CHFI - Computer Hacking Forensic Investigator Forensic Investigation Process Questions and Answers

Question 1

A forensic investigator arrives at a scene to collect evidence from a computer that is still powered on.
According to the order of volatility, which of the following data types should be collected FIRST to prevent its loss?

Accepted Answer

CPU registers and cache

Answer

Data on archival media

Answer

Temporary file systems

Answer

Data on hard disks

Question 2

An investigator is preparing a final report after analyzing a compromised system. Which phase of the forensic investigation process involves creating a detailed record of the findings, including the methods used and the evidence discovered?

Accepted Answer

Documentation and Reporting

Answer

Preservation

Answer

Identification

Answer

Analysis

Question 3

What is the primary purpose of maintaining a strict Chain of Custody for digital evidence?

Accepted Answer

To prove the integrity and authenticity of the evidence and show it has not been tampered with.

Answer

To ensure the investigator understands the technical details of the evidence.

Answer

To track the cost of the investigation and the tools used.

Answer

To speed up the analysis phase by pre-categorizing the evidence.

Question 4

During a digital forensics investigation, an analyst creates a bit-for-bit copy of a suspect's hard drive. This process is a crucial part of which investigation phase?

Accepted Answer

Preservation/Acquisition

Answer

Presentation

Answer

Identification

Answer

Analysis

Question 5

A CHFI is called to investigate a potential data breach. The first step taken is to interview stakeholders, identify potentially affected systems (laptops, servers, mobile devices), and define the scope of the investigation. Which phase of the forensic process does this activity represent?

Accepted Answer

Identification

Answer

Analysis

Answer

Reporting

Answer

Preservation

Question 6

Which of the following actions would be performed during the Analysis phase of a digital forensic investigation?

Accepted Answer

Searching for keywords, recovering deleted files, and building a timeline of events.

Answer

Testifying in court as an expert witness.

Answer

Creating a forensic image of a hard drive.

Answer

Documenting who has handled the evidence and when.