What is the purpose of hashing an acquired forensic image?

To encrypt the image to protect it from unauthorized access

To compress the image to save storage space

To verify the integrity of the image by ensuring it matches the original

To index the files in the image for faster searching

A forensic examiner is acquiring evidence from a corporate laptop. The laptop is owned by the company, and the employee is suspected of data theft. The examiner must ensure that the evidence is admissible in court and that the company's legal team is satisfied. Which action is most important to maintain the chain of custody?

Take photographs of the evidence at the scene

Document every person who handles the evidence, with dates, times, and purpose

Store the evidence in a locked cabinet with limited access

Use a forensic tool that automatically generates a report

What is a key feature of the Linux 'dd' command used in forensic acquisition?

It automatically hashes the output

It creates a bit-for-bit copy of a storage device

It only works on Windows systems

It performs logical acquisition only

Which of the following is a key element of a proper chain of custody record?

The size of the evidence storage device

The brand of the forensic tool used

The date and time of each transfer of custody

What is a primary challenge of remote acquisition?

The need for a hardware write blocker

Ensuring the integrity of data during transmission

The need to power off the remote system

The inability to acquire volatile data

EC-CouncilComputer Hacking Forensic Investigator

Domain 2Objective 2

Data Acquisition and Duplication CHFI Practice Questions (Page 8)

Part of the Storage Media, Acquisition and Anti-Forensics domain, which makes up ~18% of our current practice bank.

56questions here

12free pages

14concepts

Questions 36–40

36foundation · easy
What is the purpose of hashing an acquired forensic image?
Select an answer first
37expert · medium
A forensic examiner is acquiring evidence from a corporate laptop. The laptop is owned by the company, and the employee is suspected of data theft. The examiner must ensure that the evidence is admissible in court and that the company's legal team is satisfied. Which action is most important to maintain the chain of custody?
Select an answer first
38foundation · easy
What is a key feature of the Linux 'dd' command used in forensic acquisition?
Select an answer first
39foundation · easy
Which of the following is a key element of a proper chain of custody record?
Select an answer first
40foundation · easy
What is a primary challenge of remote acquisition?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CHFI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CHFI” is a trademark of its owner, used for identification only.