Computer Forensics Investigation Process CHFI Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   An investigator is collecting evidence from a cloud-based email service as part of a fraud investigation. The service provider is located in another country. What is the most important consideration for the investigator?

   • AThe investigator should rely on the provider's backup tapes for evidence.
   • BThe investigator should ask the user for their password to access the account.
   • CThe investigator must follow legal processes, such as a preservation request or subpoena, to obtain the data.
   • DThe investigator should immediately download all emails to a local drive.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A forensic investigator arrives at an office where a suspected insider threat has been using a shared workstation. The computer is on, the user is logged in, and the screen shows an open email draft. Several employees are still in the room. What is the investigator's FIRST priority?

   • AAsk the user to save the email draft and close all applications before handing over the machine.
   • BSecure the room, identify and isolate the user, and document the current screen contents before any shutdown.
   • CImmediately disconnect the network cable and then copy the email draft to a USB drive.
   • DPhotograph the screen, then immediately pull the power cord to freeze the system state.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A forensic examiner is called to testify in court about the analysis of a suspect's smartphone. During cross-examination, the defense attorney asks the examiner to explain how the examiner ensured the data extracted from the phone was not altered. What is the BEST response?

   • AI verified the integrity of the extracted data by comparing its hash value to the hash of the original data.
   • BI kept the phone in a Faraday bag during the entire examination.
   • CI documented every step I took in my notes.
   • DI used a forensic tool that is widely accepted in the industry.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   In a standard computer forensics investigation process, which phase immediately follows the collection of digital evidence?

   • APreservation
   • BFirst response
   • CExamination and analysis
   • DReporting
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which of the following is a common method used to preserve the integrity of digital evidence during storage and transportation?

   • AEncrypting the evidence with a password known only to the investigator
   • BCalculating and recording a cryptographic hash of the evidence
   • CMaking multiple copies of the evidence and storing them in different locations
   • DLabeling the evidence container with the date and time of collection
   Reveal Solution Discussion Select an answer first