CHFI Practice Test 19 — 15 Questions

Question 1

Which tool is specifically designed for timeline analysis of forensic artifacts across multiple systems and can process output from various forensic tools?

Accepted Answer

log2timeline. log2timeline (now part of the Plaso framework) is specifically designed for super timeline creation, aggregating and correlating timestamps from multiple forensic artifacts across different systems. It can ingest output from tools like The Sleuth Kit, Autopsy, and others to produce a unified, high-resolution timeline for analysis.

Answer

Autopsy

Answer

Wireshark

Answer

Sleuth Kit

Question 2

In an ext4 file system, a forensic analyst needs to examine the journal to recover recently deleted files. Where is the journal typically stored?

Accepted Answer

In a special inode (inode 8). In ext4, the journal is stored as a regular file associated with a special inode, typically inode 8. This design allows the journal to be managed by the file system's standard inode and block allocation mechanisms, rather than being placed in a fixed reserved area. When a file is deleted, its data blocks may still be referenced in the journal until they are overwritten, enabling recovery by replaying or analyzing journal entries.

Answer

In a reserved area after the superblock

Answer

In the superblock

Answer

In the group descriptor table

Question 3

Which of the following BEST describes the purpose of a legal hold in e-discovery?

Accepted Answer

To suspend the deletion of data that may be relevant to upcoming litigation. A legal hold (also known as a litigation hold) is a directive that suspends the normal deletion or destruction of data that may be relevant to pending or reasonably anticipated litigation. In e-discovery, this ensures that potentially relevant electronically stored information (ESI) is preserved and not altered or destroyed, thereby preventing spoliation of evidence. The purpose is to maintain the integrity and availability of data for discovery obligations under rules such as FRCP Rule 37(e).

Answer

To encrypt data for secure storage

Answer

To obtain a search warrant for digital evidence

Answer

To permanently delete irrelevant data

Question 4

During a forensic examination of a Windows 10 system, an investigator runs the following command: 'fsutil usn readjournal C: > usn_output.txt'. What is the primary purpose of this action?

Accepted Answer

To analyze the Update Sequence Number (USN) journal for file system activity. The `fsutil usn readjournal` command reads the Update Sequence Number (USN) journal, which is a change journal that records all modifications to files and directories on an NTFS volume. This is the primary purpose of the command, as it allows an investigator to analyze file system activity, including file creations, deletions, and modifications, which is critical for forensic timeline reconstruction.

Answer

To recover deleted files from the Recycle Bin

Answer

To check the integrity of the NTFS file system

Answer

To extract the Master File Table ($MFT) from the volume

Question 5

Which of the following tools is specifically designed for forensic imaging and can create compressed, segmented, or E01 format images?

Accepted Answer

FTK Imager. FTK Imager is specifically designed for forensic imaging and supports creating compressed, segmented, and E01 (Expert Witness Format) images. Unlike generic tools, it provides a GUI and built-in validation (e.g., MD5/SHA1 hashing) tailored for forensic acquisition, making it the correct choice for this question.

Answer

dd

Answer

Nmap

Answer

Wireshark

Question 6

In Windows registry forensics, which key is examined to identify USB devices that were connected to the system?

Accepted Answer

HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR. The USBSTOR key under HKLM\SYSTEM\CurrentControlSet\Enum contains a subkey for each USB mass storage device that has ever been connected to the system, recording the device's serial number, class, and instance ID. This is the primary forensic artifact for identifying USB device connection history because the system enumerates and persists these entries when a USB storage device is first plugged in.

Answer

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Answer

NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2

Answer

HKLM\SAM\SAM\Domains\Account\Users

Question 7

Which tool is commonly used for timeline analysis in digital forensics, combining multiple artifacts into a super timeline?

Accepted Answer

Plaso. Plaso (log2timeline) is the correct tool for timeline analysis because it ingests multiple forensic artifacts (e.g., registry hives, event logs, file system metadata, browser history) and correlates them into a single, unified super timeline. This allows investigators to reconstruct events across different data sources in chronological order, which is essential for timeline analysis in digital forensics.

Answer

Autopsy

Answer

Sleuth Kit

Answer

Wireshark

Question 8

An examiner acquires a forensic image of an SSD from a suspect's laptop. The SSD was connected to a system with TRIM enabled. What challenge will the examiner most likely face when trying to recover deleted files?

Accepted Answer

Deleted files may have been physically erased by TRIM. When TRIM is enabled on an SSD, the operating system sends ATA DATA SET MANAGEMENT commands to the drive to immediately erase the physical blocks corresponding to deleted files. This means the deleted file data is permanently and irreversibly erased at the flash memory level, making recovery via traditional file carving or forensic tools impossible. Option D correctly identifies this as the primary challenge.

Answer

Wear leveling complicates data location

Answer

RAID striping interferes with imaging

Answer

The SSD is encrypted and cannot be imaged

Question 9

During the initial response to a suspected data breach, a first responder discovers a live system with active network connections. The responder needs to preserve evidence while minimizing alteration. Which of the following is the MOST appropriate first step?

Accepted Answer

Use a memory acquisition tool to capture the contents of RAM.. A is correct because in a live system with active network connections, the most volatile evidence is in RAM (e.g., running processes, network connections, encryption keys). Using a memory acquisition tool (like FTK Imager or WinPmem) captures this volatile data before any other action, preserving evidence that would be lost on shutdown or disconnection. This aligns with the order of volatility (RFC 3227), which prioritizes memory over disk.

Answer

Run a full disk imaging tool to capture the hard drive contents.

Answer

Disconnect the network cable to isolate the system from the network.

Answer

Immediately shut down the system by pulling the power cord.

Question 10

A first responder arrives at a suspected data breach scene. The system is powered on and a user is logged in. Which of the following actions should the responder take FIRST to preserve volatile data?

Accepted Answer

Collect volatile data such as RAM, network connections, and running processes using appropriate tools.. Volatile data (RAM, network connections, running processes) is lost when power is removed. The first responder must capture this data using tools like FTK Imager, WinPmem, or netstat before any shutdown or disconnection. This aligns with the order of volatility (RFC 3227), which prioritizes memory and network state over disk imaging.

Answer

Document the scene and take photographs, then proceed to interview witnesses.

Answer

Immediately disconnect the network cable and power off the computer.

Answer

Use a hardware write-blocker to create a forensic image of the hard drive.

Question 11

Refer to the exhibit. An analyst recovers this binary log entry from a MySQL server. What does the timestamp '190101 10:00:00' represent?

Accepted Answer

The time the DELETE statement was executed on the MySQL server. In MySQL binary logs, the timestamp in the 'Query' event header (e.g., '190101 10:00:00') records the server's local time when the statement began executing. This is the time the DELETE statement was actually processed by the MySQL server, not when the client sent it or when the log was written. The binary log captures the exact moment the server starts executing the query, making option A correct.

Answer

The time the client sent the query to the server

Answer

The time the binary log file was written to disk

Answer

The time the transaction was committed

Question 12

A security team detects exfiltration via HTTP POST requests to a suspicious domain. Which network forensic technique would BEST identify the data being sent in these requests?

Accepted Answer

Wireshark packet capture with HTTP follow stream. Wireshark packet capture with HTTP follow stream allows the investigator to reassemble the full HTTP conversation, including the body of POST requests. By following the TCP stream, the exact payload (e.g., exfiltrated data) is reconstructed in plain text, making it the best technique to identify the data being sent. This method directly captures and decodes the application-layer content, unlike log-based or flow-based analysis.

Answer

Firewall log review

Answer

IDS alert correlation

Answer

NetFlow analysis

Question 13

A forensic examiner is analyzing a Mac system and wants to review system logs that record various activities, including application launches and kernel events. Which logging system on macOS should be examined?

Accepted Answer

Unified logging (log command). Unified logging (log command) is the correct answer because macOS has consolidated all system and user-level logs into a single, high-performance unified logging system since macOS 10.12 (Sierra). This system captures kernel events, application launches, and other activities in a structured, binary format that can be queried using the 'log' command-line tool or the Console app. It is the primary and most comprehensive source for forensic analysis of system activity on modern macOS systems.

Answer

.plist files

Answer

FSEvents

Answer

Console.app logs

Question 14

During a forensic examination, an analyst uses Autopsy to view the contents of the Recycle Bin on a Windows 10 system. However, some files that were deleted by the user do not appear in the Recycle Bin. What is the MOST likely reason?

Accepted Answer

The files were deleted using Shift+Delete. When a user deletes a file using Shift+Delete, the file bypasses the Recycle Bin entirely and is permanently removed from the file system. Autopsy, as a forensic tool, reads the Recycle Bin’s metadata (e.g., the $I and $R files) to list its contents, so files deleted with Shift+Delete will not appear there because they were never placed in the Recycle Bin.

Answer

The Recycle Bin stores only files smaller than 1 GB

Answer

The files were encrypted

Answer

The Recycle Bin was emptied

Question 15

A forensic analyst is investigating a compromised Linux server running an ext4 file system. The analyst suspects the attacker deleted critical log files (e.g., /var/log/auth.log) and wants to recover them. Which TWO techniques would be MOST effective for recovering the deleted files?

Accepted Answer

Running `extundelete` on the partition. Option A is correct because `extundelete` is a specialized utility designed for ext3/ext4 file systems that reads the journal and inode tables to locate and restore recently deleted files, making it ideal for recovering deleted logs like /var/log/auth.log on an ext4 partition. Option C is correct because `foremost` performs file carving by scanning raw disk data for known file headers and footers, which can recover deleted files even when file system metadata (inodes) has been overwritten or is unavailable. Option B is incorrect because `.Trash-1000` is a per-user trash directory used by desktop environments, not a system-wide recovery location, and root-owned logs deleted by an attacker would not be moved there. Option D is incorrect because `lost+found` is used by fsck to reconnect orphaned inodes (files with intact metadata but no directory entry), not to recover files whose inodes were freed upon deletion. Option E is incorrect because `dd` merely creates a bit-for-bit image and `strings` only extracts printable character sequences; neither reconstructs deleted files or their metadata, so this approach is not an effective recovery technique.

Answer

Checking the `.Trash-1000` folder

Answer

Restoring from the `lost+found` directory

Answer

Executing `dd if=/dev/sda1 of=image.dd` and analyzing with `strings`