CHFI Forensic Investigation Process 3

Question 1

During a post-incident forensic review, investigators find that logs were overwritten before collection. Which process failure does this represent?

Accepted Answer

Inadequate evidence identification

Answer

Overwritten logs indicate a failure in the identification phase — critical evidence sources were not identified quickly enough for preservation.

Question 2

What distinguishes a 'bit-stream image' from a simple file backup in digital forensics?

Accepted Answer

A bit-stream image captures every bit including deleted files and slack space

Answer

A bit-stream (forensic) image captures an exact sector-by-sector copy including deleted files, slack space, and unallocated regions.

Question 3

An investigator needs to analyze a suspect's smartphone without triggering remote wipe commands. What is the best immediate action?

Accepted Answer

Remove the SIM card and place the phone in a Faraday bag

Answer

Placing the device in a Faraday bag isolates it from all wireless signals, preventing remote wipe commands while preserving its powered state.

Question 4

In a corporate investigation, HR asks a forensic investigator to monitor an employee's email without a warrant. This is legally permissible primarily because:

Accepted Answer

The company owns the email system and employees have notice of monitoring policies

Answer

Employers can monitor company-owned systems when employees have been notified through acceptable-use policies, making a warrant unnecessary.

Question 5

Which type of forensic investigation scope specifically covers crimes involving networked systems across multiple geographic locations?

Accepted Answer

Network forensics

Answer

Network forensics focuses on capturing and analyzing network traffic and logs to investigate crimes spanning multiple systems or locations.

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI Forensic Investigation Process 3