CHFI Practice Test 1 — 10 Questions

Question 1

An investigator acquires an SSD from a laptop that has been turned off for 24 hours. The suspect recently deleted several incriminating files. Using a forensic imager, the investigator creates a bit-for-bit copy. However, when analyzing the image, the deleted files' data appears to be zeros. What is the MOST likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The TRIM command was issued, causing the SSD to erase the freed blocks. The TRIM command is an ATA command that allows an operating system to inform an SSD which data blocks are no longer in use and can be wiped internally. When the suspect deleted the files, the OS likely issued a TRIM command to the SSD, causing the controller to erase the freed physical blocks. Since the laptop was off for 24 hours, the SSD had ample time to complete the garbage collection process, resulting in the deleted files' data appearing as zeros in the forensic image.

Answer

The files were stored in the paging file, which is volatile

Answer

The SSD controller performed wear leveling, moving data to unallocated blocks

Answer

The imaging tool incorrectly interpreted the data due to encryption

Question 2

An investigator needs to testify in court as an expert witness. Which of the following qualifications is MOST important for the court to accept their testimony?

Accepted Answer

They can demonstrate knowledge, skill, experience, training, or education that will assist the trier of fact.. Under the Federal Rules of Evidence (FRE) Rule 702, a witness qualified as an expert by knowledge, skill, experience, training, or education may testify if their specialized knowledge will assist the trier of fact. Option C directly mirrors this legal standard, making it the most critical qualification for admissibility. Certifications, publications, or years of service are supporting factors but not independently sufficient under the Daubert or Frye standards.

Answer

They have a certification in computer forensics.

Answer

They have published articles in peer-reviewed journals on digital forensics.

Answer

They have been employed as a forensic analyst for over 10 years.

Question 3

A forensic analyst is examining a RAID 5 array consisting of three disks. One disk has failed and has been replaced. The array is rebuilt automatically. However, the analyst needs to recover deleted files that existed before the rebuild. What is the MOST significant challenge in this scenario?

Accepted Answer

The rebuild process may overwrite data in slack space and previously unallocated clusters. When a RAID 5 array with a failed disk is rebuilt, the controller reconstructs data using parity information and writes it to the replacement disk. This rebuild process writes to all previously unallocated clusters and slack space across the array, potentially overwriting the very data the analyst hopes to recover. Deleted files that existed before the rebuild are at high risk of being overwritten during this automatic reconstruction, making recovery extremely difficult or impossible.

Answer

File carving techniques do not work on RAID volumes

Answer

The file system becomes corrupted after rebuild

Answer

The RAID controller encrypts data, preventing direct disk access

Question 4

A forensic investigator examines a hard drive and needs to recover deleted files. Which tool is specifically designed for file carving by scanning raw data for file headers and footers without relying on the file system?

Accepted Answer

Foremost. Foremost is a file carving tool that scans raw disk data for known file headers and footers (e.g., JPEG, PDF, ZIP) to recover files independently of the file system metadata. This makes it ideal when the file system is damaged or deleted, as it relies solely on content signatures rather than directory structures.

Answer

Volatility

Answer

Autopsy

Answer

FTK Imager

Question 5

A forensic analyst is examining an Android device that has been factory reset. Which type of data is LEAST likely to be recoverable using forensic tools?

Accepted Answer

Encrypted app data from /data/data/. After a factory reset, the /data partition is wiped and re-encrypted with a new key. Encrypted app data stored under /data/data/ is protected by file-based encryption (FBE) using a per-user encryption key that is discarded during the reset. Without the original encryption key, forensic tools cannot decrypt this data, making it the least likely to be recoverable.

Answer

Google account tokens stored in AccountManager

Answer

System logs in /data/log/

Answer

Deleted text messages from SQLite files

Question 6

Which type of evidence is a witness's statement that they saw someone log into a computer?

Accepted Answer

Direct evidence. Direct evidence is testimony or other proof that directly proves a fact without requiring any inference. A witness's statement that they saw someone log into a computer is direct evidence because it is based on the witness's firsthand observation of the act itself, not on any deduction or assumption. In digital forensics, direct evidence can include eyewitness accounts of specific actions on a system, such as entering credentials or accessing files.

Answer

Hearsay evidence

Answer

Best evidence

Answer

Circumstantial evidence

Question 7

Which TWO of the following are tools that can be used for timeline analysis in digital forensics?

Accepted Answer

log2timeline. log2timeline (option C) is a tool specifically designed for timeline analysis in digital forensics. It parses various log files and artifacts to create a super timeline, which is a comprehensive chronological record of system activity. This allows investigators to correlate events across multiple sources, such as file system timestamps, registry keys, and application logs.

Answer

Wireshark

Answer

Nmap

Answer

FTK Imager

Question 8

What is the primary goal of the chain of custody in a digital forensic investigation?

Accepted Answer

To maintain the integrity and admissibility of evidence. The chain of custody is a documented chronological record that tracks the seizure, custody, control, transfer, analysis, and disposition of digital evidence. Its primary goal is to maintain the integrity and admissibility of evidence by proving that the evidence has not been tampered with or altered from the moment it was collected until it is presented in court. This is critical because any break in the chain can lead to evidence being deemed inadmissible under rules like the Federal Rules of Evidence (FRE) or the Daubert standard.

Answer

To encrypt the evidence during transport

Answer

To speed up the forensic analysis process

Answer

To ensure that the forensic tools used are properly licensed

Question 9

A forensic analyst is preparing to testify as an expert witness in court. Which of the following characteristics is MOST essential for the court to accept the analyst's testimony?

Accepted Answer

The analyst's methods are generally accepted in the forensic community. The court's acceptance of expert testimony hinges on the reliability and validity of the methods used, not the analyst's personal involvement or credentials. Under the Daubert standard (or Frye standard in some jurisdictions), the key factor is whether the forensic methods have been subjected to peer review, are generally accepted within the relevant scientific community, and have a known error rate. This ensures the testimony is based on sound scientific principles, not just the analyst's qualifications or role in the case.

Answer

The analyst has direct knowledge of the case

Answer

The analyst has a certification in computer forensics

Answer

The analyst is employed by the prosecution

Question 10

You are investigating a Windows 10 workstation that exhibits slow performance and frequent pop-ups. The user reports that the system started acting strangely after installing a 'PDF Converter' from an email attachment. You suspect malware. You have captured a memory dump using FTK Imager and a network capture during the infection. In the memory dump, you find a suspicious process 'conhost.exe' running from a non-standard location (C:\Users\Public\Temp). The process has an open handle to a file named 'config.ini' in the same directory. The network capture shows periodic HTTPS connections to 'malicious.com' on port 443 from the workstation's IP. Using Volatility, you extract the process's command line: 'conhost.exe -hidden -log C:\Users\Public\Temp\output.log'. Which of the following is the BEST immediate course of action to contain the threat and preserve evidence?

Accepted Answer

Isolate the workstation from the network, then create a forensic image of the hard disk for analysis.. The primary goal in a malware incident is to contain the threat and preserve evidence for forensic analysis. Isolating the workstation from the network prevents further data exfiltration (e.g., the HTTPS connections to malicious.com) and stops the malware from communicating with its C2 server. Creating a forensic image of the hard disk preserves the full state of the system, including the malicious conhost.exe, config.ini, and output.log files, which are critical for reverse engineering and attribution. Terminating the process or deleting files before imaging would destroy volatile evidence and potentially trigger anti-forensic mechanisms.

Answer

Delete the config.ini file and the conhost.exe executable immediately.

Answer

Restore the system to a previous restore point.

Answer

Terminate the suspicious conhost.exe process and run a full antivirus scan.