CHFI Test Questions with 100% Correct Verified
Answers
The GUID has this number of hexadecimal digits, with groups separated by hyphens. - ✅32
This command can be used to obtain details about partitions. - ✅Get-PartitionTable
In UEFI SEC, this is initialized. - ✅code
This is wasted area of the disk cluster, lying between the end of the file and end of the cluster. -
✅Slack space
Tasha is looking for the UEFI phase that involves clearing UEFI from memory. - ✅RT
The GUID is how many bits? - ✅128
Which Windows version boots in either UEFI-GPT or BIOS-MBR? - ✅10
This is a tool for Mac that can be used to recover files from crashed or virus corrupted
hard drives. - ✅File Salvage
Keira is an investigator with the FBI that needs to recover lost files from a USB flash drive.
Which tool can help her do this? - ✅DiskDigger
Sandra needs to see details about GPT partition tables in Mac OS. Which tool should she use? -
✅disk utility
, UTC stands for: - ✅Coordinated Universal Time
A Digital Forensic Investigator investigates this type of crime (choose the best answer). -
✅Digital crime
What does ETI stand for? - ✅Enterprise Theory of Investigation
System time is an example of non-volatile data. - ✅False
John is a forensic investigator working on a case for a WHC hospital. John finds a USB drive
sitting behind an access control door in the server room. The hospital provides John access to
retrieve the device. John knows that the USB represents: - ✅Non-volatile data
The SWGDE 1.1 standard maintains that agencies seizing or examining digital evidence must do
this. - ✅Maintain an appropriate SOP document.
Shamika is the VP of Technology at XYZ, Inc. She suspects that her newest employee, David,
may be using his work computer to look at child pornography. What type of
investigation(s) should be started? - ✅Criminal and administrative
Randill, Inc has initiated an informal evidence collection process. Which type of
investigation usually has an informal process for evidence collection? - ✅Civil
A warrantless seizure of digital evidence is used when: - ✅The destruction of evidence
is imminent and there is cause to believe that the item being seized constitutes evidence
of criminal activity
An internal investigation, undertaken by an organization, to determine if employees are
following rules and/or policies is called. - ✅Administrative
Answers
The GUID has this number of hexadecimal digits, with groups separated by hyphens. - ✅32
This command can be used to obtain details about partitions. - ✅Get-PartitionTable
In UEFI SEC, this is initialized. - ✅code
This is wasted area of the disk cluster, lying between the end of the file and end of the cluster. -
✅Slack space
Tasha is looking for the UEFI phase that involves clearing UEFI from memory. - ✅RT
The GUID is how many bits? - ✅128
Which Windows version boots in either UEFI-GPT or BIOS-MBR? - ✅10
This is a tool for Mac that can be used to recover files from crashed or virus corrupted
hard drives. - ✅File Salvage
Keira is an investigator with the FBI that needs to recover lost files from a USB flash drive.
Which tool can help her do this? - ✅DiskDigger
Sandra needs to see details about GPT partition tables in Mac OS. Which tool should she use? -
✅disk utility
, UTC stands for: - ✅Coordinated Universal Time
A Digital Forensic Investigator investigates this type of crime (choose the best answer). -
✅Digital crime
What does ETI stand for? - ✅Enterprise Theory of Investigation
System time is an example of non-volatile data. - ✅False
John is a forensic investigator working on a case for a WHC hospital. John finds a USB drive
sitting behind an access control door in the server room. The hospital provides John access to
retrieve the device. John knows that the USB represents: - ✅Non-volatile data
The SWGDE 1.1 standard maintains that agencies seizing or examining digital evidence must do
this. - ✅Maintain an appropriate SOP document.
Shamika is the VP of Technology at XYZ, Inc. She suspects that her newest employee, David,
may be using his work computer to look at child pornography. What type of
investigation(s) should be started? - ✅Criminal and administrative
Randill, Inc has initiated an informal evidence collection process. Which type of
investigation usually has an informal process for evidence collection? - ✅Civil
A warrantless seizure of digital evidence is used when: - ✅The destruction of evidence
is imminent and there is cause to believe that the item being seized constitutes evidence
of criminal activity
An internal investigation, undertaken by an organization, to determine if employees are
following rules and/or policies is called. - ✅Administrative
