CHFI Practice Test 20 — 15 Questions

Question 1

During a forensic investigation, an analyst uses a hardware write blocker to connect a suspect hard drive to a forensic workstation. What is the primary purpose of using a hardware write blocker?

Accepted Answer

To prevent the operating system from writing to the source drive. A hardware write blocker physically intercepts the write commands from the forensic workstation to the suspect drive, ensuring that no data can be altered on the source drive during acquisition. This preserves the evidentiary integrity of the original media, which is a foundational requirement in digital forensics to maintain a chain of custody and admissibility in court.

Answer

To speed up the data transfer rate during imaging

Answer

To compress the forensic image to save storage space

Answer

To automatically hash the drive contents for integrity verification

Question 2

An investigator finds a suspicious LNK file on a Windows desktop pointing to an executable in the Temp folder. What is the significance of LNK files in forensic analysis?

Accepted Answer

They provide evidence of file access and execution. LNK files (Windows shortcuts) contain metadata about the target file, including its path, creation/modification timestamps, and volume information. When a user double-clicks an LNK file, Windows follows the link to execute the target, so the presence of an LNK file pointing to an executable in the Temp folder is strong evidence that the executable was accessed or executed from that location. This is critical in forensic analysis for reconstructing user activity and identifying potential malware execution.

Answer

They store network share credentials in plaintext

Answer

They contain the full content of the target file

Answer

They are used exclusively for system files

Question 3

A Windows system has been compromised. The analyst finds a registry run key at HKCU\Software\Microsoft\Windows\CurrentVersion\Run with value name 'UpdateService' pointing to C:\Users\Public\svchost.exe. Why is this particularly suspicious?

Accepted Answer

The path is not typical for svchost.exe, which resides in System32. The legitimate svchost.exe is a critical Windows system binary located in C:\Windows\System32. An executable named svchost.exe running from C:\Users\Public\ is a classic masquerading technique used by malware to evade detection by mimicking a trusted process name while residing in a user-writable, non-standard directory. This path deviation is the primary red flag because system processes should never execute from user profile or public folders.

Answer

Run keys are only for startup programs, not services

Answer

The run key is disabled in Windows 10

Answer

The registry value name 'UpdateService' is too generic

Question 4

An organization receives a litigation hold notice regarding an ongoing lawsuit. The IT department is instructed to preserve all relevant electronic data. Which of the following actions should be taken FIRST to comply with the legal hold?

Accepted Answer

Immediately preserve all potentially relevant data, including backups and archives, and suspend automatic deletion policies.. The first step in responding to a litigation hold is to immediately preserve all potentially relevant data, including backups and archives, and suspend any automatic deletion or rotation policies. This ensures that no spoliation of evidence occurs, which could lead to legal sanctions. The preservation order must be broad to cover all data that might be relevant, as determining exact relevance comes later in the e-discovery process.

Answer

Delete all data that is not relevant to the lawsuit to reduce storage.

Answer

Notify all employees to ignore the hold and continue normal operations.

Answer

Conduct a forensic analysis of the data to determine relevance before preservation.

Question 5

During a forensic investigation, the examiner uses a write blocker to connect the suspect drive to the forensic workstation. What is the PRIMARY purpose of using a write blocker?

Accepted Answer

To prevent the operating system from writing data to the evidence drive. The primary purpose of a write blocker is to intercept and block any write commands from the operating system to the evidence drive, ensuring that the original data remains unaltered (bit-for-bit identical) during acquisition. This maintains the forensic integrity of the evidence, which is critical for admissibility in legal proceedings. Without a write blocker, the OS could automatically write metadata, logs, or temporary files to the drive, contaminating the evidence.

Answer

To speed up the data acquisition process

Answer

To encrypt the data on the evidence drive

Answer

To allow the evidence drive to be used as a boot device

Question 6

During malware analysis, an analyst discovers that a sample uses a technique to modify its own code at runtime to evade signature detection. Which anti-forensic technique does this describe?

Accepted Answer

Packing/Obfuscation. The technique of modifying code at runtime to evade signature detection is known as packing or obfuscation. Packers compress or encrypt the original executable and wrap it with a small stub that decompresses or decrypts the code in memory during execution, thereby altering the static file signature. This runtime modification allows the malware to bypass signature-based antivirus and forensic tools that rely on static analysis of the binary on disk.

Answer

Log wiping

Answer

Encryption

Answer

Timestomping

Question 7

During static analysis of a PE file, an analyst uses PEiD and detects the signature 'UPX 0.89.6 - 1.02 / 1.05 - 1.24'. What should the analyst do next?

Accepted Answer

Unpack the file using a UPX unpacker or manual unpacking. The signature 'UPX 0.89.6 - 1.02 / 1.05 - 1.24' indicates the file is packed with UPX (Ultimate Packer for eXecutables). Packing is a common technique used by malware authors to obfuscate the original code and evade signature-based detection. The analyst must unpack the file using a UPX unpacker or manual unpacking to reveal the actual executable code for further static or dynamic analysis.

Answer

The file is clean; no further analysis needed

Answer

Delete the file as it is definitely malware

Answer

Run the file in a sandbox immediately

Question 8

A forensic investigator uses FTK Imager to create a forensic image of a suspect's laptop. The acquisition generates both an E01 file and a corresponding hash file. Which statement accurately describes the integrity verification process in FTK Imager?

Accepted Answer

The image file includes embedded hash values that can be verified later to ensure data integrity. FTK Imager embeds hash values (MD5 and SHA1) directly into the E01 file during acquisition. These embedded hashes can be verified later by FTK Imager or compatible tools to confirm that the image has not been altered, ensuring data integrity without relying on an external hash file.

Answer

The hash is computed only when the image is mounted for analysis, not during acquisition

Answer

FTK Imager does not support hash verification; a separate tool must be used

Answer

The hash is compared to a known-good hash from the manufacturer's database

Question 9

During a forensic examination of a macOS system, you find a file at /private/var/log/system.log and also notice a directory /private/var/db/diagnostics/. What is the significance of these locations?

Accepted Answer

The diagnostics directory contains binary log data from the unified logging system. /private/var/db/diagnostics/ stores binary log data from Apple's unified logging system (os_log), which is the primary logging mechanism in macOS since Yosemite. Unlike the plain-text /private/var/log/system.log, these binary logs capture high-fidelity, structured diagnostic data that can be queried using the `log` command (e.g., `log show --archive`). This directory is critical for forensic analysis of system events, crashes, and performance issues.

Answer

They are both plain-text log files used for system monitoring

Answer

The diagnostics directory contains compressed archives of system.log

Answer

These locations are remnants of third-party security software

Question 10

Which Wireshark filter should an analyst use to display only TCP packets that have the SYN flag set and the ACK flag not set?

Accepted Answer

tcp.flags.syn == 1 and tcp.flags.ack == 0. The filter `tcp.flags.syn == 1 and tcp.flags.ack == 0` uses the logical AND operator to require that the SYN flag is set (value 1) and the ACK flag is not set (value 0). This precisely matches the condition for a TCP SYN packet that is not part of a SYN-ACK handshake response, which is exactly what the analyst needs to isolate.

Answer

tcp.flags.syn == 1 or tcp.flags.ack == 0

Answer

tcp.flags.syn == 1

Answer

tcp.flags == 0x002

Question 11

During an iOS forensic examination, an analyst extracts the iTunes backup of a suspect iPhone. The analyst wants to review deleted SMS messages. Which SQLite database file should be examined?

Accepted Answer

SMS.db. In iOS forensics, deleted SMS messages are stored in the SMS.db SQLite database located within the iTunes backup. This database contains the `message` table, which retains deleted messages until overwritten by new data, making it the primary target for recovering deleted iMessages and SMS texts.

Answer

AddressBook.db

Answer

Keyboard.db

Answer

call_history.db

Question 12

An investigator needs to analyze the contents of the Windows Recycle Bin on a system running Windows 10. Which artifact(s) should the investigator examine to determine the original location and deletion time of a file in the Recycle Bin?

Accepted Answer

The '$I' and '$R' files in the $Recycle.Bin\<SID> folder. In Windows 10, the Recycle Bin is implemented as the `$Recycle.Bin` folder, with each user having a subfolder identified by their Security Identifier (SID). When a file is deleted, it is renamed to an `$R` file (the actual data) and an `$I` file (metadata including original path and deletion timestamp) is created. Examining these `$I` and `$R` files allows the investigator to determine the original location and deletion time of the file.

Answer

The 'System Volume Information' folder

Answer

The 'INFO2' file in the Recycled folder

Answer

The 'desktop.ini' file in the Recycle Bin

Question 13

A security analyst responds to a suspected data breach. The analyst documents the scene, photographs the computer, and labels the cables. Which phase of the forensic investigation process is being performed?

Accepted Answer

First response. The actions described—documenting the scene, photographing the computer, and labeling cables—are part of the First Response phase. This phase occurs immediately after an incident is detected and focuses on preserving the integrity of the scene and evidence before any collection or analysis begins. In the CHFI methodology, First Response includes securing the area, creating a detailed log of the initial state, and ensuring no unauthorized changes occur.

Answer

Collection

Answer

Examination

Answer

Reporting

Question 14

A security analyst reviews Apache access logs and finds the following entry: `192.168.1.10 - - [12/Jul/2024:10:15:30 -0400] "GET /search.php?q=1' UNION SELECT username,password FROM users-- HTTP/1.1" 200 5321 "-" "Mozilla/5.0"`. Which attack technique is most likely being attempted?

Accepted Answer

SQL injection. The log entry shows a GET request to `/search.php?q=1' UNION SELECT username,password FROM users--`. The single quote (`'`) breaks out of the SQL string context, and the `UNION SELECT` clause attempts to retrieve data from the `users` table. This is a classic SQL injection (SQLi) attack targeting the backend database, as the injected SQL syntax is designed to manipulate the query executed by the application.

Answer

Remote file inclusion

Answer

Cross-site scripting (XSS)

Answer

Directory traversal

Question 15

An analyst runs 'dcfldd if=/dev/sdb of=/evidence/disk.dd hash=sha256 hashlog=/evidence/hash.log' on a Linux system. What is the primary advantage of using dcfldd over plain dd for forensic imaging?

Accepted Answer

It can compute hashes on-the-fly and log them. D is correct because dcfldd is a specialized forensic version of dd that can compute cryptographic hashes (e.g., SHA-256) on-the-fly while writing the image, and log those hashes to a separate file (hashlog). This ensures data integrity verification without requiring a separate post-imaging hashing pass, which is a critical requirement in forensic imaging to prove the acquired image is an exact bit-for-bit copy of the source.

Answer

It can acquire memory dumps from live systems

Answer

It supports compression of the output image

Answer

It automatically creates a write-blocked connection