Computer Forensics in Today's World CHFI Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A forensic examiner is investigating a case of online harassment. The victim has provided screenshots of the harassing messages. What is the primary limitation of relying solely on screenshots as digital evidence?

   • AScreenshots are not admissible in court.
   • BScreenshots do not contain metadata that can be analyzed.
   • CScreenshots can be easily altered or fabricated, so they lack authenticity.
   • DScreenshots are not considered digital evidence because they are images.
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A forensic investigator is examining a computer that was found powered on and connected to the internet. The investigator needs to preserve volatile data. Which action should the investigator take first?

   • APower off the computer immediately to prevent data alteration.
   • BDisconnect the computer from the network to prevent remote access.
   • CCreate a forensic image of the hard drive.
   • DCapture the contents of RAM using a trusted forensic tool.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A forensic investigator is comparing old and new case files. They notice that older cases focused on disk analysis, while newer cases involve memory forensics and cloud data. What does this change reflect?

   • AA decline in the importance of disk forensics.
   • BThe evolution of computer forensics to address new technologies and crime types.
   • CA shift from criminal investigations to civil litigation.
   • DA change in legal requirements that now mandate memory forensics.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A company is involved in a civil lawsuit and must produce relevant electronic documents to the opposing party. The legal team uses a software tool to search for keywords and collect emails and files. The IT security team is not involved. Which discipline is primarily being applied in this scenario?

   • AComputer forensics
   • BData recovery
   • CE-discovery
   • DIncident response
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A forensic examiner is called to a crime scene where a suspect's smartphone is found. The phone is locked, and the examiner needs to extract data. What is the most appropriate action from a computer forensics perspective?

   • ATry to unlock the phone by guessing the PIN.
   • BTurn off the phone to prevent any changes.
   • CPlace the phone in a Faraday bag to prevent remote wiping and preserve evidence.
   • DImmediately connect the phone to a computer to extract data.
   Reveal Solution Discussion Select an answer first