Computer Hacking Forensic Investigator (CHFI v10) — Question 233

When marking evidence that has been collected with the `aaa/ddmmyy/nnnn/zz` format, what does the `nnnn` denote?

Answer options

• A. The initials of the forensics analyst
• B. The sequence number for the parts of the same exhibit
• C. The year he evidence was taken
• D. The sequential number of the exhibits seized by the analyst

Correct answer: D

Explanation

The correct answer is D because `nnnn` represents the sequential number assigned to each exhibit taken by the analyst. Option A is incorrect as it refers to the analyst's initials, while B mentions sequence numbers for parts of the same exhibit, which does not apply to `nnnn`. Option C wrongly identifies `nnnn` as the year of evidence collection, which is not its purpose.