CHFI Exam Questions and Answers

An analyst executed the commands shown in the exhibit on a Windows system to prepare a forensic image for analysis. What is the most likely reason for the error message from e2fsck?

The analyst failed to properly dismount the source volume before imaging, leading to filesystem inconsistencies.

The sequence shows `fsutil dismount` being run on C:, but a forensic image taken afterward—especially after Windows remounts the volume or during a live acquisition—will capture the volume in an inconsistent state. When Windows later performs recovery on the dirty volume, metadata updates begin immediately, so e2fsck in the analyst's analysis environment will legitimately report superblock, group descriptor, or inode inconsistencies that were never present in the source. This is the classic 'dirty volume' imaging error, not a problem with the image tool.

The forensic image was not acquired with a write-blocker, causing data corruption.

The image file contains an NTFS filesystem, but e2fsck is designed for ext filesystems.

The e2fsck command syntax is incorrect; it should be 'e2fsck -f -n' instead.

Why: The error message from e2fsck indicates that the filesystem has inconsistencies, which typically occur when a volume is imaged while it is still mounted and actively being written to. The analyst likely did not dismount the source volume before acquiring the forensic image, resulting in a snapshot that reflects an inconsistent state (e.g., dirty journal, unflushed writes). This is a common chain-of-custody and acquisition procedure error in forensic imaging.

Want more Computer Forensics Investigation Process practice?

All Computer Forensics Fundamentals and Process questions

Domain 2: Computer Forensics Fundamentals and Process

8% of exam · 6 sample questions below

What is the primary goal of the chain of custody in a digital forensic investigation?

To maintain the integrity and admissibility of evidence

This is the main purpose: to show that evidence has not been tampered with.

To encrypt the evidence during transport

To speed up the forensic analysis process

To ensure that the forensic tools used are properly licensed

Why: The chain of custody is a documented chronological record that tracks the seizure, custody, control, transfer, analysis, and disposition of digital evidence. Its primary goal is to maintain the integrity and admissibility of evidence by proving that the evidence has not been tampered with or altered from the moment it was collected until it is presented in court. This is critical because any break in the chain can lead to evidence being deemed inadmissible under rules like the Federal Rules of Evidence (FRE) or the Daubert standard.

An organization receives a legal hold notice regarding pending litigation. The IT department is instructed to preserve all relevant electronically stored information. What is the primary action the IT department should take?

Place a hold on relevant data and suspend routine deletion policies

A legal hold triggers a duty to preserve all potentially relevant data in their native form, so you must place a litigation hold on the specific systems, files, email mailboxes, and backups that could contain responsive information. This includes actively suspending any automated deletion, archival, or retention policies that would destroy or alter that data, ensuring it remains intact and available for later discovery without necessarily needing forensic duplication.

Ignore the notice and continue normal operations

Create a forensic image of all servers immediately

Permanently delete all emails older than 30 days to reduce storage

Why: The primary action is to place a legal hold on relevant data and suspend routine deletion policies. This ensures that all potentially relevant electronically stored information (ESI) is preserved in its current state, preventing spoliation and compliance with the legal hold notice. Suspending deletion policies stops automated processes like email purge jobs or document retention schedules from destroying evidence, which is a foundational step in the e-discovery process.

Which TWO of the following are valid justifications for a first responder to power off a computer at a crime scene? (Select TWO)

To prevent the computer from overheating

To save time during the investigation

The computer is destroying evidence (e.g., running a data wiping program)

Powering off can stop the destruction, but ideally capture volatile data first if possible.

The computer is in a hazardous environment (e.g., flooding)

Safety risks may necessitate powering off to prevent electrical hazards.

The computer is actively being used to commit a crime

Why: If a computer is actively running a data wiping program (e.g., a tool that overwrites storage sectors with zeros or random data), leaving it powered on will cause the irreversible destruction of potential evidence. A first responder must immediately cut power to halt the wiping process and preserve the remaining data, as volatile memory (RAM) is not the primary concern in this scenario—the non-volatile storage is being actively sanitized.

Which type of evidence is a witness's statement that they saw someone log into a computer?

Hearsay evidence

Best evidence

Circumstantial evidence

Direct evidence

Correct. The witness directly observed the act.

Why: Direct evidence is testimony or other proof that directly proves a fact without requiring any inference. A witness's statement that they saw someone log into a computer is direct evidence because it is based on the witness's firsthand observation of the act itself, not on any deduction or assumption. In digital forensics, direct evidence can include eyewitness accounts of specific actions on a system, such as entering credentials or accessing files.

During a forensic investigation, an analyst uses a hardware write blocker to connect a suspect hard drive to a forensic workstation. Which of the following is the PRIMARY reason for using a write blocker?

To allow the suspect drive to be mounted as read-write for analysis

To decrypt the drive automatically without the key

To prevent any modification to the suspect drive during acquisition

The primary purpose is to ensure the drive is not altered during forensic acquisition.

To speed up the imaging process by caching writes

Why: The primary reason for using a hardware write blocker is to ensure that the suspect drive is connected in a read-only manner, preventing any write operations from the forensic workstation from reaching the drive. This preserves the integrity of the evidence by guaranteeing that no data is altered, added, or deleted during the acquisition process, which is a fundamental requirement for admissibility in legal proceedings.

Which of the following BEST defines the chain of custody in digital forensics?

The legal authority required to seize evidence

The order in which forensic tools are applied to evidence

The physical security measures used to store evidence

The chronological documentation of evidence handling, transfer, and analysis

This accurately describes the chain of custody.

Why: The chain of custody is a formal, chronological record that documents every instance of evidence handling, transfer, and analysis from the moment of seizure through its entire lifecycle. This documentation is critical to prove that evidence has not been tampered with, altered, or corrupted, thereby maintaining its admissibility in legal proceedings under rules such as Federal Rule of Evidence 901.

Want more Computer Forensics Fundamentals and Process practice?

All Storage Forensics and File System Analysis questions

Domain 3: Storage Forensics and File System Analysis

8% of exam · 6 sample questions below

Which tool is specifically designed for file carving and can recover files based on headers and footers without relying on file system metadata?

FTK Imager

Foremost

Foremost is a dedicated command-line file carver that recovers files by scanning raw disk images and matching known binary signatures for file headers, footers, and internal data structures. It was originally developed from the Air Force Office of Special Investigations' carving tool and is configured via a customizable configuration file (foremost.conf), allowing investigators to add custom signatures. Its sole purpose is to extract data based on file structure, making it the classic, focused file-carving utility rather than a general forensic suite.

Autopsy

Volatility

Why: Foremost is a file carving tool that recovers files by scanning raw data for known header and footer signatures, such as JPEG headers (0xFFD8) and footers (0xFFD9), without relying on file system metadata like MFT entries or inodes. This makes it ideal for data recovery from damaged or formatted volumes where the file system structure is unavailable.

An analyst notices that a file on an NTFS volume occupies 4096 bytes on disk but its actual data is only 100 bytes. The extra space contains remnants of a previously deleted file. What is this extra space called?

Volume slack

Free space

RAM slack

File slack

File slack is the unused area within the last allocated cluster of a file, spanning from the bytes beyond the logical end of the file to the physical end of that cluster, and it is composed of both RAM slack and the remaining sector space. On NTFS, these bytes are not zeroed when a file is written, so they may contain residual data from previously deleted files or older versions of the current file, making them a valuable forensic source. This exactly matches the analyst's observation of a file occupying 40 clusters where some space is unused, because that space remains attributed to the file's allocated cluster rather than to free or volume slack.

Why: File slack is the unused space between the end of the actual file data and the end of the last allocated cluster for that file. On an NTFS volume with a 4096-byte cluster size, a 100-byte file leaves 3996 bytes of slack space, which may contain remnants of previously deleted files. This is why option D is correct.

An analyst recovers a disk image from a Linux server that used ext4. The image shows a superblock backup at multiple offsets. Which dd command would correctly extract the backup superblock located at offset 32768 bytes?

dd if=image.dd of=superblock.bin bs=4096 skip=8 count=1

dd if=image.dd of=superblock.bin bs=512 skip=64 count=2

Using bs=512 with skip=64 also lands at 64 * 512 = 32,768 bytes, the same superblock offset, but count=2 reads two 512-byte sectors for a total of 1,024 bytes. This approach is explicitly correct because it compensates for the smaller block size by incrementing the count, thereby extracting exactly the superblock without including adjacent sectors. It demonstrates that dd can achieve the same forensic extraction using any divisor of the superblock size, as long as the offset and byte count equal 32,768 and 1,024 respectively.

dd if=image.dd of=superblock.bin bs=1024 skip=32 count=1

With bs=1024 and skip=32, dd seeks 32 * 1024 = 32,768 bytes into the image, exactly the offset of the primary superblock (block 0 of the filesystem is at byte 1024, but the superblock starts at 32,768 bytes after the partition offset in this scenario). Reading count=1 transfers exactly 1,024 bytes, which matches the canonical 1,024-byte size of an ext2/3/4 superblock, producing a pristine superblock.bin with no extraneous data. This is the standard dd method for isolating a superblock because block size, skip count, and read count align perfectly with the target structure.

dd if=image.dd of=superblock.bin bs=32768 skip=1 count=1

Why: Both options B and C correctly extract the backup superblock from the disk image. The ext4 superblock is 1024 bytes and starts at offset 32768 bytes. With bs=512, skip=64 gives offset 32768 (64*512=32768), and count=2 reads 1024 bytes (2*512=1024). With bs=1024, skip=32 gives offset 32768 (32*1024=32768), and count=1 reads 1024 bytes. Both commands extract exactly the superblock. Option A uses bs=4096 and count=1, reading 4096 bytes, which is too much and may include adjacent data. Option D uses bs=32768 and count=1, reading 32768 bytes, far exceeding the superblock size.

What is the primary purpose of the Host Protected Area (HPA) on a hard disk drive?

To provide a write-cache for improved performance

To store diagnostic data or allow vendors to hide data from the OS

The HPA is defined by the ATA/ATAPI specification as a reserved region beyond the normal maximum address reported to the host, created and modified with the SET MAX ADDRESS and DEVICE CONFIGURATION OVERLAY commands. Because operating systems enumerate only the accessible LBA range, the HPA is invisible to the OS, allowing vendors to store diagnostic firmware, crash dumps, or recovery utilities without consuming ordinary user-visible space. In forensic practice, the HPA must be checked and disabled to see the true full capacity of the drive and recover hidden data.

To store the partition table when using GPT

To store the operating system boot loader

Why: HPA is a reserved area on the disk that is not visible to the operating system, intended for vendor-specific data. It can be used to hide data from forensic acquisition.

An investigator notes that a file on an NTFS volume has a resident data size of 900 bytes, but the $DATA attribute lists an allocated size of 1024 bytes. What does this indicate?

The file is compressed using NTFS compression

The file has slack space that may contain remnants of previously deleted data

File slack occurs because NTFS allocates disk space in fixed-size clusters, while a file's logical size is measured in bytes. If the final cluster is only partially used, the remaining bytes from the end of the file to the end of that cluster are not initialized by the filesystem, so they may still contain data from a previously deleted file or from an earlier, larger version of the current file. This residual data is a common forensic target because it survives normal file deletion and can be carved during analysis. The observed discrepancy between allocated size and logical size directly indicates that such slack space exists.

The file's data is stored in the MFT as a resident attribute

The file is stored in an alternate data stream

Why: On an NTFS volume, when a file's data is stored as a resident attribute within the MFT, the $DATA attribute's allocated size is typically 0 because the data occupies space only within the MFT record itself. Here, the allocated size is 1024 bytes, which is larger than the resident data size of 900 bytes. This indicates that the file is stored non-resident (i.e., in clusters outside the MFT), and the allocated size reflects the cluster size (e.g., 1024 bytes per cluster). The difference between the allocated size (1024 bytes) and the actual data size (900 bytes) is slack space, which may contain remnants of previously deleted data.

Which TWO of the following are valid techniques for acquiring RAM in a Windows system?

WinPmem

WinPmem is a memory acquisition tool for Windows.

Sleuth Kit

LiME

FTK Imager

FTK Imager can acquire physical memory on Windows.

Why: WinPmem is a dedicated memory acquisition tool for Windows that uses the WinPmem driver to access physical memory directly, bypassing OS protections. It is widely used in forensic acquisitions because it can capture RAM with minimal interference and supports both 32-bit and 64-bit Windows systems.

Want more Storage Forensics and File System Analysis practice?

All Incident Response and First Responder Skills questions

Domain 4: Incident Response and First Responder Skills

8% of exam · 6 sample questions below

An analyst receives an alert indicating a suspicious process (PID 3342) is making outbound connections on port 443 to an unknown IP. The system is a Windows 10 workstation. Which first responder action is MOST appropriate?

Capture a full memory dump using a tool like FTK Imager (Memory Capture) or DumpIt.

Capturing a full memory dump with FTK Imager (Memory Capture) or DumpIt preserves the entire contents of RAM, including running processes, loaded drivers, active network sockets, decrypted data, and injected code that exist only in volatile memory at that instant. This adheres to the order of volatility and allows analysis of the live system state without altering or destroying it. Memory imaging is the highest-priority step because many advanced threats operate solely in memory and leave minimal traces on disk.

Immediately disconnect the system from the network to contain the threat.

Check the Windows Event Logs for related entries.

Reboot the system to clear any malicious processes from memory.

Why: Capturing a full memory dump (option A) is the most appropriate first responder action because it preserves the volatile state of the suspicious process (PID 3342) and its associated artifacts (e.g., network connections, loaded DLLs, encryption keys) before any further system changes occur. This allows forensic analysis to identify the malware's behavior, such as command-and-control (C2) communication over port 443 (HTTPS), without altering evidence. Tools like FTK Imager (Memory Capture) or DumpIt acquire a raw .mem file that can be analyzed with Volatility or Rekall to extract process details, network sockets, and injected code.

During an incident response, a first responder needs to collect evidence from a Linux server that is still running. The server has sensitive data and cannot be shut down. Which technique is BEST for acquiring a forensic image of the hard disk?

Use dd if=/dev/sda of=/mnt/evidence/image.dd conv=noerror,sync

Use dd if=/dev/sda of=/mnt/evidence/image.dd bs=4M

Imaging the entire block device /dev/sda with bs=4M captures the complete physical disk, including the master boot record, partition tables, each partition, and unallocated space. The bs=4M argument is only a performance optimization that increases the read/write buffer size; it does not change the output data, so the result is still a bit-for-bit forensically sound copy. This is the correct first-responder action because it preserves all potential evidence on the drive.

Use dd if=/dev/mapper/root of=/mnt/evidence/image.dd

Use dd if=/dev/sda1 of=/mnt/evidence/image.dd

Why: It uses dd with a 4M block size, which improves acquisition speed while still producing a bit-for-bit forensic image of the entire disk (/dev/sda). The conv=noerror,sync option in A is unnecessary for a live acquisition from a healthy disk and can mask read errors, while B's larger block size is more efficient for imaging a running system without shutdown.

A first responder arrives at a scene where a computer is powered on and a user is logged in. An incident is suspected. What should the responder do FIRST?

Begin capturing a memory dump using a forensic tool.

Power off the computer immediately to preserve the disk.

Photograph the screen to document the current state.

Documentation of the live state is critical before any collection.

Ask the user to log off so the system can be imaged.

Why: The first priority at a live incident scene is to preserve volatile evidence. Photographing the screen captures the current state of the system, including open applications, network connections, and user activity, which can be lost if the system is altered or powered down. This documentation provides a baseline for the investigation and ensures that critical volatile data is recorded before any forensic acquisition begins.

You are responding to a suspected malware infection on a Windows 10 system. The system is still running. Which of the following should you collect FIRST?

Acquire a memory dump using a tool like WinPmem.

RAM is the most volatile component in a Windows system and must be captured before any other action, because it holds currently running processes, active network sockets, loaded kernel modules, injected code, and plaintext encryption keys. Using WinPmem (or similar tools) creates a raw memory image that can be analyzed for malware artifacts that exist only in volatile memory, such as reflective DLLs or rootkits. Any subsequent step in the incident response workflow will alter memory contents, so the order of volatility dictates that memory acquisition comes first.

Collect the Windows Event Logs.

Export the contents of the Windows Registry.

Create a forensic image of the hard drive.

Why: When a system is still running and suspected of malware infection, the first priority is to capture volatile data, which includes the contents of RAM. WinPmem is a tool designed to acquire a memory dump from a live Windows system, preserving critical evidence such as running processes, network connections, and injected code that would be lost on shutdown. This follows the order of volatility (RFC 3227), which mandates collecting memory before any non-volatile data like logs, registry, or disk images.

A first responder is called to investigate a potential insider threat. The suspect's computer is turned off. What is the BEST procedure?

Compute a hash of the hard drive using a live CD.

Check the power cord and peripherals for tampering.

Seize the computer and transport it to a forensic lab for imaging.

Seizing the computer and transporting it to a forensic lab preserves the original evidence for a proper bit-for-bit image using a write-blocker, ensuring data integrity and admissibility. A controlled lab environment allows for secure storage and careful analysis before any acquisition, maintaining a documented chain of custody from the scene onward. This is the recognized best practice for first responders.

Turn on the computer to see if it boots normally.

Why: When a suspect's computer is already turned off, the best procedure is to seize it and transport it to a forensic lab for imaging. This preserves the integrity of the evidence by preventing any accidental modification of the hard drive's contents, which could occur if the system is powered on or booted from a live CD. In forensic best practices, the first responder should never boot a suspect's computer, as doing so can alter critical system files, timestamps, and volatile data, compromising the chain of custody and admissibility of evidence.

During the initial response to a suspected data exfiltration, which THREE pieces of volatile data should be collected first? (Choose three.)

Current network connections.

Network connections are transient and may disappear.

List of running processes.

Processes can start/stop quickly; must be captured early.

Contents of system memory (RAM).

Memory contains the most volatile data including encryption keys and active malware.

Windows registry hives.

Forensic image of the hard drive.

Why: Current network connections (A) are volatile because they show active communication channels that could indicate data exfiltration in progress. If the system is shut down or disconnected, this evidence is lost immediately, making it a top priority for collection during initial response.

Want more Incident Response and First Responder Skills practice?

All Evidence Acquisition and Duplication questions

Domain 5: Evidence Acquisition and Duplication

8% of exam · 3 sample questions below

You are imaging a suspect's hard drive using a write blocker and dd command. After imaging, you verify the hash of the original drive and the image file. The original drive hash is SHA1: A1B2C3D4E5..., and the image hash is SHA1: F6G7H8I9J0... What is the most likely cause of the mismatch?

The dd command used a different block size

The write blocker malfunctioned and allowed writes to the original drive

A write blocker is a dedicated hardware or software mechanism that intercepts and blocks all write commands from the host system to the suspect drive during acquisition. If it malfunctions, the operating system or the acquisition tool may write temporary files, filesystem metadata, or other data onto the original evidence drive. Any such unintended write changes the drive's contents, so when the examiner later computes a hash of the original drive, it will no longer match the hash of the forensic image taken earlier. This is the only option that directly explains how the source itself could be altered, making it the correct cause of the hash discrepancy.

The dd command compressed the output

The image file was corrupted during transfer

Why: The hash mismatch indicates that the data on the original drive and the image file are not identical. A write blocker malfunction that allowed writes to the original drive during the imaging process would alter the source data after the initial hash was computed, causing the final hash of the original drive to differ from the hash of the image file taken at a different point in time. This is the most direct cause of a hash mismatch because the write blocker's primary purpose is to prevent any modification to the evidence.

You are a forensic investigator responding to a suspected data breach at a financial institution. The incident response team has isolated a Windows 10 workstation used by a former employee. The system is still powered on, and the login screen is displayed. Your task is to acquire forensic evidence in a defensible manner. The following actions are available:

A. Immediately pull the power cord to perform a cold acquisition of the hard drive. B. Capture volatile data (RAM, network connections, running processes) using a trusted tool on a USB drive, then shut down normally and remove the hard drive for imaging. C. Boot the system from a forensic live CD and create a forensic image of the hard drive while the system is running. D. Use the built-in Windows backup to create a system image to an external drive.

Which action is the most appropriate first step in this scenario?

Use the built-in Windows backup to create a system image to an external drive

Capture volatile data using a trusted tool on a USB drive, then shut down normally and remove the hard drive for imaging

This is the correct order because volatile data (RAM, running processes, network connections, open files) is lost the instant the system loses power. Using a trusted, write-protected USB tool to capture this data first ensures the most transient evidence is preserved. A graceful shutdown, unlike a hard power-off, allows the OS to flush and close file structures cleanly, reducing the risk of filesystem corruption, and then removing the drive for a forensic imaging workstation yields a defensible disk image without altering the original.

Boot the system from a forensic live CD and create a forensic image of the hard drive while the system is running

Immediately pull the power cord to perform a cold acquisition of the hard drive

Why: The system is still powered on with the login screen displayed, meaning volatile data (RAM, network connections, running processes) is present and will be lost if the system is powered off. Capturing this data first using a trusted forensic tool (e.g., FTK Imager or DumpIt) from a write-blocked USB drive preserves critical evidence such as encryption keys, active network connections, and malware in memory. Only after volatile data is secured should the system be shut down normally and the hard drive removed for forensic imaging, ensuring a defensible chain of custody.

You are a forensic investigator responding to a data breach at a financial institution. The compromised server is a Windows Server 2019 running a custom trading application. The server is still powered on and connected to the production network. The incident response team has instructed you to acquire forensic evidence while minimizing downtime. The server has 2 TB of storage with 500 GB used. You have a forensic workstation with a write-blocker and an empty 2 TB external drive. The server's RAM is 64 GB. You need to acquire both volatile data (RAM) and a forensic image of the disk. However, the legal team requires a verified bit-for-bit copy with cryptographic hash verification. Additionally, the server's performance is critical; acquiring RAM via network is not feasible due to bandwidth constraints. Which of the following is the best course of action?

Shut down the server, remove the disk, connect it to a write-blocker, and acquire the disk image using FTK Imager; RAM is lost but disk acquisition is verified.

Use FTK Imager over the network to acquire RAM first, then use dd to image the disk to the external drive via write-blocker.

Run win32dd locally to capture RAM to the external drive, then use FTK Imager over the network to create a physical disk image with verification.

This is the correct order of volatility. Running win32dd locally captures RAM quickly to an external device, minimizing the time that volatile data is at risk, and it preserves a raw memory image for later analysis. After that, FTK Imager can acquire a physical disk image over the network and automatically generate hash values (e.g., MD5/SHA1) to verify the integrity of the image at acquisition time. This combines fast volatile capture with network-acquired disk imaging that includes built-in verification.

Use dd over netcat to acquire RAM and disk simultaneously, then compute hashes separately.

Why: It prioritizes capturing volatile RAM first using win32dd (a memory acquisition tool) locally to the external drive, which preserves the most volatile evidence before any shutdown or network transfer. After RAM capture, FTK Imager over the network creates a verified physical disk image, satisfying the legal requirement for cryptographic hash verification while minimizing downtime. This approach avoids the risk of losing RAM data (as in shutdown) and avoids bandwidth constraints (as in network RAM acquisition).

Want more Evidence Acquisition and Duplication practice?

All OS and Network Forensics questions

Domain 6: OS and Network Forensics

8% of exam · 6 sample questions below

A security analyst reviews Windows Security Event Logs and finds multiple Event ID 4625 entries from a single source IP address targeting various usernames. Which type of attack is MOST likely occurring?

Password spraying attack

Password spraying is a low-and-slow attack in which an adversary chooses a handful of common passwords and tries them individually across many user accounts from a single source IP. In Windows Security logs this manifests as multiple Event ID 4625 failed-logon events with different account names but the same source workstation/IP and a common failure code such as 0xC000006D, often within a short window. Because each account is hit only once or twice, the total event volume stays low, evading threshold-based brute-force detection while still matching the observed pattern of many usernames from the same source.

Brute-force attack on a single account

Pass-the-hash attack

Kerberoasting attack

Why: Event ID 4625 indicates a failed logon attempt. When multiple usernames are targeted from a single source IP, it suggests the attacker is trying a small set of common passwords against many accounts to avoid account lockout thresholds. This is the hallmark of a password spraying attack, which differs from a brute-force attack that focuses on many passwords for one account.

In a macOS forensic investigation, which log system provides a timeline of high-level system events such as application launches and user logins?

syslog

FSEvents

.plist files

Unified logging

Unified logging is the modern, centralized logging architecture on macOS, introduced in macOS 10.12, which aggregates all system and user-level log messages into a high-performance, structured data store accessible via the `log` command and Console app. It captures high-level forensic events such as logon/logoff, application launches, and background daemon activity, along with rich metadata like timestamps, process IDs, and privacy-annotated content. This makes Unified logging the authoritative artifact for investigating high-level system events because it provides a unified, queryable, and tamper-resistant timeline of system activity.

Why: Unified logging is the correct answer because it is the comprehensive logging system in macOS that captures high-level system events such as application launches and user logins, providing a timeline for forensic analysis. FSEvents, on the other hand, only records file system changes at the directory level.

Which TWO Windows Event IDs are associated with successful logon or explicit credential usage? (Choose TWO.)

4648

Event ID 4648 records a logon attempt using explicit credentials, such as when a user runs a process with `runas` or supplies alternate domain credentials for a network connection. This satisfies the stem’s constraint of “explicit credential usage” because the event logs the target account and the source process, distinguishing it from interactive logon events like 4624.

4720

4624

4624: An account was successfully logged on.

4625

7045

Why: Event ID 4648 is logged when a user attempts to log on using explicit credentials, such as running a program as a different user or using the 'runas' command. Event ID 4624 is logged for every successful local or remote logon session, including interactive, network, and service logons. Both are standard Windows Security log events used in forensic analysis to track authentication activity.

In network forensics, an analyst captures traffic and sees a large number of ICMP echo requests from 10.0.0.1 to 10.0.0.2 with varying payload sizes. What is the most likely scenario?

Network reconnaissance (ping sweep)

A man-in-the-middle attack

A DoS attack using ICMP floods

A large volume of ICMP echo requests (ping) from a single source to a single destination, especially with varying payload sizes, is a classic signature of an ICMP flood DoS attack. The sheer volume of packets consumes the target's bandwidth and processing resources, and the varied payload sizes are often used to defeat filters that block only fixed-size pings. This pattern is distinct from reconnaissance or protocol-specific abuse because it intentionally overwhelms the victim with raw ICMP traffic.

A DNS amplification attack

Why: The scenario describes a single source sending a large number of ICMP echo requests to a single destination with varying payload sizes. This is characteristic of an ICMP flood attack, a type of DoS attack where the attacker overwhelms the target with echo requests, consuming bandwidth and processing resources. The varying payload sizes may be an attempt to evade simple packet filters or to maximize resource consumption. In contrast, a ping sweep would involve sending requests to multiple destinations to discover live hosts, not a sustained high-volume stream to one host. Therefore, this is most likely a DoS attack, not reconnaissance.

Which TWO of the following are valid artifacts for determining program execution on a Windows system? (Select TWO.)

Pagefile.sys

System Restore points

Jump Lists

Jump Lists record recently accessed files per application, showing usage.

Prefetch files

Prefetch files contain execution count and last run time for applications.

Windows Error Reporting logs

Why: Jump Lists (C) are correct because they store recently accessed files and applications per user, providing a timeline of program execution. Prefetch files (D) are correct because they contain execution counts, timestamps, and file paths for applications launched on Windows, directly indicating program execution.

A network forensics analyst captures traffic and sees a series of TCP SYN packets sent to multiple ports on a target, with no corresponding SYN-ACK replies. What type of activity is MOST likely indicated?

A denial-of-service (DoS) flood

A port scan reconnaissance

This pattern is the classic signature of a TCP SYN scan, a common port scanning technique. The attacker sends a SYN packet to each port on a target; if the port is open, the target responds with a SYN-ACK, while closed ports trigger an RST or no reply. Observing multiple SYN packets to different ports without complete handshakes indicates systematic probing to enumerate which services are listening, exactly what a port scan reconnaissance does.

A man-in-the-middle attack

Normal web browsing traffic

Why: The observation of TCP SYN packets sent to multiple ports without any SYN-ACK replies indicates a port scan, specifically a SYN scan (half-open scan). In a SYN scan, the attacker sends a SYN packet to each port; if the port is open, the target responds with a SYN-ACK, but the attacker never completes the handshake. The absence of any SYN-ACK replies suggests that either all scanned ports are closed (RST responses would be expected) or the target is filtering traffic, but the pattern of multiple SYN packets to different ports is the hallmark of reconnaissance, not a denial-of-service attack.

Want more OS and Network Forensics practice?

All OS and File System Forensics questions

Domain 7: OS and File System Forensics

8% of exam · 6 sample questions below

A forensic analyst is examining a Windows 10 system and needs to determine the last boot time of the system. Which registry hive and key should the analyst query to find this information?

NTUSER.DAT hive, key 'Control Panel\Desktop\'

SYSTEM hive, key 'CurrentControlSet\Control\Windows\', value 'ShutdownTime'

The 'ShutdownTime' value in this key records the last system shutdown time, which can be used to infer the last boot time (as the system boots after shutdown).

SOFTWARE hive, key 'Microsoft\Windows NT\CurrentVersion\'

SAM hive, key 'SAM\Domains\Account\Users\'

Why: The SYSTEM hive stores system-wide configuration data, and the key 'CurrentControlSet\Control\Windows\' contains the 'ShutdownTime' value, which records the last system shutdown time. Since the last boot time is effectively the time after the last shutdown, querying this value provides the necessary information. This is a standard forensic artifact for determining system uptime and boot events on Windows 10.

During a forensic investigation, an analyst needs to preserve the integrity of evidence on a hard drive. Which of the following is the best practice for acquiring an image of the drive?

Use the 'dd' command to create a raw image without a write blocker.

Connect the drive to a forensic workstation and use the operating system's copy command.

Use a hardware write blocker and create a bit-stream image.

A hardware write blocker is the definitive forensic safeguard: it sits between the drive and the workstation and physically intercepts any write command at the ATA/SATA/USB interface, allowing only read operations. Creating a bit-stream image (e.g., using 'dd' or FTK Imager) then captures a sector-by-sector, bit-identical copy of the entire drive, including partition tables, unused sectors, slack space, and deleted files, ensuring the original evidence remains pristine and admissible in court.

Format the drive before imaging to ensure no hidden data is missed.

Why: Using a hardware write blocker ensures that no write commands from the forensic workstation reach the suspect drive, preserving its integrity at the physical level. Creating a bit-stream image (sector-by-sector copy) captures all data, including slack space and unallocated clusters, which is essential for thorough forensic analysis. This combination is the gold standard in digital forensics, as mandated by best practices like those from NIST and the ACPO principles.

You are a forensic investigator responding to a security incident at a medium-sized company. The incident involved an attacker gaining unauthorized access to a Windows Server 2019 system. The server was taken offline by the IT team immediately after detection. Your task is to acquire forensic evidence from the server's hard drive. The server has a single 500 GB NTFS partition. You have a forensic workstation with a write blocker, a SATA-to-USB adapter, and a forensic imaging tool that supports both dd and EWF (E01) formats. The server is still physically in the server room, and the IT team has powered it off. You need to create a forensic image that preserves the integrity of the evidence and allows for efficient analysis. Which of the following is the most appropriate course of action?

Boot the server using a forensic live CD, connect an external USB drive to the server, and use 'dd' to create a raw image on the external drive.

Use the server's built-in backup utility to create a system state backup and copy it to a network share.

Remove the hard drive, connect it via a write blocker to the forensic workstation, and then use 'dd' over a network connection to send the image to a remote server.

Remove the hard drive, connect it via a write blocker to the forensic workstation, and create an EWF (E01) image stored locally on the forensic workstation's internal drive.

This method uses a write blocker to preserve integrity, and EWF format provides compression and metadata for efficient analysis.

Why: It follows best practices for forensic acquisition: removing the hard drive and connecting it via a write blocker ensures that no data is altered during imaging. Using EWF (E01) format provides compression, metadata, and integrity checks (e.g., CRC32, MD5, SHA-1), which are essential for efficient analysis and evidence preservation. Storing the image locally on the forensic workstation avoids network latency and potential data corruption.

During a forensic investigation of a Windows 10 system, you need to analyze the file system to recover deleted files. Which TWO file system artifacts would be most useful for this purpose?

$LogFile

The $LogFile records metadata changes, including deletions; can help reconstruct file history.

$Boot file

$MFT (Master File Table)

The MFT contains file records; even after deletion, the record may remain until overwritten.

$Volume

$Bitmap

Why: $LogFile (A) records metadata changes to the NTFS volume, including transactions that can be replayed to recover file names and directory entries for recently deleted files. $MFT (C) contains the master file table entries for every file and directory; even after deletion, the MFT entry often remains until overwritten, allowing recovery of file attributes and data runs.

A forensic analyst is reviewing the syslog from a compromised Linux server. Based on the exhibit, what does the 'orphan inode deleted' message indicate?

A hidden file was permanently removed from the filesystem.

A file was deleted while still open, and the filesystem has cleaned up the orphan inode.

When a file is unlinked but a process still holds its file descriptor, the inode remains allocated until the descriptor closes, resulting in an orphan inode. On a journaling filesystem such as ext4, that inode is recorded in the orphan list during the transaction, and after an unclean shutdown or during mount, the filesystem deletes it to reclaim space and logs 'orphan inode' messages. This is expected lifecycle behavior, not a sign of an attack or corruption.

A rootkit has attempted to hide files by marking them as orphan inodes.

A critical system file has been deleted, and the filesystem is warning the administrator.

Why: The 'orphan inode deleted' message in syslog indicates that a file was deleted while it was still open by a process. The kernel's inode cleanup mechanism (part of the VFS layer) detected the orphaned inode—an inode with no directory entry but still referenced by an open file descriptor—and removed it after the last file descriptor was closed. This is standard behavior in Linux filesystems (e.g., ext4) and is not indicative of hidden files, rootkits, or critical system file alerts.

You are a forensic investigator responding to an incident on a Windows 10 workstation used by a finance manager. The user reports that a critical spreadsheet containing quarterly budget data was accidentally deleted from the Desktop yesterday at approximately 3:00 PM. The system has been used normally since then, and the user has not emptied the Recycle Bin. You have created a forensic image of the drive using FTK Imager. The Recycle Bin contains a file named 'Quarterly_Budget.xlsx', but it appears to be a shortcut (size 1 KB). The user insists the original file was several megabytes. You need to recover the original file. Which action should you take next?

Search the $Recycle.Bin folder on the forensic image to locate the original file data, which may be stored under a different name.

On the forensic image, the $Recycle.Bin folder contains the original file data in a renamed storage file (typically $R...) while a companion $I... file preserves the original name and metadata; relying on the live Recycle Bin UI is insufficient because it only exposes a virtual view of these entries. Searching this hidden system folder directly is the correct first step because the file is still fully allocated and recoverable without carving or relying on volume snapshots.

Restore a previous version of the Desktop folder from Volume Shadow Copy.

Use file carving techniques to recover the file from unallocated space on the Desktop.

Check the Recycle Bin on the live system; the file should be there and can be restored.

Why: When a file is moved to the Recycle Bin on Windows 10, the original file data is not stored in the Recycle Bin itself; instead, a hidden file (with a random name) is created in the `$Recycle.Bin` folder on the volume, and a shortcut (the visible entry) is placed in the Recycle Bin. The shortcut points to the hidden file, which retains the original data. Since the visible entry is only 1 KB, the actual file content must be located in the `$Recycle.Bin` folder under a different name, making option A the correct next step.

Want more OS and File System Forensics practice?

All Application, Email and Cloud Forensics questions

Domain 8: Application, Email and Cloud Forensics

8% of exam · 6 sample questions below

Which THREE of the following are common challenges specific to cloud forensics? (Select THREE)

Data jurisdiction and legal compliance across regions

Data may be stored in multiple countries with different laws.

Volatility of evidence due to auto-scaling and ephemeral instances

Resources can be terminated automatically, losing evidence.

Inability to acquire physical hard drives

Cloud providers control the physical hardware; investigators cannot image drives directly.

Lack of standardized log formats

High cost of forensic tools

Why: Cloud forensic investigations must navigate data jurisdiction and legal compliance issues when data is stored across multiple geographic regions, each with its own data protection laws (e.g., GDPR, CLOUD Act). This creates challenges in obtaining lawful access to data that may be physically located in a jurisdiction where the investigator has no legal authority.

During a database forensic investigation, you need to review Microsoft SQL Server transaction logs to identify unauthorized data modifications. Which of the following SQL Server functions or commands is used to read the transaction log?

SELECT * FROM sys.dm_tran_database_transactions

DBCC LOG

fn_dblog

fn_dblog is a table-valued function that accepts a starting and ending LSN and returns every transaction log record in that range, with columns such as Current LSN, Operation, Context, Transaction ID, Description, AllocUnitName, Page ID, and decoded row data. It allows an investigator to filter by operation type, transaction ID, or database object to reconstruct insert/update/delete activity, page allocations, and schema changes directly from the log. This makes it the standard, structured method for reviewing the actual log records during a database forensic investigation.

BACKUP LOG

Why: The fn_dblog function is the correct choice because it is the undocumented but widely used SQL Server function that reads the transaction log (LDF file) directly, allowing forensic examiners to view every logged operation including data modifications, schema changes, and transaction details. Unlike other DMVs or commands, fn_dblog provides a row-by-row dump of the log records, making it essential for identifying unauthorized changes at the transaction level.

An analyst examines the following Apache access log entry: 192.168.1.10 - - [10/Jan/2023:13:45:22 +0000] "GET /search.php?q=1%27%20UNION%20SELECT%201,2,3-- HTTP/1.1" 200 1234 "-" "Mozilla/5.0". Which attack is MOST likely indicated?

Path Traversal

SQL Injection

The UNION SELECT statement in the query parameter is a SQL injection technique to extract data from the database.

Cross-Site Scripting (XSS)

Remote File Inclusion

Why: The log shows a UNION SELECT statement in the query parameter, indicating a SQL injection attempt. The URL-encoded single quote (') and comment (--) are classic SQLi payloads.

Which of the following email headers is used to verify the domain of the sending server and is commonly used for authentication to prevent spoofing?

Content-Type

Received

X-Mailer

DKIM-Signature

DKIM-Signature provides a digital signature for domain verification.

Why: DKIM-Signature is the correct answer because it is an email authentication method that uses a digital signature to verify the domain of the sending server. It allows the receiver to check that the email was not forged or altered during transit, directly preventing domain spoofing. This header is defined in RFC 6376 and is a core component of email authentication frameworks like DMARC.

A forensic analyst is investigating a Docker container that was used to launch a network attack. The container has been stopped but not removed. Which action should the analyst take FIRST to preserve volatile evidence?

Restart the container and use 'docker exec' to collect evidence

Use 'docker inspect' to view container metadata only

Use 'docker save' to export the container as a tar file

Use 'docker commit' to create an image of the container

'docker commit' captures the container's current writable layer into a new image, preserving the filesystem state at a defined moment without modifying the original container's content. By default, Docker pauses the container during the commit, giving a point-in-time consistent snapshot that can be exported with 'docker save' and analyzed in a sandbox. This method is the best option listed because it preserves the container's filesystem evidence in a non-destructive way, although it does not capture live memory or active network connections.

Why: Preserving the container's file system and logs is key. 'docker commit' creates an image from the container's current state. 'docker export' exports the filesystem as a tar archive. 'docker logs' retrieves logs. 'docker inspect' shows metadata. The container is stopped, so 'docker exec' won't work without starting it, which alters state. 'docker save' saves images, not containers. The best first step is to create an image or export the filesystem.

Which Azure log source should an investigator query to identify who deleted a virtual machine and when?

Azure Activity Log

Activity Log records resource management operations (create, update, delete).

Azure Active Directory sign-in logs

Azure Diagnostic Settings for the VM

Network Security Group flow logs

Why: The Azure Activity Log (formerly known as Audit Logs) is the subscription-level log that records all control-plane operations on Azure resources, including virtual machine creation, deletion, and modification. When a VM is deleted, the Activity Log captures the operation name (e.g., 'Microsoft.Compute/virtualMachines/delete'), the caller's identity (user or service principal), the timestamp, and the status of the operation. This makes it the authoritative source for answering 'who deleted a VM and when'.

Want more Application, Email and Cloud Forensics practice?

All Mobile and Malware Forensics questions

Domain 9: Mobile and Malware Forensics

7% of exam · 6 sample questions below

A forensic analyst is examining a Windows malware sample using static analysis. Which tool is BEST suited for viewing the PE header structure, including sections, imports, and exports?

Strings

Ghidra

IDA Pro

PEiD

PEiD (Portable Executable Identifier) is a specialized forensic and reverse-engineering tool that statically parses PE files to identify the compiler, linker, and—most importantly—the packer or protector used. It extracts and displays PE header details such as the entry point, the section table with names and sizes, and optional header fields, then cross-references them against a signature database of known packers (e.g., UPX, ASPack, Themida) using byte patterns and section heuristics. For a malware analyst performing triage, PEiD instantly reveals whether a binary is packed and which tool packed it, making it the correct choice for PE header and packer analysis.

Why: PEiD is specifically designed to analyze PE (Portable Executable) headers, making it ideal for quickly viewing section tables, import/export tables, and detecting packers or compilers. It parses the IMAGE_NT_HEADERS structure directly, providing a concise summary of the PE layout without requiring disassembly or decompilation.

During an iOS forensic examination, an analyst extracts an iTunes backup and finds the file '3d0d7e5fb2ce288813306e4d4636395e047a3d28'. Which type of data does this file typically contain?

Call history

SMS and iMessage conversations

Keychain data

Notes app data

The hash corresponds to the Notes app's SQLite database (NotesStore.sqlite).

Why: The file '3d0d7e5fb2ce288813306e4d4636395e047a3d28' is the SQLite database (NotesStore.sqlite) that stores Apple's Notes app data in an iOS backup. Its SHA-1 hash name corresponds to the domain 'AppDomain-com.apple.mobilenotes' and contains the notes, attachments, and metadata. This is a well-known artifact in iOS forensics for recovering user-created notes.

Which mobile forensics tool is specifically designed for physical extraction of iOS devices, including bypassing passcodes and extracting full file system images?

Oxygen Forensic Detective

Magnet AXIOM

Cellebrite UFED

GrayKey

GrayKey, developed by Grayshift, is a dedicated iOS forensic tool engineered specifically for physical extraction and passcode bypass. It exploits hardware and software vulnerabilities to gain full file-system access from locked iPhones/iPads, bypassing the Secure Enclave's retry limits. Law enforcement agencies use GrayKey for targeted deep extraction of iOS devices, making it the only option in this list uniquely designed for this purpose.

Why: GrayKey is a specialized forensic tool developed by GrayShift that performs physical extraction on iOS devices, including bypassing passcodes and obtaining full file system images. It exploits hardware and software vulnerabilities in iOS to extract data, making it the correct choice for this specific task.

A malware analyst is performing static analysis on a packed executable. Which THREE techniques are effective for unpacking or analyzing packed malware? (Select THREE.)

Renaming the file to .txt

Performing strings analysis on the packed binary

Strings may reveal embedded data or unpacked code regions.

Running PEiD to identify the packer

PEiD can detect many common packers, guiding the analyst on how to unpack.

Executing the sample in Cuckoo Sandbox

Using OllyDbg to step through the unpacking routine

OllyDbg is a debugger that can trace unpacking code.

Why: Performing strings analysis on a packed binary can reveal embedded strings, such as import hints, configuration data, or the original entry point (OEP), which may survive packing. While packing obfuscates many strings, some packers leave remnants that static analysis tools like `strings` can extract, providing initial clues about the malware's functionality without execution.

An analyst is investigating a potential data breach on an Android device. Which TWO artefacts are MOST useful for determining which third-party apps were installed and used? (Select TWO.)

Full system dump (dd image)

packages.xml file in /data/system/

This file lists all installed packages (apps) on the device.

Wi-Fi connection logs

/data/data/ directory listing

Each installed app has a folder under /data/data/; presence indicates installation and usage.

SMS database (mmssms.db)

Why: The packages.xml file in /data/system/ records all installed packages, including third-party apps, their permissions, and installation metadata. The /data/data/ directory contains per-package subdirectories with application-specific data, confirming actual usage and stored data. Together, these two artefacts provide definitive evidence of which third-party apps were installed and used on the device.

During an iOS forensic examination, an analyst extracts an iTunes backup and finds a file named 'SMS.db'. Which of the following tools is BEST suited to parse and analyze this SQLite database for SMS and iMessage content?

GrayKey

Oxygen Forensic Detective

Cellebrite UFED

SQLite Browser

SQLite Browser is a free, open-source graphical tool that opens SQLite databases directly, allowing the examiner to browse table structures, execute SQL queries, and export results. For an iOS SMS.db file, it lets the analyst immediately inspect messages, timestamps, and associated metadata by running SELECT statements across the relevant tables. This makes it ideal for targeted database examination rather than relying on extraction hardware or a full analysis suite.

Why: SQLite Browser is the best tool for parsing and analyzing the 'SMS.db' file because it is a free, open-source SQLite database viewer that allows direct querying and inspection of the database schema, tables, and records. Since 'SMS.db' is a standard SQLite database containing SMS and iMessage data in iOS backups, SQLite Browser provides the most straightforward and cost-effective method for manual forensic analysis without relying on proprietary extraction tools.

Want more Mobile and Malware Forensics practice?

All Network and Cloud Forensics questions

Domain 10: Network and Cloud Forensics

7% of exam · 3 sample questions below

An investigator needs to capture network traffic from a live network segment without altering the traffic flow. Which technique should they use?

Enable NetFlow on the router and capture flows

Configure a SPAN port on the switch

Configuring a SPAN (Switched Port Analyzer) port on the switch copies ingress and egress frames from specified source ports or VLANs to a designated monitor port, where a forensic workstation can record full packets without altering the original traffic path. This non-intrusive mirroring preserves switch performance and avoids introducing latency or dropping frames, making it the standard method for lawful network capture at Layer 2.

Deploy an ARP spoofing tool to redirect traffic

Set the NIC to promiscuous mode on the forensic workstation

Why: A SPAN (Switched Port Analyzer) port, also known as a mirror port, copies all traffic from a specified source port or VLAN to a destination port where the forensic workstation is connected. This allows the investigator to capture traffic without injecting any frames or altering the forwarding behavior of the switch, thus preserving the integrity of the live network segment.

During a forensic investigation, the analyst runs netstat -ano on a compromised workstation. Based on the exhibit, which connection is MOST suspicious and should be investigated further?

The established HTTPS connection to 203.0.113.5:443 (PID 5678).

An established HTTPS connection to 203.0.113.5:443 is the clearest anomaly because 203.0.113.0/24 is TEST-NET-3, a documentation-only range that real internet services never legitimately use. An outbound connection to that test address over the standard TLS port strongly suggests C2 traffic, data exfiltration, or a covert tunnel masquerading as HTTPS. PID 5678 enables triage to the responsible process, but the destination alone warrants immediate isolation and memory capture.

The DNS query to 192.168.1.1:53 in TIME_WAIT state.

The UDP listener on port 5353 (mDNS) with PID 910.

The listening RDP service on port 3389 (PID 1234).

Why: The established HTTPS connection to 203.0.113.5:443 (PID 5678) is most suspicious because it is an external IP address (not in the private RFC 1918 range) with an established TCP connection, indicating active data transfer. In a forensic context, an outbound HTTPS connection to an unknown external IP is a common indicator of command-and-control (C2) communication or data exfiltration, especially when the PID can be traced to an unknown or malicious process.

You are a forensic investigator responding to a data breach at a mid-sized company. The company uses a hybrid cloud environment with AWS for production workloads and on-premises servers for legacy applications. The breach was detected when an internal monitoring system flagged unusual outbound traffic from an AWS EC2 instance (i-0a1b2c3d4e5f) to an external IP address (198.51.100.20) on TCP port 4444 during off-hours. The EC2 instance runs a Linux-based web server. The security team has already isolated the instance by removing its security group rules and stopping the instance. You have been provided with the following: (1) AWS CloudTrail logs for the past 72 hours, (2) VPC Flow Logs for the same period, (3) a snapshot of the instance’s root volume (EBS), and (4) the instance metadata log from the AWS console. The company’s incident response policy requires preservation of all volatile data before powering off the instance. Which of the following steps should you take FIRST to ensure a forensically sound investigation?

Acquire a memory dump from the stopped instance by re-attaching the root volume to a forensic workstation.

Review the instance metadata log to identify the user who launched the instance.

Create a forensic copy of the EBS snapshot and attach it to a separate analysis EC2 instance in a different AWS account to avoid altering evidence.

Creating a forensic copy of the EBS snapshot and attaching that copy to a separate EC2 instance in a different AWS account is the correct first preservation step because the snapshot is the only durable disk evidence of the compromised instance. Attaching the original snapshot to an analysis instance—even read-only—risks unwitting writes from filesystem journal replay, and operating in the same account risks accidental modification or deletion. A copied snapshot in an isolated account grants a clean, authority-controlled workspace where forensic tools cannot alter the original evidence.

Analyze the VPC Flow Logs to determine if other instances communicated with the same external IP.

Why: The first step in a forensically sound investigation is to create a forensic copy (bit-for-bit) of the EBS snapshot before any analysis. This preserves the original evidence integrity, as required by the order of volatility and chain of custody. Attaching the copy to a separate analysis EC2 instance in a different AWS account prevents accidental modification of the original snapshot and isolates the forensic environment from the compromised production account.

Want more Network and Cloud Forensics practice?

All Database and Application Forensics questions

Domain 11: Database and Application Forensics

7% of exam · 3 sample questions below

An organization uses Microsoft SQL Server 2019 with full recovery model. A database administrator accidentally executed a DROP TABLE statement. The transaction log was backed up immediately after the incident. Which forensic technique would allow the analyst to restore the dropped table?

Restore the transaction log backup taken after the DROP TABLE and apply it to the database.

Use the RESTORE LOG statement with the NO_TRUNCATE option to recover the table.

Perform a tail-log backup, then restore the full backup and all subsequent transaction log backups, stopping before the DROP TABLE.

The correct procedure is to first back up the tail of the transaction log to capture all log records generated since the last backup, including the DROP TABLE transaction. Then restore the most recent full backup in NORECOVERY mode, followed by every subsequent transaction log backup using STOPAT (or STOPBEFOREMARK) set to a time just before the drop. This rolls the database forward to the pre-drop state while preserving all earlier committed changes.

Restore the most recent full backup and ignore subsequent transaction log backups.

Why: Under the full recovery model, point-in-time recovery is required to undo the DROP TABLE. By performing a tail-log backup (to capture any transactions after the last log backup), then restoring the full backup and all subsequent transaction log backups with STOPAT or STOPBEFOREMARK to the moment just before the DROP TABLE, the analyst can recover the table without losing other transactions. This is the only method that preserves the dropped table's data while maintaining database consistency.

You are a forensic investigator responding to an incident at a financial institution. The organization uses Microsoft SQL Server 2016 for its transaction processing system. The database is configured with full recovery model and transaction log backups are taken every 15 minutes. The incident response team has identified that an attacker gained access to the database server via compromised credentials and executed a series of malicious SQL statements, including data exfiltration and deletion of critical records. The time of the attack is estimated to be between 2:00 PM and 2:05 PM. The last full backup was taken at 12:00 AM (midnight) the same day. Transaction log backups are available for the entire day. The last transaction log backup before the attack was taken at 1:45 PM. The next transaction log backup after the attack was taken at 2:15 PM. The database is still online and being used by the business. Management wants to recover the database to a point just before the attack (2:00 PM) to minimize data loss, while preserving evidence for investigation. Which of the following actions should you take FIRST?

Perform a tail-log backup of the database using the NORECOVERY option to capture all transactions since the last log backup.

Performing a tail-log backup with NORECOVERY captures every transaction that was recorded in the active portion of the transaction log after the last full transaction log backup, including transactions in flight or not yet backed up. The NORECOVERY option transitions the database into the Restoring state, preserving the current transaction log as a backup file that can be used for point-in-time recovery. This is the only way to preserve the complete post-backup forensic evidence, and it must be done before any restore operation is attempted.

Immediately restore the full backup from midnight and all transaction log backups up to 1:45 PM to a separate server for forensic analysis.

Shut down the SQL Server service to prevent further changes and then restore the database from backup.

Restore the database to a point in time using the full backup and all transaction log backups up to 1:45 PM, then apply the 2:15 PM backup to recover lost data.

Why: Performing a tail-log backup with NORECOVERY captures all transactions committed after the last log backup (1:45 PM) up to the current point in time, including the attack period. This preserves the database in a restoring state, preventing further changes while allowing point-in-time recovery to just before 2:00 PM. It is the mandatory first step to minimize data loss and maintain forensic integrity before any restore operations.

Refer to the exhibit. A database administrator finds the above error log entries when attempting to start the MySQL service. The server was working fine yesterday. What is the most likely cause of this issue?

The MySQL user does not have write permissions to the data directory.

The binary log is full and cannot be rotated.

The server ran out of memory due to high innodb_buffer_pool_size.

The InnoDB system tablespace file (ibdata1) is corrupted.

The InnoDB system tablespace file (ibdata1) holds the data dictionary, rollback segments, and undo tablespaces; its first page contains a header that InnoDB validates at startup. If that header or any critical internal page is corrupted, InnoDB cannot initialize its storage engine and aborts with errors such as 'Database page corruption' or 'Cannot open datafile'. This matches the administrator's exhibit, making corruption of ibdata1 the correct explanation; recovery requires restoring the tablespace from backup or rebuilding it with new setup.

Why: The error log entries indicate that InnoDB is unable to open or read the system tablespace file (ibdata1), which is the core file storing the InnoDB data dictionary, undo logs, and doublewrite buffer. A corrupted ibdata1 prevents MySQL from starting because the storage engine cannot initialize its internal structures, even if the server was operational the previous day. This matches the symptom of a sudden failure without prior configuration changes.

Want more Database and Application Forensics practice?

All Malware Forensics questions

Domain 12: Malware Forensics

7% of exam · 5 sample questions below

During malware analysis, an investigator finds that a suspicious process is injecting code into a legitimate system process (e.g., explorer.exe). Which technique is being used?

API hooking

Process hollowing

Code injection

Code injection is the correct classification because the finding that code was inserted into a running process directly matches this term. It encompasses any technique that places executable code into the virtual address space of another process and then causes it to run, often by creating a remote thread or using an asynchronous procedure call. The stem's description is a general definition of code injection, not limited to a specific delivery vector.

DLL injection

Why: Code injection is the correct answer because the scenario describes a process injecting arbitrary code into a legitimate system process like explorer.exe. This is the generic term for techniques where malicious code is written into the address space of another process and executed, often via Windows API calls such as WriteProcessMemory and CreateRemoteThread. The question explicitly states 'injecting code,' which directly maps to the broad category of code injection, not a specific subtype.

Refer to the exhibit. An investigator is examining a disk image using TSK. The output from 'fls' shows the directory structure. What is the significance of the entry 'V/V 113-128-1: $OrphanFiles'?

It is a sign that a rootkit has hidden files in the image

It indicates the location of the Master File Table (MFT) mirror

It is a virtual directory that contains files with no parent directory, often from deleted files

In tools like The Sleuth Kit (tsk) and Autopsy, the virtual directory named $OrphanFiles (or displayed as 'V/V') is not a literal directory stored on the disk. It is dynamically generated to represent files whose MFT entries exist but whose parent directory references were lost, typically because the directory entry was deleted, overwritten, or corrupted while the file record itself remains in the MFT. This commonly occurs after a file is deleted, when the directory index entry is removed but the file's MFT record is not yet reused, or after a malformed directory entry prevents normal linkage in the tree.

It is a standard NTFS metadata file that stores file permissions

Why: In The Sleuth Kit (TSK), the 'fls' command lists files and directories within a disk image. The entry 'V/V 113-128-1: $OrphanFiles' is a virtual directory that contains files that have no parent directory in the file system, typically because their directory entries were deleted or corrupted. This is a common artifact when recovering deleted files from NTFS volumes, as TSK collects such orphaned MFT entries into this virtual container.

You are a forensic analyst investigating a suspected malware infection on a Windows 10 workstation. The user reports that the system has been slow and that unexpected pop-ups appear. You have acquired a memory dump and a disk image. During analysis, you find a suspicious process named 'svch0st.exe' running with PID 4567. The process has loaded several DLLs, including 'wininet.dll' and 'ws2_32.dll'. You also find that the process has an active TCP connection to an external IP address 203.0.113.5 on port 4444. In the disk image, you find an executable file at C:\Users\Public\svch0st.exe with a creation date that matches the start of symptoms. The file's hash is not in any known malware database. You decide to perform dynamic analysis by running the file in a sandbox. However, the sandbox environment has no network connectivity. The executable runs but does not exhibit any malicious behavior. What should you do next to determine if the file is malicious?

Conduct a thorough static analysis using a disassembler and debugger to understand the code

Delete the suspicious file and run a full antivirus scan on the system

Re-run the sample in a sandbox with simulated network connectivity or a controlled network to observe C2 communication

Re-running the sample in a sandbox with simulated network connectivity or a controlled network is the correct approach because many malware families remain dormant until they establish C2 communication, at which point they download additional payloads, exfiltrate data, or execute commands. A network-enabled sandbox provides a safe, but realistic environment where the analyst can observe DNS queries, HTTP/S connections, beaconing intervals, and the exact data exchanged with the C2 server. This dynamic analysis yields actionable indicators of compromise (IoCs) and reveals the malware's full functionality without risking real network infection.

Perform a forensic imaging of the system again and compare with the original image

Why: The sandbox lacked network connectivity, which prevented the malware from reaching its command-and-control (C2) server. Many malware samples, especially those using HTTP or raw TCP for C2, will remain dormant or exhibit no malicious behavior when they cannot connect to the external IP. By providing simulated or controlled network connectivity, you can trigger the malicious payload and observe the actual C2 communication, confirming the file's intent.

Based on the exhibit, what is the most likely indication of malware persistence?

services.exe PID 4321 is a known malware process

Windows Defender service is stopped, allowing malware to run

services.exe is listening on TCP port 4444, indicating possible code injection

services.exe is the Windows Service Control Manager and should never expose listening TCP endpoints on its own; its normal IPC is via a named pipe used by subprocesses, not a network socket. Port 4444 is a well-known default payload port for Metasploit's meterpreter and is frequently used by backdoors, so an established listening socket on services.exe is a classic sign of injected shellcode. Because services.exe runs as SYSTEM, attackers often inject code into it to steal its high privileges and evade detection.

svchost.exe hosting BFE and MpsSvc indicates a firewall bypass

Why: Services.exe (the Service Control Manager) should not normally listen on any TCP port. When it is found listening on TCP port 4444—a port commonly associated with Metasploit and reverse shells—it strongly indicates that malware has injected code into the legitimate services.exe process, hijacking it to establish a persistent backdoor listener. This is a classic sign of process hollowing or reflective DLL injection, where the malware hides its network activity under a trusted system process.

You are investigating a Windows 10 workstation that exhibits slow performance and frequent pop-ups. The user reports that the system started acting strangely after installing a 'PDF Converter' from an email attachment. You suspect malware. You have captured a memory dump using FTK Imager and a network capture during the infection. In the memory dump, you find a suspicious process 'conhost.exe' running from a non-standard location (C:\Users\Public\Temp). The process has an open handle to a file named 'config.ini' in the same directory. The network capture shows periodic HTTPS connections to 'malicious.com' on port 443 from the workstation's IP. Using Volatility, you extract the process's command line: 'conhost.exe -hidden -log C:\Users\Public\Temp\output.log'. Which of the following is the BEST immediate course of action to contain the threat and preserve evidence?

Delete the config.ini file and the conhost.exe executable immediately.

Restore the system to a previous restore point.

Terminate the suspicious conhost.exe process and run a full antivirus scan.

Isolate the workstation from the network, then create a forensic image of the hard disk for analysis.

Isolating the workstation from the network by disconnecting the cable or disabling the NIC immediately severs Command & Control (C2) channels and halts any lateral movement to other hosts, preserving the network flow data and the current state of live connections. Creating a forensic image of the hard disk using a write-blocker and bit-for-bit imaging tools maintains the integrity of evidence, allowing recovery of deleted files, unallocated space, and file system slack that may contain residual malware or attacker artifacts. This evidence-preserving approach aligns with forensic best practices, keeps proper chain of custody, and enables thorough static and dynamic analysis in a controlled lab environment—unlike the destructive or ineffective alternatives.

Why: The primary goal in a malware incident is to contain the threat and preserve evidence for forensic analysis. Isolating the workstation from the network prevents further data exfiltration (e.g., the HTTPS connections to malicious.com) and stops the malware from communicating with its C2 server. Creating a forensic image of the hard disk preserves the full state of the system, including the malicious conhost.exe, config.ini, and output.log files, which are critical for reverse engineering and attribution. Terminating the process or deleting files before imaging would destroy volatile evidence and potentially trigger anti-forensic mechanisms.

Want more Malware Forensics practice?

Browse all CHFI questions Take a timed practice test

Frequently asked questions

How many questions are on the CHFI exam?

The CHFI exam has 125 questions and must be completed in 240 minutes. The passing score is 700/1000.

What types of questions appear on the CHFI exam?

Scenario-based questions covering exam objectives with detailed answer explanations.

How are CHFI questions organised by domain?

The exam covers 12 domains: Computer Forensics Investigation Process, Computer Forensics Fundamentals and Process, Storage Forensics and File System Analysis, Incident Response and First Responder Skills, Evidence Acquisition and Duplication, OS and Network Forensics, OS and File System Forensics, Application, Email and Cloud Forensics, Mobile and Malware Forensics, Network and Cloud Forensics, Database and Application Forensics, Malware Forensics. Questions are weighted by domain — higher-weight domains appear more on your actual exam.

Are these the actual CHFI exam questions?

No. These are original exam-style practice questions written against the official EC-Council CHFI exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.

Ready to practice all 125 CHFI questions?

Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.

EC-Council · Free Practice Questions · Last reviewed May 2026

CHFI Exam Questions and Answers

57real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.

125 exam questions

240 min time limit

Pass: 700/1000 / 1000

12 exam domains

Overview Domain Blueprint Study Guide All QuestionsSample by Domain

Domain 1: Computer Forensics Investigation Process

8% of exam · 1 sample questions below

All Computer Forensics Investigation Process questions

An analyst executed the commands shown in the exhibit on a Windows system to prepare a forensic image for analysis. What is the most likely reason for the error message from e2fsck?

The analyst failed to properly dismount the source volume before imaging, leading to filesystem inconsistencies.

The forensic image was not acquired with a write-blocker, causing data corruption.

The image file contains an NTFS filesystem, but e2fsck is designed for ext filesystems.

The e2fsck command syntax is incorrect; it should be 'e2fsck -f -n' instead.

Want more Computer Forensics Investigation Process practice?

All Computer Forensics Fundamentals and Process questions

Domain 2: Computer Forensics Fundamentals and Process

8% of exam · 6 sample questions below

What is the primary goal of the chain of custody in a digital forensic investigation?

To maintain the integrity and admissibility of evidence

This is the main purpose: to show that evidence has not been tampered with.

To encrypt the evidence during transport

To speed up the forensic analysis process

To ensure that the forensic tools used are properly licensed

Place a hold on relevant data and suspend routine deletion policies

Ignore the notice and continue normal operations

Create a forensic image of all servers immediately

Permanently delete all emails older than 30 days to reduce storage

Which TWO of the following are valid justifications for a first responder to power off a computer at a crime scene? (Select TWO)

To prevent the computer from overheating

To save time during the investigation

The computer is destroying evidence (e.g., running a data wiping program)

Powering off can stop the destruction, but ideally capture volatile data first if possible.

The computer is in a hazardous environment (e.g., flooding)

Safety risks may necessitate powering off to prevent electrical hazards.

The computer is actively being used to commit a crime

Which type of evidence is a witness's statement that they saw someone log into a computer?

Hearsay evidence

Best evidence

Circumstantial evidence

Direct evidence

Correct. The witness directly observed the act.

To allow the suspect drive to be mounted as read-write for analysis

To decrypt the drive automatically without the key

To prevent any modification to the suspect drive during acquisition

The primary purpose is to ensure the drive is not altered during forensic acquisition.

To speed up the imaging process by caching writes

Which of the following BEST defines the chain of custody in digital forensics?

The legal authority required to seize evidence

The order in which forensic tools are applied to evidence

The physical security measures used to store evidence

The chronological documentation of evidence handling, transfer, and analysis

This accurately describes the chain of custody.

Want more Computer Forensics Fundamentals and Process practice?

All Storage Forensics and File System Analysis questions

Domain 3: Storage Forensics and File System Analysis

8% of exam · 6 sample questions below

Which tool is specifically designed for file carving and can recover files based on headers and footers without relying on file system metadata?

FTK Imager

Foremost

Autopsy

Volatility

Volume slack

Free space

RAM slack

File slack

dd if=image.dd of=superblock.bin bs=4096 skip=8 count=1

dd if=image.dd of=superblock.bin bs=512 skip=64 count=2

dd if=image.dd of=superblock.bin bs=1024 skip=32 count=1

dd if=image.dd of=superblock.bin bs=32768 skip=1 count=1

What is the primary purpose of the Host Protected Area (HPA) on a hard disk drive?

To provide a write-cache for improved performance

To store diagnostic data or allow vendors to hide data from the OS

To store the partition table when using GPT

To store the operating system boot loader

Why: HPA is a reserved area on the disk that is not visible to the operating system, intended for vendor-specific data. It can be used to hide data from forensic acquisition.

An investigator notes that a file on an NTFS volume has a resident data size of 900 bytes, but the $DATA attribute lists an allocated size of 1024 bytes. What does this indicate?

The file is compressed using NTFS compression

The file has slack space that may contain remnants of previously deleted data

The file's data is stored in the MFT as a resident attribute

The file is stored in an alternate data stream

Which TWO of the following are valid techniques for acquiring RAM in a Windows system?

WinPmem

WinPmem is a memory acquisition tool for Windows.

Sleuth Kit

LiME

FTK Imager

FTK Imager can acquire physical memory on Windows.

Want more Storage Forensics and File System Analysis practice?

All Incident Response and First Responder Skills questions

Domain 4: Incident Response and First Responder Skills

8% of exam · 6 sample questions below

Capture a full memory dump using a tool like FTK Imager (Memory Capture) or DumpIt.

Immediately disconnect the system from the network to contain the threat.

Check the Windows Event Logs for related entries.

Reboot the system to clear any malicious processes from memory.

Use dd if=/dev/sda of=/mnt/evidence/image.dd conv=noerror,sync

Use dd if=/dev/sda of=/mnt/evidence/image.dd bs=4M

Use dd if=/dev/mapper/root of=/mnt/evidence/image.dd

Use dd if=/dev/sda1 of=/mnt/evidence/image.dd

A first responder arrives at a scene where a computer is powered on and a user is logged in. An incident is suspected. What should the responder do FIRST?

Begin capturing a memory dump using a forensic tool.

Power off the computer immediately to preserve the disk.

Photograph the screen to document the current state.

Documentation of the live state is critical before any collection.

Ask the user to log off so the system can be imaged.

You are responding to a suspected malware infection on a Windows 10 system. The system is still running. Which of the following should you collect FIRST?

Acquire a memory dump using a tool like WinPmem.

Collect the Windows Event Logs.

Export the contents of the Windows Registry.

Create a forensic image of the hard drive.

A first responder is called to investigate a potential insider threat. The suspect's computer is turned off. What is the BEST procedure?

Compute a hash of the hard drive using a live CD.

Check the power cord and peripherals for tampering.

Seize the computer and transport it to a forensic lab for imaging.

Turn on the computer to see if it boots normally.

During the initial response to a suspected data exfiltration, which THREE pieces of volatile data should be collected first? (Choose three.)

Current network connections.

Network connections are transient and may disappear.

List of running processes.

Processes can start/stop quickly; must be captured early.

Contents of system memory (RAM).

Memory contains the most volatile data including encryption keys and active malware.

Windows registry hives.

Forensic image of the hard drive.

Want more Incident Response and First Responder Skills practice?

All Evidence Acquisition and Duplication questions

Domain 5: Evidence Acquisition and Duplication

8% of exam · 3 sample questions below

The dd command used a different block size

The write blocker malfunctioned and allowed writes to the original drive

The dd command compressed the output

The image file was corrupted during transfer

Which action is the most appropriate first step in this scenario?

Use the built-in Windows backup to create a system image to an external drive

Capture volatile data using a trusted tool on a USB drive, then shut down normally and remove the hard drive for imaging

Boot the system from a forensic live CD and create a forensic image of the hard drive while the system is running

Immediately pull the power cord to perform a cold acquisition of the hard drive

Shut down the server, remove the disk, connect it to a write-blocker, and acquire the disk image using FTK Imager; RAM is lost but disk acquisition is verified.

Use FTK Imager over the network to acquire RAM first, then use dd to image the disk to the external drive via write-blocker.

Run win32dd locally to capture RAM to the external drive, then use FTK Imager over the network to create a physical disk image with verification.

Use dd over netcat to acquire RAM and disk simultaneously, then compute hashes separately.

Want more Evidence Acquisition and Duplication practice?

All OS and Network Forensics questions

Domain 6: OS and Network Forensics

8% of exam · 6 sample questions below

Password spraying attack

Brute-force attack on a single account

Pass-the-hash attack

Kerberoasting attack

In a macOS forensic investigation, which log system provides a timeline of high-level system events such as application launches and user logins?

syslog

FSEvents

.plist files

Unified logging

Which TWO Windows Event IDs are associated with successful logon or explicit credential usage? (Choose TWO.)

4648

4720

4624

4624: An account was successfully logged on.

4625

7045

In network forensics, an analyst captures traffic and sees a large number of ICMP echo requests from 10.0.0.1 to 10.0.0.2 with varying payload sizes. What is the most likely scenario?

Network reconnaissance (ping sweep)

A man-in-the-middle attack

A DoS attack using ICMP floods

A DNS amplification attack

Which TWO of the following are valid artifacts for determining program execution on a Windows system? (Select TWO.)

Pagefile.sys

System Restore points

Jump Lists

Jump Lists record recently accessed files per application, showing usage.

Prefetch files

Prefetch files contain execution count and last run time for applications.

Windows Error Reporting logs

A denial-of-service (DoS) flood

A port scan reconnaissance

A man-in-the-middle attack

Normal web browsing traffic

Want more OS and Network Forensics practice?

All OS and File System Forensics questions

Domain 7: OS and File System Forensics

8% of exam · 6 sample questions below

A forensic analyst is examining a Windows 10 system and needs to determine the last boot time of the system. Which registry hive and key should the analyst query to find this information?

NTUSER.DAT hive, key 'Control Panel\Desktop\'

SYSTEM hive, key 'CurrentControlSet\Control\Windows\', value 'ShutdownTime'

The 'ShutdownTime' value in this key records the last system shutdown time, which can be used to infer the last boot time (as the system boots after shutdown).

SOFTWARE hive, key 'Microsoft\Windows NT\CurrentVersion\'

SAM hive, key 'SAM\Domains\Account\Users\'

During a forensic investigation, an analyst needs to preserve the integrity of evidence on a hard drive. Which of the following is the best practice for acquiring an image of the drive?

Use the 'dd' command to create a raw image without a write blocker.

Connect the drive to a forensic workstation and use the operating system's copy command.

Use a hardware write blocker and create a bit-stream image.

Format the drive before imaging to ensure no hidden data is missed.

Boot the server using a forensic live CD, connect an external USB drive to the server, and use 'dd' to create a raw image on the external drive.

Use the server's built-in backup utility to create a system state backup and copy it to a network share.

Remove the hard drive, connect it via a write blocker to the forensic workstation, and then use 'dd' over a network connection to send the image to a remote server.

Remove the hard drive, connect it via a write blocker to the forensic workstation, and create an EWF (E01) image stored locally on the forensic workstation's internal drive.

This method uses a write blocker to preserve integrity, and EWF format provides compression and metadata for efficient analysis.

During a forensic investigation of a Windows 10 system, you need to analyze the file system to recover deleted files. Which TWO file system artifacts would be most useful for this purpose?

$LogFile

The $LogFile records metadata changes, including deletions; can help reconstruct file history.

$Boot file

$MFT (Master File Table)

The MFT contains file records; even after deletion, the record may remain until overwritten.

$Volume

$Bitmap

A forensic analyst is reviewing the syslog from a compromised Linux server. Based on the exhibit, what does the 'orphan inode deleted' message indicate?

A hidden file was permanently removed from the filesystem.

A file was deleted while still open, and the filesystem has cleaned up the orphan inode.

A rootkit has attempted to hide files by marking them as orphan inodes.

A critical system file has been deleted, and the filesystem is warning the administrator.

Search the $Recycle.Bin folder on the forensic image to locate the original file data, which may be stored under a different name.

Restore a previous version of the Desktop folder from Volume Shadow Copy.

Use file carving techniques to recover the file from unallocated space on the Desktop.

Check the Recycle Bin on the live system; the file should be there and can be restored.

Want more OS and File System Forensics practice?

All Application, Email and Cloud Forensics questions

Domain 8: Application, Email and Cloud Forensics

8% of exam · 6 sample questions below

Which THREE of the following are common challenges specific to cloud forensics? (Select THREE)

Data jurisdiction and legal compliance across regions

Data may be stored in multiple countries with different laws.

Volatility of evidence due to auto-scaling and ephemeral instances

Resources can be terminated automatically, losing evidence.

Inability to acquire physical hard drives

Cloud providers control the physical hardware; investigators cannot image drives directly.

Lack of standardized log formats

High cost of forensic tools

SELECT * FROM sys.dm_tran_database_transactions

DBCC LOG

fn_dblog

BACKUP LOG

Path Traversal

SQL Injection

The UNION SELECT statement in the query parameter is a SQL injection technique to extract data from the database.

Cross-Site Scripting (XSS)

Remote File Inclusion

Why: The log shows a UNION SELECT statement in the query parameter, indicating a SQL injection attempt. The URL-encoded single quote (') and comment (--) are classic SQLi payloads.

Which of the following email headers is used to verify the domain of the sending server and is commonly used for authentication to prevent spoofing?

Content-Type

Received

X-Mailer

DKIM-Signature

DKIM-Signature provides a digital signature for domain verification.

Restart the container and use 'docker exec' to collect evidence

Use 'docker inspect' to view container metadata only

Use 'docker save' to export the container as a tar file

Use 'docker commit' to create an image of the container

Which Azure log source should an investigator query to identify who deleted a virtual machine and when?

Azure Activity Log

Activity Log records resource management operations (create, update, delete).

Azure Active Directory sign-in logs

Azure Diagnostic Settings for the VM

Network Security Group flow logs

Want more Application, Email and Cloud Forensics practice?

All Mobile and Malware Forensics questions

Domain 9: Mobile and Malware Forensics

7% of exam · 6 sample questions below

A forensic analyst is examining a Windows malware sample using static analysis. Which tool is BEST suited for viewing the PE header structure, including sections, imports, and exports?

Strings

Ghidra

IDA Pro

PEiD

During an iOS forensic examination, an analyst extracts an iTunes backup and finds the file '3d0d7e5fb2ce288813306e4d4636395e047a3d28'. Which type of data does this file typically contain?

Call history

SMS and iMessage conversations

Keychain data

Notes app data

The hash corresponds to the Notes app's SQLite database (NotesStore.sqlite).

Which mobile forensics tool is specifically designed for physical extraction of iOS devices, including bypassing passcodes and extracting full file system images?

Oxygen Forensic Detective

Magnet AXIOM

Cellebrite UFED

GrayKey

A malware analyst is performing static analysis on a packed executable. Which THREE techniques are effective for unpacking or analyzing packed malware? (Select THREE.)

Renaming the file to .txt

Performing strings analysis on the packed binary

Strings may reveal embedded data or unpacked code regions.

Running PEiD to identify the packer

PEiD can detect many common packers, guiding the analyst on how to unpack.

Executing the sample in Cuckoo Sandbox

Using OllyDbg to step through the unpacking routine

OllyDbg is a debugger that can trace unpacking code.

An analyst is investigating a potential data breach on an Android device. Which TWO artefacts are MOST useful for determining which third-party apps were installed and used? (Select TWO.)

Full system dump (dd image)

packages.xml file in /data/system/

This file lists all installed packages (apps) on the device.

Wi-Fi connection logs

/data/data/ directory listing

Each installed app has a folder under /data/data/; presence indicates installation and usage.

SMS database (mmssms.db)

GrayKey

Oxygen Forensic Detective

Cellebrite UFED

SQLite Browser

Want more Mobile and Malware Forensics practice?

All Network and Cloud Forensics questions

Domain 10: Network and Cloud Forensics

7% of exam · 3 sample questions below

An investigator needs to capture network traffic from a live network segment without altering the traffic flow. Which technique should they use?

Enable NetFlow on the router and capture flows

Configure a SPAN port on the switch

Deploy an ARP spoofing tool to redirect traffic

Set the NIC to promiscuous mode on the forensic workstation

During a forensic investigation, the analyst runs netstat -ano on a compromised workstation. Based on the exhibit, which connection is MOST suspicious and should be investigated further?

The established HTTPS connection to 203.0.113.5:443 (PID 5678).

The DNS query to 192.168.1.1:53 in TIME_WAIT state.

The UDP listener on port 5353 (mDNS) with PID 910.

The listening RDP service on port 3389 (PID 1234).

Acquire a memory dump from the stopped instance by re-attaching the root volume to a forensic workstation.

Review the instance metadata log to identify the user who launched the instance.

Create a forensic copy of the EBS snapshot and attach it to a separate analysis EC2 instance in a different AWS account to avoid altering evidence.

Analyze the VPC Flow Logs to determine if other instances communicated with the same external IP.

Want more Network and Cloud Forensics practice?

All Database and Application Forensics questions

Domain 11: Database and Application Forensics

7% of exam · 3 sample questions below

Restore the transaction log backup taken after the DROP TABLE and apply it to the database.

Use the RESTORE LOG statement with the NO_TRUNCATE option to recover the table.

Perform a tail-log backup, then restore the full backup and all subsequent transaction log backups, stopping before the DROP TABLE.

Restore the most recent full backup and ignore subsequent transaction log backups.

Perform a tail-log backup of the database using the NORECOVERY option to capture all transactions since the last log backup.

Immediately restore the full backup from midnight and all transaction log backups up to 1:45 PM to a separate server for forensic analysis.

Shut down the SQL Server service to prevent further changes and then restore the database from backup.

Restore the database to a point in time using the full backup and all transaction log backups up to 1:45 PM, then apply the 2:15 PM backup to recover lost data.

The MySQL user does not have write permissions to the data directory.

The binary log is full and cannot be rotated.

The server ran out of memory due to high innodb_buffer_pool_size.

The InnoDB system tablespace file (ibdata1) is corrupted.

Want more Database and Application Forensics practice?

All Malware Forensics questions

Domain 12: Malware Forensics

7% of exam · 5 sample questions below

During malware analysis, an investigator finds that a suspicious process is injecting code into a legitimate system process (e.g., explorer.exe). Which technique is being used?

API hooking

Process hollowing

Code injection

DLL injection

Refer to the exhibit. An investigator is examining a disk image using TSK. The output from 'fls' shows the directory structure. What is the significance of the entry 'V/V 113-128-1: $OrphanFiles'?

It is a sign that a rootkit has hidden files in the image

It indicates the location of the Master File Table (MFT) mirror

It is a virtual directory that contains files with no parent directory, often from deleted files

It is a standard NTFS metadata file that stores file permissions

Conduct a thorough static analysis using a disassembler and debugger to understand the code

Delete the suspicious file and run a full antivirus scan on the system

Re-run the sample in a sandbox with simulated network connectivity or a controlled network to observe C2 communication

Perform a forensic imaging of the system again and compare with the original image

Based on the exhibit, what is the most likely indication of malware persistence?

services.exe PID 4321 is a known malware process

Windows Defender service is stopped, allowing malware to run

services.exe is listening on TCP port 4444, indicating possible code injection

svchost.exe hosting BFE and MpsSvc indicates a firewall bypass

Delete the config.ini file and the conhost.exe executable immediately.

Restore the system to a previous restore point.

Terminate the suspicious conhost.exe process and run a full antivirus scan.

Isolate the workstation from the network, then create a forensic image of the hard disk for analysis.

Want more Malware Forensics practice?