CHFI Data Acquisition and Duplication 3

Question 1

What is the Host Protected Area (HPA) and why is it forensically significant?

Accepted Answer

A hidden drive region invisible to the OS that may contain concealed data

Answer

The HPA is a reserved area at the end of a drive that the OS cannot see; suspects may hide data there, and standard imaging tools miss it unless configured to access it.

Question 2

During network-based forensic acquisition, which protocol is commonly used to stream a disk image over the network?

Accepted Answer

netcat or dcfldd piped over SSH

Answer

Forensic examiners commonly pipe dd or dcfldd output through netcat or SSH to transfer disk images over a network to a remote storage server.

Question 3

Which hash algorithm is currently recommended by NIST for forensic image verification due to collision resistance concerns with MD5?

Accepted Answer

SHA-256

Answer

NIST recommends SHA-256 (or stronger) for forensic integrity verification because MD5 and SHA-1 are vulnerable to collision attacks.

Question 4

An examiner acquires a drive and calculates an MD5 hash that differs from the hash taken by the first responder. What is the MOST likely conclusion?

Accepted Answer

The evidence was altered or the chain of custody was broken between acquisitions

Answer

A hash mismatch between acquisition points indicates that data changed, suggesting evidence tampering or a broken chain of custody.

Question 5

What is 'write blocking' and which layer does a software write blocker operate at?

Accepted Answer

Intercepts write commands via OS driver or API interception before they reach the drive

Answer

Software write blockers intercept OS-level write commands (via drivers or system call hooks) before they reach the storage device, preventing data modification during examination.

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI Data Acquisition and Duplication 3