Computer Forensics Investigation Process CHFI Practice Questions (Page 10)

Questions 46–50

1. 46expert · hard

   An analyst is examining a forensic image and finds a file that appears to be a deleted spreadsheet. The file's metadata shows it was last modified after the suspect's computer was seized. What should the analyst conclude?

   • AThe file was likely altered during the imaging process.
   • BThe timestamp may be unreliable due to system clock skew or time zone differences.
   • CThe file is a strong indicator that the suspect accessed the computer remotely after seizure.
   • DThe file is irrelevant because it was modified after seizure.
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   A forensic examiner is called to testify in court about the analysis of a suspect's smartphone. The defense attorney asks the examiner to explain how the data was extracted. What is the examiner's best response?

   • AState that the extraction method is proprietary and cannot be disclosed.
   • BRefer the attorney to the written report and decline to answer verbally.
   • CProvide a detailed technical explanation of every low-level command used during extraction.
   • DExplain the extraction process in simple terms, including the tools used and the steps taken to preserve evidence.
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   A forensic investigator is preparing a report for a case that will be reviewed by a judge. The investigator wants to ensure the report is clear and defensible. Which practice is most important?

   • AUse technical jargon to demonstrate expertise.
   • BWrite the report in a narrative style without headings or sections.
   • CInclude only the evidence that supports the prosecution's case.
   • DClearly separate facts from opinions and conclusions.
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   An investigator is collecting evidence from a Windows workstation involved in a data breach. The investigator needs to preserve the original hard drive while also obtaining a copy for analysis. Which action best preserves the integrity of the original evidence?

   • ARemove the hard drive and connect it to a write-blocker before imaging.
   • BCreate a backup using the built-in Windows backup utility to an external drive.
   • CBoot the system normally and copy files to an external USB drive.
   • DRun a software tool on the suspect machine to create a logical copy of user folders.
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   A first responder arrives at a scene where a computer is running and the user is still logged in. The responder must secure the scene. Which action is most appropriate?

   • AAsk the user to save their work and log off so the computer can be safely transported.
   • BImmediately turn off the monitor to prevent the screen from timing out.
   • CUnplug the network cable and then ask the user to explain what they were doing.
   • DIsolate the computer from the network and restrict access to the area.
   Reveal Solution Discussion Select an answer first