CHFI Practice Test 13 — 15 Questions

Question 1

During a forensic investigation of a compromised Linux server, an investigator needs to recover deleted files from an ext4 filesystem. Which method should the investigator use to maximize recovery of file content, considering the filesystem may have been partially overwritten?

Accepted Answer

Use 'foremost' to carve files based on file headers and footers.. Foremost is the correct choice because it performs file carving based on headers and footers, which can recover file content even when the filesystem metadata (such as inodes) is damaged or partially overwritten. Unlike undelete tools that rely on intact filesystem structures, foremost scans the raw disk blocks for known file signatures, making it effective for recovering files from an ext4 filesystem that has experienced partial overwriting.

Answer

Use 'grep -a' to search the raw disk for file signatures.

Answer

Use 'scalpel' to perform a deep scan of the filesystem.

Answer

Use 'extundelete' to recover files from the ext4 filesystem.

Question 2

During a forensic investigation, the analyst runs netstat -ano on a compromised workstation. Based on the exhibit, which connection is MOST suspicious and should be investigated further?

Accepted Answer

The established HTTPS connection to 203.0.113.5:443 (PID 5678).. The established HTTPS connection to 203.0.113.5:443 (PID 5678) is most suspicious because it is an external IP address (not in the private RFC 1918 range) with an established TCP connection, indicating active data transfer. In a forensic context, an outbound HTTPS connection to an unknown external IP is a common indicator of command-and-control (C2) communication or data exfiltration, especially when the PID can be traced to an unknown or malicious process.

Answer

The DNS query to 192.168.1.1:53 in TIME_WAIT state.

Answer

The UDP listener on port 5353 (mDNS) with PID 910.

Answer

The listening RDP service on port 3389 (PID 1234).

Question 3

During a database forensic investigation, an analyst finds that the SQL Server transaction log contains gaps. Which TWO actions should the analyst take to preserve evidence integrity and recover missing transactions?

Accepted Answer

Perform a transaction log backup using BACKUP LOG. Option A is correct because performing a transaction log backup using BACKUP LOG captures the active portion of the transaction log, preserving evidence of all committed and uncommitted transactions. This ensures that the log is not truncated and that the forensic integrity of the transaction history is maintained for later analysis. Without this backup, subsequent operations could overwrite or lose critical transaction records.

Answer

Run DBCC CHECKDB to verify database consistency

Answer

Restart the SQL Server service to flush pending transactions

Answer

Truncate the transaction log to free space

Question 4

You are investigating a suspected data exfiltration incident at a financial institution. The database is MySQL 8.0 running on Linux. The security team suspects that a user with administrative privileges exported sensitive customer records via SELECT INTO OUTFILE and then deleted the output file. The MySQL general log is enabled and located at /var/log/mysql/mysql.log. However, the log file appears to be truncated and only contains entries from the last hour. The binary log is also enabled, and the binary log files are stored in /var/lib/mysql/binlog.000001 through binlog.000005. The database is actively being used. Which of the following is the BEST course of action to recover evidence of the SELECT INTO OUTFILE command that may have occurred 3 hours ago?

Accepted Answer

Parse the binary log files using mysqlbinlog to extract all statements from the relevant time period. The binary log records all data-changing statements (including DDL and DML) and is not truncated like the general log. Since the incident occurred 3 hours ago and the general log only covers the last hour, the binary log files (binlog.000001–000005) are the only persistent record. Using mysqlbinlog to parse these files can recover the SELECT INTO OUTFILE statement from the relevant time period, even if the output file was deleted.

Answer

Analyze the general log file using grep and tail to search for SELECT INTO OUTFILE

Answer

Examine the InnoDB redo log files to find the SELECT INTO OUTFILE command

Answer

Enable MySQL audit logging and wait for the activity to reoccur

Question 5

During a forensic investigation, an analyst uses a tool to create a bit-for-bit copy of a hard drive while ensuring the original is not modified. Which of the following is a hardware write blocker that can be used for this purpose?

Accepted Answer

Tableau. A hardware write blocker physically prevents any write commands from reaching the original drive at the SATA/IDE bus level, ensuring the drive remains unaltered during acquisition. Tableau is a well-known manufacturer of forensic hardware write blockers that operate transparently to the imaging software, making it the correct choice for a hardware-based solution.

Answer

FTK Imager

Answer

dd

Answer

EnCase

Question 6

Which of the following is the PRIMARY purpose of using a write blocker in computer forensics?

Accepted Answer

To prevent any modification to the original evidence drive during acquisition.. A write blocker ensures that no data is written to the original evidence drive during acquisition, maintaining its integrity.

Answer

To speed up the imaging process by caching writes.

Answer

To convert the hard drive interface from SATA to USB.

Answer

To encrypt the forensic image for secure transport.

Question 7

A security analyst arrives at a suspected computer crime scene. The computer is on and a user is logged in. The analyst needs to preserve volatile data. According to first responder duties, what should the analyst do FIRST?

Accepted Answer

Capture volatile data such as running processes and network connections. Option D is correct because the first responder's priority is to preserve volatile data, which is lost when the system is powered off. Volatile data includes running processes, network connections, and memory contents, which must be captured before any other action. This aligns with the order of volatility (RFC 3227) and standard forensic procedures.

Answer

Immediately unplug the power cord to prevent data alteration

Answer

Create a forensic image of the hard drive using a write blocker

Answer

Photograph the scene and document everything

Question 8

Based on the exhibit, what is the most likely indication of malware persistence?

Accepted Answer

services.exe is listening on TCP port 4444, indicating possible code injection. Option C is correct because services.exe (the Service Control Manager) should not normally listen on any TCP port. When it is found listening on TCP port 4444—a port commonly associated with Metasploit and reverse shells—it strongly indicates that malware has injected code into the legitimate services.exe process, hijacking it to establish a persistent backdoor listener. This is a classic sign of process hollowing or reflective DLL injection, where the malware hides its network activity under a trusted system process.

Answer

services.exe PID 4321 is a known malware process

Answer

Windows Defender service is stopped, allowing malware to run

Answer

svchost.exe hosting BFE and MpsSvc indicates a firewall bypass

Question 9

Which TWO of the following are essential duties of a first responder at a digital crime scene? (Select two.)

Accepted Answer

Photograph the scene including the screen, connections, and surrounding area. First responders must secure the scene, document everything, preserve evidence, and avoid altering the system state. Photographing the scene and using a write blocker to image are correct; collecting volatile memory is a specialized task, not a first responder's primary duty, and powering off without capturing RAM is generally avoided.

Answer

Attempt to recover deleted files using forensic software on the live system

Answer

Power off the computer immediately to prevent data modification

Answer

Disconnect the computer from the network to stop remote access

Question 10

Which TWO of the following are requirements for evidence to be admissible in court? (Select two.)

Accepted Answer

Evidence must be reliable. The rules of evidence require that evidence be admissible, reliable, complete, and authentic. In many jurisdictions, evidence must be relevant and reliable to be admissible. Completeness and authenticity are also key.

Answer

Evidence must be encrypted

Answer

Evidence must be stored on a write-blocked drive

Answer

Evidence must be obtained by the police

Question 11

Which THREE of the following correctly describe the rules of evidence as applied to digital forensics? (Select three.)

Accepted Answer

Evidence must be relevant to the case and obtained through lawful means. Option A is correct because evidence must be relevant to the case and obtained through lawful means. In digital forensics, this aligns with the legal principle of relevance under the Federal Rules of Evidence (FRE 401) and the requirement that evidence be obtained via a lawful search warrant or consent, otherwise it may be suppressed under the exclusionary rule (e.g., Fourth Amendment violations).

Answer

Circumstantial evidence is not allowed in digital forensics cases

Answer

Hearsay evidence is always inadmissible in court

Question 12

During a forensic investigation, a junior analyst suggests using a software write blocker to image a suspect's hard drive. Which of the following is the PRIMARY concern with relying solely on a software write blocker in a high-stakes legal case?

Accepted Answer

Software write blockers may be circumvented if the operating system is compromised.. Software write blockers are not as reliable as hardware ones because they rely on the operating system, which can be compromised; hardware write blockers provide physical write protection.

Answer

Software write blockers require additional licensing fees.

Answer

Software write blockers are not compatible with all operating systems.

Answer

Software write blockers are too slow for large drives.

Question 13

A forensic examiner needs to acquire an image of a suspect's laptop hard drive. The laptop is running, and the examiner wants to capture volatile data first. According to best practices, which order of steps should the examiner follow?

Accepted Answer

Capture volatile data, then shut down normally, remove the drive, and image with a write blocker.. Option D is correct because forensic best practices mandate capturing volatile data (e.g., RAM, network connections, running processes) first, as this data is lost on power loss. After capturing volatile data, the examiner should perform a graceful shutdown to preserve file system integrity, then remove the drive and acquire a forensic image using a write blocker to prevent any modification to the original evidence.

Answer

Unplug the laptop, remove the drive, and boot the drive in a forensic workstation.

Answer

Immediately remove the hard drive, then capture RAM from the drive.

Answer

Create a full disk image over the network while the laptop is running.

Question 14

During a forensic investigation, the analyst needs to create a forensic image of a hard drive that also hashes the data during acquisition. Which command-line tool would be MOST appropriate for this task?

Accepted Answer

dcfldd. dcfldd is a modified version of dd that includes built-in hashing (e.g., MD5, SHA-1, SHA-256) during the imaging process, allowing the analyst to verify data integrity in real time without a separate hashing step. This makes it the most appropriate tool for creating a forensic image that also hashes the data during acquisition.

Answer

dd

Answer

fdisk

Answer

memdump

Question 15

During the first response to a computer incident, which of the following actions is MOST critical for preserving evidence?

Accepted Answer

Photograph the scene including all visible cables and connections. Option C is correct because photographing the scene, including all visible cables and connections, is the most critical first step in preserving the chain of custody and documenting the exact physical state of the system before any changes occur. This visual record captures port assignments, device connections, and cable orientations that could be altered by subsequent actions, ensuring that the original configuration is preserved for forensic analysis. Without this documentation, later evidence of network topology or peripheral involvement may be lost or disputed.

Answer

Run antivirus software to remove any malware

Answer

Disconnect the power to prevent data alteration

Answer

Immediately boot the system to verify it is operational