Computer Forensics Investigation Process CHFI Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   During an investigation, an analyst discovers a hidden partition on a suspect's drive. The analyst needs to determine whether the partition contains relevant evidence. Which approach is most appropriate?

   • AUse forensic software to analyze the partition in a read-only manner and recover deleted files.
   • BCopy the partition to a new drive and then analyze the copy with standard disk management tools.
   • CMount the partition and browse the files using the operating system's file explorer.
   • DFormat the partition and then run a data recovery tool to see what can be recovered.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A company suspects an employee of leaking sensitive data. The employee uses a company-issued laptop and a personal smartphone. The legal department wants to investigate both devices. However, the employee has a reasonable expectation of privacy on the personal smartphone. What is the BEST course of action?

   • ASeize both devices immediately and image them without notifying the employee.
   • BOnly investigate the laptop and ignore the smartphone to avoid legal complications.
   • CSeize the company laptop and seek a court order or legal authorization to search the personal smartphone.
   • DAsk the employee to voluntarily provide the smartphone's passcode and consent to the search.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A forensic analyst is testifying about the chain of custody of a hard drive. The defense attorney points out that the evidence log shows a gap of two days when the drive was in a locked evidence locker. How should the analyst respond?

   • AAdmit that the chain of custody was broken and the evidence is inadmissible.
   • BClaim that the gap is irrelevant because the drive was not accessed.
   • CAcknowledge the gap and explain that the drive was in a secure, access-controlled locker during that time.
   • DState that the evidence log is not required to be continuous.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   An investigator responds to a scene where a server is running and appears to be actively used in a cybercrime. The server is in a data center with remote management capabilities. The investigator must preserve evidence while minimizing disruption to the organization's operations. What is the BEST course of action?

   • AContact the organization's IT team to perform a backup of the server before any forensic actions.
   • BCapture volatile data (memory, network connections) using forensic tools, then perform a controlled shutdown and image the drives.
   • CImmediately shut down the server by pulling the power cord to preserve the hard drive state.
   • DDisconnect the server from the network and leave it running while you image the drives over the network.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A forensic examiner has completed the analysis of a hard drive seized in a criminal case. The defense attorney requests the original hard drive to conduct an independent examination. The prosecutor asks the examiner to provide the forensic image instead. What is the BEST reason to provide the image rather than the original?

   • AThe original drive is the property of the police department and cannot be released.
   • BThe image is smaller and easier to transport than the physical drive.
   • CProviding the image protects the original from alteration and maintains the chain of custody.
   • DThe image contains more data than the original because it includes deleted files.
   Reveal Solution Discussion Select an answer first