CHFI

David, a forensic investigator, needs to acquire volatile data from a running system. Which of the following should he use?

Which of the following is a technique used to hide data within other data, such as an image or audio file?

A forensic investigator is examining a file system and needs to determine if files have been hidden using NTFS alternate data streams. Which tool should he use?

During a forensic investigation, Maria finds that several files on a suspect’s computer have been overwritten multiple times. Which of the following techniques was likely used to prevent data recovery?

Which file system is commonly used by Windows operating systems and supports features such as file compression, encryption, and large file support?

A forensic investigator is tasked with examining an Android device. Which of the following tools is specifically designed for mobile device forensics?

Which of the following methods is used to ensure the integrity and authenticity of digital evidence collected during an investigation?

While examining a suspect’s computer, a forensic investigator finds a large number of deleted files. Which tool can be used to recover these deleted files?

In the context of computer forensics, what does the term “chain of custody” refer to?

Which of the following is a digital forensics framework that provides a graphical interface for The Sleuth Kit?