nerdexam
GIAC

GCFA · Question #70

Adam works as a professional Computer Hacking Forensic Investigator with the local police of his area. A project has been assigned to him to investigate a PDA seized from a local drug dealer. It is…

The correct answer is D. Examination, Identification, Collection, Documentation. PDA forensic investigation follows a specific EC-Council defined sequential methodology to ensure evidence integrity. The correct procedural order per the CHFI curriculum is Examination, Identification, Collection, then Documentation.

Advanced Incident Response & Digital Forensics Fundamentals

Question

Adam works as a professional Computer Hacking Forensic Investigator with the local police of his area. A project has been assigned to him to investigate a PDA seized from a local drug dealer. It is expected that many valuable and important information are stored in this PDA. Adam follows investigative methods, which are required to perform in a pre-defined sequential manner for the successful forensic investigation of the PDA. Which of the following is the correct order to perform forensic investigation of PDA?

Options

  • AIdentification, Collection, Examination, Documentation
  • BExamination, Collection, Identification, Documentation
  • CDocumentation, Examination, Identification, Collection
  • DExamination, Identification, Collection, Documentation

How the community answered

(53 responses)
  • A
    6% (3)
  • B
    2% (1)
  • C
    15% (8)
  • D
    77% (41)

Why each option

PDA forensic investigation follows a specific EC-Council defined sequential methodology to ensure evidence integrity. The correct procedural order per the CHFI curriculum is Examination, Identification, Collection, then Documentation.

AIdentification, Collection, Examination, Documentation

This order places Identification before Examination, which skips the initial assessment of the device and scene required to understand what evidence may exist before formally cataloging it.

BExamination, Collection, Identification, Documentation

Moving from Examination directly to Collection before performing Identification means evidence is acquired without first formally recognizing and cataloging what constitutes relevant data.

CDocumentation, Examination, Identification, Collection

Beginning with Documentation before any Examination or Identification has occurred produces an incomplete and meaningless initial record, violating proper forensic sequencing.

DExamination, Identification, Collection, DocumentationCorrect

According to the EC-Council CHFI framework for PDA forensic investigation, the process begins with Examination of the device and its environment, followed by Identification of what data or artifacts constitute relevant evidence, then Collection of that evidence in a forensically sound manner, and finally Documentation of all procedures and findings. This sequence ensures the device state is thoroughly assessed before evidence is formally identified and acquired, preserving chain of custody.

Concept tested: PDA forensic investigation sequential methodology

Source: https://www.eccouncil.org/train-certify/computer-hacking-forensic-investigator-chfi/

Topics

#PDA forensics#investigation methodology#forensic process order#evidence collection

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GCFA Practice