis, and disposition of evidence?

Accepted Answer

Chain of Custody

Answer

Evidence Intake Form

Answer

Investigator's Notes

Answer

Case Summary Report

Question 4

A forensic analyst needs to acquire data from a running server that is suspected of being involved in an ongoing network attack. The analyst wants to capture the contents of RAM, running processes, and active network connections. Which type of data acquisition is most appropriate in this scenario?

Accepted Answer

Live Acquisition

Answer

Static (Dead) Acquisition

Answer

Logical Acquisition

Answer

Sparse Acquisition

Question 5

Which of the following is considered the most common and forensically sound method for duplicating a storage device, as it creates an exact, bit-for-bit copy of the entire drive, including unallocated space and deleted files?

Accepted Answer

Bit-stream disk-to-image file

Answer

Logical file copy

Answer

System backup and restore

Answer

Sparse imaging

Question 6

A CHFI is at a scene and must decide on an acquisition method for a suspect's laptop. The investigator has limited time and is primarily interested in specific user-created documents and emails, not the entire operating system or unallocated space. Which acquisition method would be the most efficient in this situation?

Accepted Answer

Logical Acquisition

Answer

Physical Acquisition

Answer

Live RAM Capture

Answer

Bit-stream Imaging