CHFI and cyber forensics interview questions with model answers

Key takeaways

• Interviewers care about process: preserve, copy, verify, analyse, report.
• Know chain of custody, hashing and write blockers cold.
• Be ready to explain volatile versus non-volatile evidence and order of volatility.
• Name tools only after explaining what you are trying to do.
• Practise a full imaging and hashing exercise in a lab before the interview.

Fundamentals

1. What is cyber forensics?

It is the process of identifying, preserving, analysing and presenting digital evidence from computers, networks and devices so that it can be used in an investigation or in court.

2. How is it different from incident response?

Incident response aims to contain and recover. Forensics aims to find out what happened and preserve evidence. They overlap, and responders must avoid destroying evidence.

3. What are the main phases of an investigation?

Identification, preservation, collection, examination, analysis and reporting. Some frameworks add search and seizure and testimony. Our article on the what a digital forensics investigation involves goes through them.

4. What is the order of volatility?

Collect the most volatile data first: CPU registers and cache, memory (RAM), network state and running processes, then disk, then logs and archived media.

5. What is the Locard exchange principle?

Every contact leaves a trace. In digital terms, an action on a system leaves artefacts such as logs, timestamps or temporary files that an examiner can look for.

Evidence handling

6. What is chain of custody?

A documented record of who handled the evidence, when, where and why. It shows the evidence stayed unaltered and helps keep it admissible.

7. What is a write blocker and why use one?

A hardware or software device that lets you read a drive without writing to it. It protects the original from accidental change.

8. Why do you work on a copy?

Analysis can change timestamps and data. A verified forensic image lets you work freely while the original stays untouched.

9. What is a hash and what does it prove?

A hash such as SHA-256 is a fixed-length fingerprint of data. Matching hashes of the source and the image show the copy is identical. MD5 is still seen but SHA-256 is preferred because MD5 has known collision weaknesses.

10. Should you power off a running machine?

It depends. Powering off loses memory contents. If volatile data matters, capture memory first. Follow the agreed procedure and document what you did.

Acquisition

11. What is a forensic image?

A bit-for-bit copy of a storage device, including unallocated space and slack space as well as visible files.

12. Physical versus logical acquisition?

Physical copies every sector of the device. Logical copies files and folders the file system presents. Physical captures deleted data and unallocated space, logical does not.

13. How would you image a disk in a lab?

Attach it behind a write blocker, image it with a tool such as FTK Imager or dd, hash the source and the image, and record both hashes.

$ sudo dd if=/dev/sdb of=evidence.img bs=4M conv=noerror, sync status=progress
$ sha256sum /dev/sdb evidence.img

Use this on practice media you own.

14. What is slack space?

The unused part of the last cluster allocated to a file. It can hold remnants of earlier data.

15. How do you collect evidence from a cloud service?

Work through legal process or the account owner's authorisation, use the provider's export tools and logs, and record hashes and timestamps. You cannot image the provider's hardware.

Analysis

16. What is file carving?

Recovering files from raw data by looking for file signatures (headers and footers), without relying on file system records.

17. How do you recover deleted files?

On many file systems, deletion removes the directory entry but leaves the data until it is overwritten. Tools such as Autopsy can recover them from the image.

18. What are timestamps MAC times?

Modified, accessed and created (or changed) times. They help build a timeline, but can be altered, so correlate with other artefacts.

19. What artefacts do you check for web activity?

Browser history, cache, cookies, downloads and session data. Our digital forensics guide covers these artefacts.

20. What is memory forensics?

Analysing a RAM capture for running processes, network connections, loaded modules and keys. Volatility is a common framework.

21. How do you spot anti-forensic techniques?

Look for timestamp mismatches, wiping tools, unusual file signatures, encrypted containers, and gaps in logs.

22. How do you analyse a suspicious email?

Examine the full headers, trace the Received lines, check SPF, DKIM and DMARC results, and inspect attachments in a sandbox.

Tools

23. Which tools have you used?

Name tools you have actually used in a lab. Typical answers include FTK Imager, Autopsy, EnCase, Volatility and Wireshark. Say what each is for.

24. Autopsy versus EnCase?

Autopsy is free and open source, built on The Sleuth Kit. EnCase is a commercial suite. Both analyse images.

25. What does Wireshark add to forensics?

It lets you analyse captured network traffic to see connections, protocols and transferred content.

Reporting and law

26. What goes in a forensic report?

Scope, evidence list with hashes, methods and tool versions, findings with supporting artefacts, timeline and conclusions, kept separate from opinion.

27. How do you explain findings to a non-technical audience?

Use plain words, short timelines and screenshots, and state what the evidence does and does not prove.

28. What does the law say about electronic evidence in India?

Electronic records are admissible under conditions that include a certificate about the record. This was Section 65B of the Indian Evidence Act and is now covered by the Bharatiya Sakshya Adhiniyam, 2023. Confirm the current provisions with legal counsel before you quote them.

29. What is your approach if you find illegal content on a suspect's drive?

Stop, do not copy or share it, secure the evidence and report to the person in charge following legal procedure.

30. How do you stay current?

Practise on public disk images and capture-the-flag labs, read vendor documentation, and keep a lab notebook.

How to practise

Take a disk image from a public forensic training dataset or one you created, and do the whole process: hash, open in Autopsy, build a timeline, and write a two-page report. The NIST SP 800-86 guide gives a clear process outline.

Next steps

If you want hands-on practice with imaging and analysis, see our CHFI course. More questions are in VAPT and forensics interview questions.

Related reading

• Is Digital Forensics a Good Career Option in India?