Computer Forensics Investigation Process CHFI Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   An investigator is examining a suspect's laptop for evidence of unauthorized data exfiltration. The investigator finds a suspicious file that appears to be a compressed archive. What is the MOST appropriate next step in the examination?

   • ACreate a forensic image of the laptop and analyze the archive within the image using forensic tools.
   • BOpen the archive with a hex editor to view its contents without extracting.
   • CExtract the archive to a new folder on the same laptop for analysis.
   • DCopy the archive to the investigator's workstation and extract it there.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A forensic examiner is preparing the final report for a case involving a company's internal investigation. The report will be reviewed by the legal team and possibly used in court. Which element is ESSENTIAL to include in the report?

   • AA chronological narrative of the investigation, including all actions taken and evidence collected.
   • BA summary of the investigator's personal opinion about the suspect's guilt.
   • CA detailed description of the forensic tools used, including version numbers and settings.
   • DA clear statement of findings, conclusions, and the evidence supporting each conclusion.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   During cross-examination, a forensic expert is asked whether a specific tool used in the investigation is 'forensically sound.' How should the expert respond?

   • AState that the tool is forensically sound because it is certified by the vendor.
   • BSay 'yes' because the tool is widely used in the industry.
   • CRefuse to answer because tool validation is a trade secret.
   • DExplain that the tool was tested and validated for the specific type of acquisition performed.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A forensic examiner is preparing to testify as an expert witness in a case involving email evidence. The examiner used a forensic tool to recover deleted emails from a suspect's computer. During direct examination, the prosecutor asks the examiner to explain the process used. What is the BEST way for the examiner to respond?

   • AProvide a detailed technical explanation of the tool's internal algorithms.
   • BExplain the steps taken in a clear, logical sequence, avoiding technical jargon.
   • CState that the tool is widely accepted and therefore the results are reliable.
   • DRefer to the written report and refuse to elaborate.
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   An investigator is collecting evidence from a network server that is part of a botnet. The server is located in a different country with different data protection laws. The investigator needs to collect the server's logs and memory. What is the MOST important consideration?

   • AThe investigator must comply with the legal requirements of the country where the server is located.
   • BThe investigator should use remote forensic tools to collect data without physical access.
   • CThe investigator should immediately shut down the server to prevent further botnet activity.
   • DThe investigator should ignore local laws because the investigation is for a criminal case.
   Reveal Solution Discussion Select an answer first