CHFI Forensic Investigation Process 2

Question 1

During a forensic investigation, which principle ensures that evidence collected is admissible in a court of law?

Accepted Answer

Chain of custody

Answer

Chain of custody documents every person who handled the evidence, ensuring its integrity and admissibility in court.

Question 2

A forensic investigator discovers volatile data on a running system. According to the order of volatility, what should be collected FIRST?

Accepted Answer

CPU registers and cache

Answer

CPU registers and cache are the most volatile data and must be collected first as they are lost immediately upon power-off.

Question 3

Which document formally authorizes a forensic investigator to conduct an investigation within an organization?

Accepted Answer

Written authorization or letter of engagement

Answer

A written authorization or letter of engagement from the organization legally authorizes the investigator to examine its systems.

Question 4

What is the primary purpose of a forensic investigation report?

Accepted Answer

To document findings in a legally defensible and comprehensible manner

Answer

The forensic report must document findings clearly and in a legally defensible way so it can be used in judicial or corporate proceedings.

Question 5

In the CHFI investigation methodology, what is the correct sequence of the initial phases?

Accepted Answer

Identification, Preservation, Collection, Examination

Answer

The standard forensic process begins with Identification, then Preservation, then Collection, followed by Examination and Analysis.

CHFI - Computer Hacking Forensic Investigator Practice Test