CHFI - Computer Hacking Forensic Investigator Forensic Investigation Process Questions and Answers

Question 1

A forensic investigator arrives at a scene to collect evidence from a computer that is still powered on. According to the order of volatility, which of the following data types should be collected FIRST to prevent its loss?

Accepted Answer

CPU registers and cache

Answer

The order of volatility dictates that the most transient data be collected first. CPU registers and cache are extremely volatile and change within nanoseconds. Therefore, this information must be captured before any other data, as even the act of running a collection tool can alter it.

Question 2

An investigator is preparing a final report after analyzing a compromised system. Which phase of the forensic investigation process involves creating a detailed record of the findings, including the methods used and the evidence discovered?

Accepted Answer

Documentation and Reporting

Answer

The Documentation and Reporting phase is where the investigator formally records all actions taken, methodologies used for analysis, and the conclusions drawn from the evidence. This report is crucial for legal proceedings and must be clear, concise, and defensible.

Question 3

What is the primary purpose of maintaining a strict Chain of Custody for digital evidence?

Accepted Answer

To prove the integrity and authenticity of the evidence and show it has not been tampered with.

Answer

The Chain of Custody is a chronological paper trail that documents the seizure, custody, control, transfer, analysis, and disposition of evidence. Its main purpose is to ensure the integrity of the evidence, proving that it has not been altered or tampered with, which is critical for its admissibility in court.

Question 4

During a digital forensics investigation, an analyst creates a bit-for-bit copy of a suspect's hard drive. This process is a crucial part of which investigation phase?

Accepted Answer

Preservation/Acquisition

Answer

Creating a forensic image (a bit-for-bit copy) of the original media is a fundamental step in the Preservation and Acquisition phase. This ensures that the original evidence is left untouched and unaltered, while the analysis is performed on the identical copy, thus maintaining the integrity of the original evidence.

Question 5

A CHFI is called to investigate a potential data breach. The first step taken is to interview stakeholders, identify potentially affected systems (laptops, servers, mobile devices), and define the scope of the investigation. Which phase of the forensic process does this activity represent?

Accepted Answer

Identification

Answer

The Identification phase is the initial step in the digital forensic process. It involves recognizing and determining what evidence is present, where it is stored, and what format it is in. This includes identifying all potential sources of digital evidence like computers, mobile devices, and cloud storage.

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI - Computer Hacking Forensic Investigator Forensic Investigation Process Questions and Answers