CHFI General 2

Question 1

Which type of evidence is considered the most reliable in a court of law during a digital forensics case?

Accepted Answer

Best evidence

Answer

Best evidence refers to the original document or data, and courts prefer it over copies or secondary evidence.

Question 2

What does the term 'locard's exchange principle' mean in the context of digital forensics?

Accepted Answer

Every contact leaves a trace between the criminal and the crime scene

Answer

Locard's Exchange Principle states that any interaction between two entities results in an exchange of material, including digital artifacts.

Question 3

In digital forensics, what is the primary purpose of write blockers?

Accepted Answer

To prevent any writes to the evidence media during acquisition

Answer

Write blockers prevent the forensic examiner's system from writing data to the evidence drive, preserving its original state.

Question 4

What is 'slack space' in the context of disk forensics?

Accepted Answer

The space between the end of a file and the end of its allocated cluster

Answer

Slack space is the residual storage area between the end of a file's logical content and the end of the last cluster allocated to it.

Question 5

Which RFC defines the format and structure of email messages and is important for email forensics?

Accepted Answer

RFC 2822

Answer

RFC 2822 defines the Internet Message Format, specifying how email headers and body content are structured.

CHFI - Computer Hacking Forensic Investigator Practice Test