Computer Hacking Forensic Investigator (CHFI)

Last checked October 22, 2026 against the official EC-Council exam page.

1. Question 1Forensic Process and Evidence Handling

   An investigator is asked to seize a running computer that holds volatile evidence. Which step should be taken first?

   1. AShut the computer down immediately so that the disk can be imaged without any further changes
   2. BCapture the volatile data, such as memory and network connections, before shutting the system down
   3. CLog in to the computer and browse its files to decide which evidence is worth collecting
   4. DUnplug the power cable from the wall socket so that the system stops at once without any delay
   Show answer and explanationHide answer

   Correct answer: B

   Volatile data such as RAM and live connections disappears when the system is powered off, so it must be captured first. Shutting down, logging in or pulling the plug each destroys volatile evidence.

2. Question 2Disk Forensics and File Systems

   Which type of data is stored in the unallocated space of a disk and may contain deleted files?

   1. AThe firmware code of the disk controller that is stored permanently in its chip
   2. BFiles that are currently open by the operating system in the foreground of the desktop
   3. CRemnants of files that were deleted but whose clusters have not yet been overwritten
   4. DThe temporary files that the browser writes to memory and never to the disk at all
   Show answer and explanationHide answer

   Correct answer: C

   Unallocated space holds remnants of deleted files until their clusters are overwritten, which makes it valuable for recovery. Open files, controller firmware and memory-only data are not in unallocated space.

3. Question 3Network Forensics

   Which tool captures network packets for later analysis, which is the basis of many network investigations?

   1. AA spreadsheet that lists the IP addresses of the office printers for quick reference
   2. BA word processor that writes the investigation report in a plain format for the client
   3. CA packet capture tool that records traffic for detailed analysis after it has been collected
   4. DA calendar tool that schedules the investigator's interviews with the staff in the building
   Show answer and explanationHide answer

   Correct answer: C

   Packet capture records traffic for detailed analysis, which is the foundation of network forensics. The other tools do not capture network traffic.

4. Question 4Windows Forensics

   Which Windows log records successful and failed logon attempts, which is useful for tracing account use?

   1. AThe Setup log, which records the progress of Windows installation and updates only
   2. BThe Application log, which records events generated by the installed software packages
   3. CThe Security event log, which records logon events and account activity
   4. DThe Print Service log, which records each document sent to a printer on the network
   Show answer and explanationHide answer

   Correct answer: C

   The Security event log records logon successes and failures and account activity, which is central to tracing account use. The other logs record software, installation and printing.

5. Question 5Malware Forensics

   During malware analysis, which technique involves examining the code without running it?

   1. ADynamic analysis, which runs the sample and observes its behaviour on a monitored system
   2. BStatic analysis, which examines the sample's code and strings without executing it
   3. CLive response, which collects data from a running system to understand its current state
   4. DNetwork replay, which sends the captured traffic back to the network to see the effect
   Show answer and explanationHide answer

   Correct answer: B

   Static analysis examines code and strings without execution. Dynamic analysis, live response and network replay all involve running or interacting with the malware or system.