Computer Forensics Investigation Process CHFI Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   An investigator is called to a crime scene where a desktop computer is running and the suspect is not present. The investigator needs to collect potential evidence from the computer. Which action is MOST appropriate for preserving volatile data?

   • AImmediately unplug the power cord to prevent any remote access.
   • BTake a photograph of the screen and then shut down the system normally.
   • CCopy the hard drive to an external drive while the system is running.
   • DCapture the contents of RAM and running processes using a forensic tool before shutting down.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   During a corporate investigation, an analyst arrives at a suspect's desk and finds the computer powered on with an open email client. The suspect is standing nearby. The analyst's first priority is to preserve volatile data. Which action should the analyst take first?

   • AImmediately shut down the computer using the operating system's shutdown command to avoid data corruption.
   • BAsk the suspect to log out of the email client so the analyst can take a clean screenshot.
   • CPerform a live acquisition of RAM using a trusted forensic tool, then document the screen contents.
   • DPhotograph the screen, then immediately pull the power cord from the back of the computer.
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A forensic investigator is preparing a report for a case where the evidence was collected from a mobile device. The report will be reviewed by the defense attorney, who is known to challenge the admissibility of digital evidence. What is the BEST way to strengthen the report's credibility?

   • AProvide only the conclusions without the supporting data to keep the report concise.
   • BInclude the hash values of all extracted data and explain how they were verified.
   • CState that the forensic tool used is certified by the vendor.
   • DUse technical language to show the investigation was thorough.
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A forensic examiner is documenting the chain of custody for a hard drive that was seized and then stored in a police evidence locker. The examiner later retrieves the drive for analysis. During the analysis, the examiner notices that the drive's serial number does not match the one recorded during seizure. What is the BEST action?

   • AContinue the analysis and note the discrepancy in the final report.
   • BStop the analysis and document the discrepancy, then investigate how the mismatch occurred.
   • CReplace the drive with a different one that matches the serial number.
   • DAssume the serial number was recorded incorrectly during seizure and proceed.
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   What is the primary purpose of maintaining a chain of custody for digital evidence?

   • ATo ensure that the evidence is stored in a secure location with limited access
   • BTo record the forensic tools used during the examination of the evidence
   • CTo demonstrate that the evidence has not been tampered with and to establish its authenticity for legal proceedings
   • DTo provide a list of all potential sources of digital evidence in the case
   Reveal Solution Discussion Select an answer first