10 exam-style questions with answers and explanations, straight from our 1,030-question bank. Tap an answer to check yourself. When you're ready, take the scored version in the free practice test.
The CSFA exam has 175 questions and runs 4 hours.
These 10 free CSFA questions are organized by exam domain, so you can see how each part of the Certified Surgical First Assistant blueprint is tested. Reveal the answer and explanation under each question.
An examiner acquires a forensic image of a suspect hard drive. The MD5 hash calculated from the source drive before acquisition matches the MD5 hash calculated from the resulting image file. This match establishes that:
Correct answer: B - The image is a complete and unaltered copy of the source as it existed at the time of acquisition
An examiner arrives at a scene and finds a workstation powered on and logged in. A volume labeled 'Archive (V:)' is visible in File Explorer and is confirmed to be a mounted VeraCrypt container. Which action BEST preserves the available evidence?
Correct answer: B - Capture volatile memory, then acquire the mounted volume while it is still open
A hardware write blocker is correctly installed between a solid-state drive and the forensic workstation, and its operation has been verified. Which statement about deleted data on that drive is MOST accurate?
Correct answer: A - The drive's own TRIM and garbage collection may have already purged deleted data
A file is deleted from a FAT32 volume. The examiner locates the directory entry and observes that the first byte of the filename has been replaced with 0xE5. Which information remains available from the file system structures?
Correct answer: A - The starting cluster number and the logical size of the file
FAT file systems store file timestamps in Coordinated Universal Time (UTC), while NTFS stores file timestamps in the system's local time.
Correct answer: B - False
A volume is formatted with 512-byte sectors and 8 sectors per cluster. A file of 3,000 bytes is written to a newly allocated cluster on this volume. How much total file slack is created?
Correct answer: C - 1,096 bytes
An examiner runs a raw physical keyword search for the term 'Kingfisher' across an entire Windows image and receives no hits. The term is later found in the visible text of a .docx file located in the user's Documents folder. What is the MOST likely explanation?
Correct answer: C - A .docx file is a compressed container, so its text is not stored as plaintext
A prefetch file named ERASER.EXE-B4C71A2F.pf is present in C:\Windows\Prefetch. The Eraser application is not installed, and no copy of eraser.exe exists anywhere on the volume. What does this artifact MOST reliably establish?
Correct answer: D - Eraser was executed on this system at some point, possibly from external media
A LNK file in a user's Recent folder references the target G:\ProjectFalcon\bid_summary.xlsx. No G: volume is connected and the file does not exist on the system. Which comparison would BEST corroborate that a particular USB device was the source of that file?
Correct answer: B - The volume serial number in the LNK file against the USBSTOR registry entries
An examiner exports a Chrome History database and finds visit times stored as the integer 13350988800000000. Which epoch must be applied to convert this value correctly?
Correct answer: D - Microseconds elapsed since 1 January 1601 (WebKit time)
The full bank has 1,020 more CSFA questions with explanations.
Continue in the free practice test →
View plans