During testimony, a forensic expert is asked whether a particular file was 'deleted' by the suspect. The expert's analysis shows the file was moved to the recycle bin and then emptied. What is the most accurate statement the expert can make?

The file is irrelevant because it was deleted.

The file was deleted by the suspect because it was in the recycle bin.

The file's directory entry was removed, but the data may still exist in unallocated space.

The file was permanently destroyed and cannot be recovered.

When collecting digital evidence from a computer that is turned off, which of the following is the most appropriate technique?

Create a bit-for-bit forensic image of the hard drive using a write blocker

Remove the hard drive and place it in an anti-static bag without any further action

Boot the computer and run a data recovery tool to extract deleted files

Copy all visible files and folders to an external hard drive

An investigator has created a forensic image of a suspect's drive and stored it on a network share. The investigator needs to ensure the image remains unaltered while the case is ongoing. Which measure is most effective?

Store the image on a RAID-5 array to protect against disk failure.

Compress the image into a ZIP file with a password.

Compute a cryptographic hash of the image and store the hash in a secure location.

Place the image in a folder with read-only permissions for all users except the investigator.

Which of the following activities is typically performed during the examination and analysis phase of a computer forensics investigation?

Sealing the evidence in an anti-static bag

Creating a chain of custody document

Searching the forensic image for keywords related to the case

Interviewing witnesses at the crime scene

A first responder arrives at a scene where a suspect's laptop is open and the screen shows an encrypted file container. The suspect is not present. The responder must preserve evidence. Which action is most appropriate?

Close the encrypted container and shut down the laptop immediately.

Unplug the laptop and remove the battery to ensure it powers off quickly.

Photograph the screen, then perform a live memory acquisition to capture the decryption key.

Wait for the suspect to return to ask for the password.

EC-CouncilComputer Hacking Forensic Investigator

Domain 1Objective 2

Computer Forensics Investigation Process CHFI Practice Questions (Page 9)

Part of the Forensic Fundamentals and Process domain, which makes up ~14% of our current practice bank.

51questions here

11free pages

7concepts

Questions 41–45

41expert · hard
During testimony, a forensic expert is asked whether a particular file was 'deleted' by the suspect. The expert's analysis shows the file was moved to the recycle bin and then emptied. What is the most accurate statement the expert can make?
Select an answer first
42foundation · easy
When collecting digital evidence from a computer that is turned off, which of the following is the most appropriate technique?
Select an answer first
43expert · hard
An investigator has created a forensic image of a suspect's drive and stored it on a network share. The investigator needs to ensure the image remains unaltered while the case is ongoing. Which measure is most effective?
Select an answer first
44foundation · easy
Which of the following activities is typically performed during the examination and analysis phase of a computer forensics investigation?
Select an answer first
45expert · hard
A first responder arrives at a scene where a suspect's laptop is open and the screen shows an encrypted file container. The suspect is not present. The responder must preserve evidence. Which action is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CHFI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CHFI” is a trademark of its owner, used for identification only.