CHFI Forensic Investigation Process 4

Question 1

A forensic investigator receives a hard drive that may contain evidence. Before imaging, the investigator calculates a hash value. After imaging, the same hash is calculated on the image. If both hashes match, this proves:

Accepted Answer

The image is an exact bit-for-bit copy of the original

Answer

Matching hash values before and after imaging confirm the forensic copy is an exact, unaltered duplicate of the original evidence.

Question 2

Which of the following best describes the 'first responder' role in a digital forensic investigation?

Accepted Answer

The first person on the scene who secures and documents the environment without altering evidence

Answer

The first responder secures the scene, documents the environment, and protects evidence from contamination before forensic specialists arrive.

Question 3

An investigator must examine a live server that cannot be shut down. Which approach is most appropriate?

Accepted Answer

Perform live forensic acquisition capturing RAM and volatile data first

Answer

Live forensic acquisition captures volatile memory and running process data from a system that must remain operational.

Question 4

What is the significance of 'metadata' in digital forensic investigations?

Accepted Answer

Metadata provides information such as file creation time, author, and modification history

Answer

Metadata stores critical information like timestamps, author details, and modification history that can corroborate or contradict a suspect's claims.

Question 5

In which phase of the forensic investigation process does an investigator reconstruct the timeline of events?

Accepted Answer

Examination and Analysis

Answer

During the Examination and Analysis phase, investigators correlate artifacts and timestamps to reconstruct the sequence of events.

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI Forensic Investigation Process 4