Question bank
Computer Hacking Forensic Investigator
46 Computer Hacking Forensic Investigator questions with the correct answer and a written explanation, organised across 10 exam domains.
- 46 questions
- 10 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Cloud/IoT Forensics
4 questions in this domain
- Question 1Single Choice
During a live forensic response, which action must be performed first to preserve the most ephemeral data?
- ACapture the contents of RAMCorrect answer
- BPull the power plug to protect the hard drive
- CCreate a bit-stream image of the internal SSD
- DPhotograph and document the physical hardware
Why this is the answer
Volatile evidence in RAM is lost when power is removed; it is the highest priority in the Order of Volatility.
- Question 2Multiple Select
Select all of the following that are examples of non-volatile evidence.
- ASolid-state drive (SSD)Correct answer
- BUSB flash driveCorrect answer
- CRAM
- DCPU cache
Why this is the answer
Non-volatile evidence persists without power; SSDs and USB flash drives retain data. RAM and CPU cache are volatile and lose data when power is removed.
- Question 3Interactive
Review the command sequence. What forensic acquisition process is being executed?
- ABit-stream imagingCorrect answer
- BSimple file copy
- CLogical acquisition
- DVolatile memory capture
Why this is the answer
The dd command creates a sector-by-sector copy of the whole drive, and sha256sum generates an integrity hash, indicating bit-stream imaging.
- Question 4Single Choice
Why is the chain of custody critical in a forensic investigation?
- ATo prove evidence has not been tampered with by documenting every transferCorrect answer
- BTo speed up the forensic imaging process
- CTo encrypt the evidence at rest
- DTo assign ownership of the case to a specific investigator
Why this is the answer
A continuous chain of custody tracks evidence handling and control; any gap can cause legal dismissal.
Digital Evidence
4 questions in this domain
- Question 5Single Choice
In a digital forensic investigation, which of the following statements correctly describes volatile evidence that must be collected first?
- ALost when power is removedCorrect answer
- BRemains on a hard drive after shutdown
- CHidden within image files
- DPhysical hardware used in crime
Why this is the answer
Volatile evidence resides in temporary storage such as RAM, CPU registers, and cache, so it is lost when power is removed.
- Question 6Multiple Select
Which of the following items are examples of non-volatile evidence that remain intact after the system is powered down? Select all that apply.
- ASolid-state drive (SSD)Correct answer
- BOptical mediaCorrect answer
- CRandom Access Memory (RAM)
- DUSB flash driveCorrect answer
Why this is the answer
Non-volatile evidence remains intact after power is removed; SSDs, optical media, and USB drives persist, while RAM is volatile.
- Question 7Interactive
During a forensic acquisition, an examiner runs the command shown in the exhibit. What is the primary purpose of this command?
- AVerifying acquisition integrity by hashingCorrect answer
- BEncrypting evidence for confidentiality
- CCreating a compressed evidence archive
- DGenerating file system metadata
Why this is the answer
The command compares hash values; matching hashes prove the forensic copy is an exact, unaltered duplicate of the original.
- Question 8Single Choice
Which statement correctly describes latent evidence that a forensic examiner may recover from a storage device?
- ANot visible without specialized toolsCorrect answer
- BResides only in CPU cache
- CDocumented in chain of custody
- DStored only on optical media
Why this is the answer
Latent evidence is not immediately visible and may include deleted files, slack space, unallocated clusters, or data hidden in carrier files.
Digital Forensics
7 questions in this domain
- Question 9Single Choice
Which category of digital evidence is permanently lost as soon as a computer loses power?
- AVolatile evidenceCorrect answer
- BNon-volatile evidence
- CLatent evidence
- DPhysical evidence
Why this is the answer
Volatile evidence resides in temporary storage such as RAM, CPU registers, and cache, and is lost when power is removed.
- Question 10Multiple Select
Which of the following are examples of non-volatile evidence? Select all that apply.
- AHard disk driveCorrect answer
- BSolid-state driveCorrect answer
- CRAM contents
- DCPU cache
Why this is the answer
Hard disk drives and SSDs are non-volatile storage. RAM and CPU cache are volatile and lose data when power is removed.
- Question 11Interactive
The provided code block shows a live system acquisition. Why is the RAM dump captured before any disk acquisition?
- ABecause RAM is volatile and would be lost during shutdownCorrect answer
- BBecause the hard drive is less important
- CBecause RAM contains only metadata
- DBecause the Order of Volatility requires disk capture first
Why this is the answer
RAM is volatile and contains active processes, network connections, and encryption keys. It must be captured before power loss.
- Question 12Single Choice
Which principle requires continuous and chronological documentation of evidence movement?
- AChain of CustodyCorrect answer
- BWrite Blocking
- CBit-stream Imaging
- DHash Verification
Why this is the answer
Chain of custody is a continuous chronological log that tracks evidence movement, handling, and control. Any gap can invalidate evidence.
- Question 13Multiple Select
Which statements accurately describe bit-stream imaging? Select all that apply.
- AIt creates a sector-by-sector, bit-for-bit copyCorrect answer
- BIt captures deleted files and unallocated spaceCorrect answer
- CIt only copies active user files
- DIt updates access timestamps on the original drive
Why this is the answer
Bit-stream imaging copies the entire physical drive sector-by-sector, including hidden and deleted data in unallocated space.
- Question 14Interactive
The code block shows an examiner imaging a suspect drive. Why is a bit-stream image required instead of a normal file copy?
- AIt preserves hidden and deleted dataCorrect answer
- BIt is faster than a file copy
- CIt eliminates the need for a write blocker
- DIt verifies file content semantics
Why this is the answer
Bit-stream imaging captures all sectors of the drive, including deleted files and system artifacts in unallocated space.
- Question 15Single Choice
What is the primary purpose of a hardware write blocker during forensic imaging?
- ATo prevent any write operations to the original mediaCorrect answer
- BTo increase the speed of the imaging process
- CTo recover deleted files from the drive
- DTo generate a hash of the evidence
Why this is the answer
A hardware write blocker prevents any data from being written to the original media, ensuring the evidence remains pristine.
Forensic Science
3 questions in this domain
- Question 16Single Choice
Which type of evidence is lost when power is removed from a device?
- AVolatile evidenceCorrect answer
- BNon-volatile evidence
- CLatent evidence
- DPhysical evidence
Why this is the answer
Volatile evidence resides in temporary storage such as RAM and CPU registers. It is irrecoverably lost when power is removed, so it must be captured first.
- Question 17Multiple Select
Which of the following are classified as non-volatile evidence? Select all that apply.
- ASolid-state driveCorrect answer
- BOptical discCorrect answer
- CRAM contents
- DUSB flash driveCorrect answer
Why this is the answer
Non-volatile evidence includes data on hard drives, SSDs, optical media, and USB flash drives. RAM is volatile because it requires continuous power to retain data.
- Question 18Interactive
The code block displays file system attributes. What category of evidence is the investigator collecting?
- AMetadataCorrect answer
- BVolatile evidence
- CPhysical evidence
- DCryptographic hash
Why this is the answer
The command retrieves file names, creation, access, and modification times, which are descriptive attributes, i.e., metadata, rather than file content or volatile data.
Forensics Investigation Process
6 questions in this domain
- Question 19Single Choice
What type of evidence is lost when power is removed from a device?
- AVolatile evidenceCorrect answer
- BNon-volatile evidence
- CLatent evidence
- DPhysical evidence
Why this is the answer
Volatile evidence resides in RAM, CPU registers, and cache, and is permanently lost when power is removed.
- Question 20Multiple Select
Which items are examples of volatile evidence? Select all that apply.
- AActive network connectionsCorrect answer
- BDecrypted passwords in RAMCorrect answer
- CCPU registersCorrect answer
- DFiles on an SSD
Why this is the answer
Active network connections, decrypted passwords, and CPU registers are volatile. Files on an SSD are non-volatile and persist after power loss.
- Question 21Interactive
Review the Python code block. What will happen to the hash output if a single bit changes in evidence.bin?
- AA completely different hash is producedCorrect answer
- BOnly one character of the hash changes
- CThe hash remains identical
- DThe hash algorithm returns an error
Why this is the answer
Hashing exhibits the avalanche effect: any small input change produces a drastically different digest.
- Question 22Single Choice
Which category of evidence remains intact even after the system is powered down?
- ANon-volatile evidenceCorrect answer
- BVolatile evidence
- CNetwork connections
- DRunning processes
Why this is the answer
Non-volatile evidence, such as hard drives and SSDs, persists after power removal and provides long-term history.
- Question 23Multiple Select
Which sources are considered latent evidence? Select all that apply.
- ADeleted filesCorrect answer
- BSlack spaceCorrect answer
- CSteganographic hidden dataCorrect answer
- DRAM cache
Why this is the answer
Latent evidence includes deleted files, slack space, unallocated clusters, and hidden data in steganographic files.
- Question 24Interactive
Inspect the shell command in the code block. What kind of forensic acquisition is being performed?
- ABit-stream imagingCorrect answer
- BFile copy
- CMetadata extraction
- DRAM capture
Why this is the answer
The dd command creates a bit-for-bit, sector-by-sector copy of the drive, known as bit-stream imaging.
Malware Forensics
4 questions in this domain
- Question 25Single Choice
Which category of digital evidence is lost as soon as power is removed from a device?
- AVolatile evidenceCorrect answer
- BNon-volatile evidence
- CLatent evidence
- DPhysical evidence
Why this is the answer
Volatile evidence resides in RAM, caches, and CPU registers and is permanently lost when power is removed; therefore it must be captured first.
- Question 26Multiple Select
Which of which of these are examples of non-volatile evidence? Select all that apply.
- AHard drivesCorrect answer
- BSSDsCorrect answer
- CUSB flash drivesCorrect answer
- DRAM
Why this is the answer
Non-volatile evidence remains intact after power-off; hard drives, SSDs, and USB flash drives persist, while RAM is volatile and loses data.
- Question 27Interactive
Examine the file listing in the code block. Which metadata category includes the date and time displayed?
- AMAC timestampCorrect answer
- BExif data
- CCryptographic hash
- DFile ownership
Why this is the answer
The date and time in a file listing correspond to MAC (Modified, Accessed, Created) timestamps, not hash values or file ownership.
- Question 28Single Choice
What is the function of a certified hardware write blocker during evidence acquisition?
- AAny write operations to suspect mediaCorrect answer
- BData encryption on the original drive
- CDeletion of temporary files
- DAutomatic malware execution
Why this is the answer
A hardware write blocker ensures the original media receives no write operations, preserving its pristine state and making the evidence legally defensible.
Network Forensics
5 questions in this domain
- Question 29Single Choice
According to the Order of Volatility, which type of evidence must be captured first when investigating a live system?
- AVolatile evidence stored in RAMCorrect answer
- BNon-volatile evidence on the hard drive
- CLatent evidence in unallocated space
- DPhysical evidence such as a router
Why this is the answer
Volatile evidence, such as RAM contents, is lost when power is removed, so it must be collected first according to the Order of Volatility.
- Question 30Multiple Select
Which of the following are examples of volatile evidence that exist in temporary storage? (Select all that apply)
- AData in RAMCorrect answer
- BCPU registersCorrect answer
- CCache memoryCorrect answer
- DData on an SSD
Why this is the answer
Volatile evidence resides in RAM, CPU registers, and cache, and it is lost when power is removed. SSDs retain data after power-off.
- Question 31Interactive
Examine the file listing shown in the code block. Which forensic metadata category is represented by the output?
- AMAC timestampsCorrect answer
- BExif data
- CEmail header information
- DCryptographic hash values
Why this is the answer
The stat output shows Access, Modify, and Change times, which are the MAC timestamps used to build a forensic timeline.
- Question 32Single Choice
What is the name of the continuous chronological documentation that tracks the movement, handling, and control of evidence?
- AChain of CustodyCorrect answer
- BWrite Blocker log
- CHash manifest
- DMetadata report
Why this is the answer
A chain of custody is a continuous chronological log of evidence movement; any gap can lead to legal dismissal.
- Question 33Multiple Select
Which of the following measures help ensure the integrity of original evidence during forensic acquisition? (Select all that apply)
- AUsing a hardware write blockerCorrect answer
- BCreating a bit-stream imageCorrect answer
- CComparing SHA-256 hashesCorrect answer
- DOpening files directly to inspect contents
Why this is the answer
Hardware write blockers keep the original pristine, bit-stream images capture all data, and hashes verify the copy is identical.
Procedures and Methodology
4 questions in this domain
- Question 34Single Choice
Which type of evidence disappears immediately when power is removed from a device?
- AVolatile EvidenceCorrect answer
- BNon-Volatile Evidence
- CLatent Evidence
- DPhysical Evidence
Why this is the answer
Volatile evidence resides in RAM, CPU registers, and cache. It is lost when power is removed, so it must be captured first.
- Question 35Multiple Select
Select TWO examples of volatile storage where data is lost when the system loses power.
- ARAMCorrect answer
- BCPU registersCorrect answer
- CHard disk
- DSolid-state drive
Why this is the answer
RAM and CPU registers are temporary storage; hard disks and SSDs retain data after power loss, making them non-volatile.
- Question 36Interactive
Review the acquisition script in the code block. Why is this procedure considered forensically unsound for preserving the original storage media?
- AIt uses dd to capture RAM
- BIt performs a standard file copy instead of a bit-stream imageCorrect answer
- CIt records network connections before RAM
- DIt writes the acquired data to the wrong directory
Why this is the answer
A standard file copy only stores active files and alters timestamps. A forensically sound duplicate requires bit-stream imaging of the entire physical drive.
- Question 37Single Choice
Deleted files and data hidden in slack space are examples of which evidence type?
- ALatent EvidenceCorrect answer
- BVolatile Evidence
- CPhysical Evidence
- DMetadata
Why this is the answer
Latent evidence is not visible to the naked eye and requires specialized tools to recover from slack space, unallocated clusters, or steganographic carriers.
Reporting & Testimony
3 questions in this domain
- Question 38Single Choice
Which type of evidence is immediately lost when a device loses power?
- AVolatile evidenceCorrect answer
- BNon-volatile evidence
- CLatent evidence
- DPhysical evidence
Why this is the answer
Volatile evidence is stored in RAM, CPU registers, or cache and is destroyed when power is removed, making it the highest collection priority.
- Question 39Multiple Select
What are the valid examples of non-volatile evidence? Select all that apply.
- AHard driveCorrect answer
- BRAM contents
- CUSB flash driveCorrect answer
- DCPU registers
Why this is the answer
Non-volatile evidence persists after power loss and includes hard drives, SSDs, optical media, and USB flash drives; RAM and CPU registers are volatile.
- Question 40Interactive
A forensic analyst runs a metadata inspection command and receives the output shown in the code block. Based on that output, which timestamp corresponds to the last modification of the file's contents?
- AAccess
- BModifyCorrect answer
- CChange
- DBirth
Why this is the answer
MAC times include Modified, Accessed, and Created; in the code block, the 'Modify' timestamp shows when the file content was last changed.
Tools/Systems/Programs
6 questions in this domain
- Question 41Single Choice
Which type of evidence is permanently destroyed as soon as a device loses power?
- AVolatile evidenceCorrect answer
- BNon-volatile evidence
- CLatent evidence
- DPhysical evidence
Why this is the answer
Volatile evidence resides in RAM, CPU registers, and cache, so removing power destroys it instantly.
- Question 42Multiple Select
Which storage media qualify as non-volatile evidence sources? Select all that apply.
- AHard disk driveCorrect answer
- BSolid-state driveCorrect answer
- CRandom access memory content
- DUSB flash driveCorrect answer
Why this is the answer
Hard drives, SSDs, and USB flash drives retain data without power; RAM content is volatile.
- Question 43Interactive
Inspect the command-line snippet. Which forensic acquisition process is being performed?
- ABit-stream imagingCorrect answer
- BFile copy
- CWrite blocking
- DHash verification
Why this is the answer
The dd command with a raw device and a separate output creates a sector-by-sector bit-stream image.
- Question 44Single Choice
What is the primary function of a hardware write blocker in forensic acquisitions?
- APrevents any writes to original mediaCorrect answer
- BEncrypts the original drive
- CSpeeds up the imaging process
- DRecovers deleted files
Why this is the answer
A certified hardware write blocker physically blocks all write operations, preserving the original evidence.
- Question 45Multiple Select
Which elements must be recorded in a valid chain of custody? Select all that apply.
- AChronological movement logCorrect answer
- BNames of all handlersCorrect answer
- CSecure storage detailsCorrect answer
- DSuspect's confession statement
Why this is the answer
Chain of custody requires continuous chronological documentation of movement, handling, and storage; a confession is not part of it.
- Question 46Interactive
Examine the command-line snippet. What is the purpose of running this command on a forensic image?
- AIntegrity verificationCorrect answer
- BWrite protection
- CData carving
- DMetadata extraction
Why this is the answer
sha256sum computes a cryptographic hash that can be compared to the original to verify image integrity.
Frequently asked questions
Everything about the Computer Hacking Forensic Investigator question bank and how to use it.