CHFI General 4

Question 1

Which hashing algorithm is commonly used in CHFI to verify the integrity of forensic disk images?

Accepted Answer

MD5 or SHA-1

Answer

MD5 and SHA-1 (or SHA-256) hashes are computed before and after acquisition to confirm the image is an exact copy of the original media.

Question 2

What type of investigation focuses on analyzing employee misconduct, policy violations, or internal fraud within an organization?

Accepted Answer

Corporate/internal forensics

Answer

Corporate or internal forensics deals with workplace investigations such as data theft, insider threats, and HR policy violations.

Question 3

Which law in the US specifically addresses unauthorized access to computer systems and is frequently cited in cybercrime investigations?

Accepted Answer

Computer Fraud and Abuse Act (CFAA)

Answer

The CFAA criminalizes unauthorized access to protected computers and is the primary federal statute used in computer crime prosecutions.

Question 4

What is a 'dead box' forensic examination?

Accepted Answer

Forensic analysis of a powered-off system using an external boot device

Answer

Dead box forensics involves examining a system that has been powered off, typically by booting from forensic media to access the drive.

Question 5

Which tool is widely used by CHFI investigators for comprehensive disk imaging and forensic analysis on Windows systems?

Accepted Answer

FTK (Forensic Toolkit)

Answer

FTK by AccessData is a comprehensive forensic platform supporting disk imaging, file analysis, password cracking, and evidence management.

CHFI - Computer Hacking Forensic Investigator Practice Test