When providing expert testimony in court, what is the primary role of a computer forensics investigator?

To explain technical findings in a way that the judge and jury can understand

To argue that the defendant is guilty based on the evidence

To recommend a sentence for the defendant

To provide the court with the suspect's personal information

What is the primary purpose of the final report in a computer forensics investigation?

To serve as a backup of the forensic image

To provide a detailed list of all the forensic tools used during the investigation

To present the findings and conclusions of the investigation in a clear and understandable manner

To document the chain of custody for the evidence

An analyst is examining a forensic image of a computer involved in a harassment case. The analyst finds deleted emails that appear relevant. What is the best way to include these findings in the investigation?

Print the emails and attach them to the report without further documentation.

Copy the emails to a USB drive and give them to the requesting party.

Recover the emails and document their content, metadata, and the method used for recovery.

Ignore the emails because they were deleted and are not considered evidence.

A forensic investigator is documenting the chain of custody for a seized smartphone. Which piece of information is MOST critical to record?

The date, time, and location of every transfer of the device, along with the names of the people involved.

The forensic tools that will be used to examine the device.

The name and contact information of the suspect.

The model and serial number of the smartphone.

An investigator is collecting evidence from a network server that may have been accessed by an attacker. The server is critical to business operations and cannot be taken offline. Which collection technique is most appropriate?

Shut down the server and create a forensic image of the hard drives.

Perform a live acquisition of the server's memory and relevant log files.

Ask the system administrator to create a backup using the server's backup software.

Copy the entire hard drive over the network to a forensic workstation.

EC-CouncilComputer Hacking Forensic Investigator

Domain 1Objective 2

Computer Forensics Investigation Process CHFI Practice Questions (Page 3)

Part of the Forensic Fundamentals and Process domain, which makes up ~14% of our current practice bank.

51questions here

11free pages

7concepts

Questions 11–15

11foundation · easy
When providing expert testimony in court, what is the primary role of a computer forensics investigator?
Select an answer first
12foundation · easy
What is the primary purpose of the final report in a computer forensics investigation?
Select an answer first
13application · medium
An analyst is examining a forensic image of a computer involved in a harassment case. The analyst finds deleted emails that appear relevant. What is the best way to include these findings in the investigation?
Select an answer first
14application · medium
A forensic investigator is documenting the chain of custody for a seized smartphone. Which piece of information is MOST critical to record?
Select an answer first
15application · medium
An investigator is collecting evidence from a network server that may have been accessed by an attacker. The server is critical to business operations and cannot be taken offline. Which collection technique is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CHFI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CHFI” is a trademark of its owner, used for identification only.