CHFI Practice Test 18 — 15 Questions

Question 1

You are imaging a suspect's hard drive using a write blocker and dd command. After imaging, you verify the hash of the original drive and the image file. The original drive hash is SHA1: A1B2C3D4E5..., and the image hash is SHA1: F6G7H8I9J0... What is the most likely cause of the mismatch?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The write blocker malfunctioned and allowed writes to the original drive. The hash mismatch indicates that the data on the original drive and the image file are not identical. A write blocker malfunction that allowed writes to the original drive during the imaging process would alter the source data after the initial hash was computed, causing the final hash of the original drive to differ from the hash of the image file taken at a different point in time. This is the most direct cause of a hash mismatch because the write blocker's primary purpose is to prevent any modification to the evidence.

Answer

The dd command used a different block size

Answer

The dd command compressed the output

Answer

The image file was corrupted during transfer

Question 2

During a forensic investigation of a hard disk, the investigator finds that the partition table is missing. The disk was previously partitioned using GPT. Which area of the disk should be examined to recover the GPT partition table?

Accepted Answer

LBA 1 (sector 1). In GPT (GUID Partition Table) disks, the primary partition table is stored in LBA 1 (sector 1), immediately following the protective MBR at LBA 0. When the partition table is missing, examining LBA 1 allows recovery of the GPT header, which contains pointers to the partition entry array. This is the correct location because GPT uses LBA 1 for its header, not the last sector or the MBR.

Answer

Last sector of the disk

Answer

Volume boot record

Answer

Master Boot Record (LBA 0)

Question 3

A forensic analyst receives a mobile device that has been factory reset. Which of the following types of data is MOST likely to be recoverable using advanced forensic techniques?

Accepted Answer

Google account tokens and cached credentials. A factory reset typically does not overwrite the flash memory where Google account tokens and cached credentials are stored. Advanced forensic techniques, such as chip-off or JTAG, can recover these remnants from the NAND flash memory, as the reset only marks the storage blocks as available for reuse without physically erasing the data.

Answer

Deleted text messages and call logs, but not app data

Answer

All user data, as factory reset only deletes file pointers

Answer

No data is recoverable after a factory reset on modern devices

Question 4

During a mobile forensics investigation, an examiner needs to acquire data from an iPhone running iOS 14. Which of the following acquisition methods provides the MOST complete data extraction?

Accepted Answer

Physical acquisition via JTAG or chip-off. Physical acquisition via JTAG or chip-off provides the most complete data extraction because it captures a bit-for-bit copy of the raw NAND flash memory, including deleted files, unallocated space, and system partitions that are otherwise inaccessible. On iOS 14, Apple's security features (e.g., full-disk encryption, SEP) limit logical and file system methods, but physical techniques bypass the operating system to retrieve the entire storage image, albeit with decryption challenges.

Answer

File system acquisition via jailbreak

Answer

Manual acquisition by browsing the device

Answer

Logical acquisition via iTunes backup

Question 5

A forensics investigator finds a suspicious LNK file on a Windows system that points to a script located on a remote share. What is the PRIMARY forensic significance of this LNK file?

Accepted Answer

It may be part of a lateral movement technique using remote execution.. An LNK file pointing to a remote share is a classic indicator of lateral movement, often used in techniques like SMB-based remote execution or PsExec. The LNK file itself does not execute code, but when opened, it triggers the Windows shell to connect to the remote share and run the script, allowing an attacker to move from one system to another without dropping a binary on the target. This is a key forensic artifact for identifying network-based propagation in attacks such as ransomware or APT intrusions.

Answer

It is evidence of USB device insertion.

Answer

It shows the user's recently accessed files.

Answer

It is a prefetch artifact indicating the script was executed.

Question 6

Which type of evidence is based on information that is not directly from an eyewitness but is reported by someone else?

Accepted Answer

Hearsay evidence. Hearsay evidence is defined as a statement made outside of court that is presented to prove the truth of the matter asserted. In digital forensics, this applies when a witness testifies about what another person said regarding an event, rather than recounting their own direct observation. The CHFI exam categorizes this under evidence types because it is not based on the witness's firsthand knowledge, making it generally inadmissible unless an exception applies.

Answer

Direct evidence

Answer

Circumstantial evidence

Answer

Best evidence

Question 7

During a Linux forensic investigation, you find the following entry in /var/log/auth.log: "Accepted publickey for root from 203.0.113.5 port 54321 ssh2: RSA SHA256:abc...". The user claims they never connect from that IP. Which forensic artifact should you examine next to confirm unauthorized access?

Accepted Answer

~/.ssh/authorized_keys for unauthorized keys. The log entry shows a successful SSH authentication using a public key from an unknown IP. The most direct way to confirm unauthorized access is to check ~/.ssh/authorized_keys for any rogue public keys that were added without the user's knowledge, as this file controls which keys are permitted to authenticate as that user. If an attacker added their own public key here, they could log in without a password, making this the primary artifact to examine.

Answer

bash_history for suspicious commands

Answer

/etc/shadow for recent modifications

Answer

/var/log/syslog for cron job entries

Question 8

A forensic examiner is analyzing a compromised Linux system and finds a suspicious cron job in /var/spool/cron/crontabs/root that executes a script every hour. The script is located in /tmp/.hidden/update.sh. What is the BEST next step?

Accepted Answer

Capture the script for analysis and preserve the cron entry as evidence. The cron job entry in /var/spool/cron/crontabs/root and the associated script in /tmp/.hidden/update.sh are critical pieces of evidence. The best next step is to capture the script for malware analysis and preserve the cron entry (e.g., by making a forensic copy of the file and its metadata) to maintain the integrity of the evidence chain. Deleting or rebooting would destroy volatile data and potentially alert the attacker, while running the script without proper containment could cause further compromise.

Answer

Reboot the system to clear the cron job from memory

Answer

Delete the cron job immediately to prevent further damage

Answer

Run the script in a sandbox to determine its functionality

Question 9

Which Windows artifact is primarily used to determine the execution history of applications, including the path and run count?

Accepted Answer

Prefetch files. Prefetch files (.pf) are created by Windows to speed up application startup by caching data about the files loaded during the first few seconds of execution. Each prefetch file records the application's path, the number of times it has been run (run count), and the last execution timestamp, making it the primary artifact for determining execution history.

Answer

LNK files

Answer

Jump lists

Answer

Event logs

Question 10

A security analyst reviews Windows Security event logs and finds Event ID 4625 with Logon Type 10. What does this indicate?

Accepted Answer

Failed remote interactive logon (e.g., RDP). Event ID 4625 with Logon Type 10 specifically indicates a failed Remote Interactive logon attempt, which is characteristic of Remote Desktop Protocol (RDP) connections. Logon Type 10 is defined in Windows security auditing as 'RemoteInteractive' and is triggered when an authentication attempt fails over a remote desktop session, typically using RDP (port 3389). This event is critical for detecting brute-force or unauthorized RDP access attempts.

Answer

Failed service logon attempt

Answer

Successful network logon

Answer

Successful local logon

Question 11

During a forensic examination, an analyst runs `dcfldd if=/dev/sda of=image.dd hash=sha256 hashwindow=1G` on a suspect drive. What is the PRIMARY advantage of using `hashwindow=1G` over a single hash at the end?

Accepted Answer

It allows verification of the image in 1GB segments, so errors can be pinpointed.. The `hashwindow=1G` option in `dcfldd` computes a SHA-256 hash for every 1 GB segment of the input data, rather than a single hash for the entire image. This allows the analyst to verify the integrity of each segment independently, so if a hash mismatch occurs during later verification, the exact 1 GB block containing the error can be identified and reacquired without reimaging the entire drive.

Answer

It enables the image to be mounted as a loop device.

Answer

It encrypts the image file for security.

Answer

It reduces the total time to create the image.

Question 12

During a forensic investigation, an analyst creates a forensic image using `dcfldd` with the command: `dcfldd if=/dev/sda of=image.dd hash=sha256 hashwindow=10M`. What is the purpose of the `hashwindow` parameter?

Accepted Answer

It creates a hash for every 10 MB block of data. The `hashwindow` parameter in `dcfldd` specifies the size of the data chunks for which individual hash values are computed. With `hashwindow=10M`, the tool generates a SHA-256 hash for every 10 MB block of the input data, allowing verification of integrity on a per-block basis rather than only a single hash for the entire image. This is useful for detecting corruption or tampering in specific segments of large forensic images.

Answer

It limits the total amount of data to hash to 10 MB

Answer

It sets the hash algorithm to SHA-256

Answer

It enables error correction for every 10 MB

Question 13

In Windows forensics, which artifact is a database of metadata about files and applications accessed by the user, used to populate the 'Recent Items' and 'Quick Access' lists?

Accepted Answer

Jumplists. Jumplists are the correct answer because they are a Windows artifact that stores metadata about recently accessed files and applications, directly populating the 'Recent Items' and 'Quick Access' lists in the taskbar and File Explorer. Each jumplist is a database file (e.g., .automaticDestinations-ms or .customDestinations-ms) containing entries with timestamps, file paths, and application IDs, making them a key source for forensic reconstruction of user activity.

Answer

Prefetch files

Answer

LNK files

Answer

ShellBags

Question 14

An analyst runs 'foremost -i disk.dd -o output' and recovers several JPEG files. However, some files are corrupted or incomplete. What is the most likely cause?

Accepted Answer

The files were fragmented across the disk, and foremost did not reassemble fragments. Foremost is a file carving tool that relies on file headers and footers to recover data. It does not handle fragmentation; if a JPEG file's data blocks are non-contiguous on the disk, Foremost will only recover the first fragment up to the point where the next fragment begins, resulting in a corrupted or incomplete file. This is a known limitation of header/footer carving without fragmentation support.

Answer

The files were stored in a journaling file system that overwrites deleted data quickly

Answer

The output directory had insufficient space to store the recovered files

Answer

The disk image contains bad sectors that could not be read

Question 15

A malware analyst is using a tool to monitor registry and file system changes during the execution of a suspicious binary. Which tool is specifically designed to take snapshots of the registry and file system before and after execution to identify changes?

Accepted Answer

Regshot. Regshot is a lightweight open-source tool designed specifically to compare registry hives and file system snapshots taken before and after executing a binary. It generates a detailed report of added, modified, or deleted keys and files, making it ideal for malware analysis to quickly identify persistence mechanisms or configuration changes.

Answer

Cuckoo Sandbox

Answer

Process Explorer

Answer

Process Monitor