CHFI - Computer Hacking Forensic Investigator Data Acquisition and Duplication Questions and Answers

Question 1

A forensic investigator is tasked with creating a bit-for-bit copy of a suspect's hard drive. To ensure the integrity of the original evidence, which of the following tools is essential to use during the acquisition process?

Accepted Answer

A write-blocker

Answer

A write-blocker is a device or software that prevents any write operations to a storage device, ensuring that the original evidence is not altered during the forensic imaging process. This preserves the integrity of the data, which is a fundamental principle in digital forensics. Hashing is used for verification after the image is created, file carving is for data recovery, and a network sniffer captures network traffic.

Question 2

An investigator has just created a forensic image of a hard drive. To verify that the duplicate is an exact copy of the original, what cryptographic function must be performed on both the original media and the created image file?

Accepted Answer

Hashing

Answer

Hashing algorithms like SHA-256 or MD5 are used to create a unique digital fingerprint (hash value) of a piece of data. By calculating the hash value for both the original evidence drive and the forensic image, an investigator can prove that the image is a perfect, unaltered copy. If the hash values match, it confirms the integrity of the duplication process.

Question 3

During a digital forensics investigation, which document provides a chronological paper trail of the seizure, custody, control, transfer, analysis, and disposition of evidence?

Accepted Answer

Chain of Custody

Answer

The Chain of Custody is a critical document that records the entire lifecycle of a piece of evidence. It meticulously tracks who handled the evidence, when, and for what purpose, ensuring its integrity and admissibility in legal proceedings. A broken chain of custody can render evidence inadmissible in court.

Question 4

A forensic analyst needs to acquire data from a running server that is suspected of being involved in an ongoing network attack. The analyst wants to capture the contents of RAM, running processes, and active network connections. Which type of data acquisition is most appropriate in this scenario?

Accepted Answer

Live Acquisition

Answer

Live acquisition involves collecting volatile data from a system while it is still running. This is necessary to capture transient information like the contents of RAM, running processes, network connections, and logged-on users, which would be lost if the system were powered down for a static (dead) acquisition.

Question 5

Which of the following is considered the most common and forensically sound method for duplicating a storage device, as it creates an exact, bit-for-bit copy of the entire drive, including unallocated space and deleted files?

Accepted Answer

Bit-stream disk-to-image file

Answer

Creating a bit-stream disk-to-image file is the standard forensic method for duplicating evidence. This process creates a file that is an exact, sector-by-sector copy of the source drive, ensuring that all data, including deleted files, file slack, and unallocated space, is preserved for analysis. This is often referred to as creating a 'forensic image'.

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI - Computer Hacking Forensic Investigator Data Acquisition and Duplication Questions and Answers