CHFI Practice Exam 2 — 20 Questions

Question 1

An expert witness is preparing to testify in a computer forensics case. Which of the following is a key requirement for the expert's testimony to be admissible under the Daubert standard?

Accepted Answer

The expert's techniques must be based on reliable principles and methods. Under the Daubert standard, the admissibility of expert testimony hinges on whether the expert's techniques are based on reliable principles and methods, not merely on general acceptance. This standard, established in Daubert v. Merrell Dow Pharmaceuticals, requires the trial judge to act as a gatekeeper, evaluating the scientific validity and reliability of the methodology used. In computer forensics, this means the expert must demonstrate that their acquisition, preservation, and analysis methods (e.g., using write-blockers, cryptographic hashing like SHA-256, and chain-of-custody documentation) are scientifically sound and consistently applied.

Answer

The expert's methods must be generally accepted in the scientific community

Answer

The expert must have personally examined all evidence

Answer

The expert must have a law degree

Question 2

During a forensic investigation, you need to acquire the RAM of a running Linux system. Which tool is specifically designed for memory acquisition on Linux?

Accepted Answer

LiME. LiME (Linux Memory Extractor) is the correct tool because it is specifically designed to capture volatile memory (RAM) from Linux systems, loading as a loadable kernel module (LKM) to dump memory contents to a file or over the network. Unlike generic tools, LiME handles kernel address space layout randomization (KASLR) and can acquire memory without altering the system state, making it the standard for Linux forensic memory acquisition.

Answer

Memdump

Answer

Volatility

Answer

WinPmem

Question 3

A security analyst reviewing Windows Security Event Logs sees multiple Event ID 4625 entries for a single user account, followed by a successful Event ID 4624. The account is a domain administrator. What is the MOST likely explanation?

Accepted Answer

An attacker performed a brute-force password attack and succeeded. Event ID 4625 indicates a failed logon attempt, while Event ID 4624 indicates a successful logon. A sequence of multiple 4625 events for the same domain administrator account followed by a single 4624 event is the classic signature of a successful brute-force password attack, where an attacker systematically tries passwords until one works. The fact that the account is a domain administrator makes it a high-value target, and the pattern of failures then success is inconsistent with simple user error or misconfiguration.

Answer

The user typed their password incorrectly several times before succeeding

Answer

The system experienced a denial of service attack

Answer

A misconfigured application caused repeated logon attempts

Question 4

During a Windows forensic investigation, an analyst finds prefetch files with the .pf extension. Which TWO pieces of information can the analyst obtain from analyzing prefetch files?

Accepted Answer

The number of times the application has been executed. Prefetch files in Windows store execution count and timestamps of application launches. The .pf file header contains a run count field that increments each time the application is executed, and the file also records up to eight previous execution timestamps. This allows the analyst to determine how many times the application was run and the exact date and time of each execution, making A and B correct.

Answer

The username that executed the application

Answer

The command-line arguments used to launch the program

Answer

The IP addresses the application connected to

Question 5

Which THREE of the following are types of slack space that can contain hidden data on a hard disk?

Accepted Answer

File slack. File slack (C) is correct because it refers to the unused space between the end of a file's data and the end of the allocated cluster. This area can contain remnants of previous file data or intentionally hidden data, and is a standard forensic artifact in file system analysis (e.g., NTFS or FAT).

Answer

Device Configuration Overlay

Answer

Host Protected Area

Question 6

Which TWO Windows Event IDs are associated with successful logon or explicit credential usage? (Choose TWO.)

Accepted Answer

4648. Event ID 4648 is logged when a user attempts to log on using explicit credentials, such as running a program as a different user or using the 'runas' command. Event ID 4624 is logged for every successful local or remote logon session, including interactive, network, and service logons. Both are standard Windows Security log events used in forensic analysis to track authentication activity.

Answer

4720

Answer

4625

Answer

7045

Question 7

In mobile forensics, which acquisition method preserves the highest level of data integrity and captures the most data from an iOS device?

Accepted Answer

Physical acquisition. Physical acquisition is correct because it creates a bit-for-bit copy of the entire flash storage, including unallocated space, deleted files, and system partitions. This method bypasses the iOS file system abstraction, preserving the highest data integrity and capturing all recoverable data, unlike higher-level acquisitions that only retrieve accessible files.

Answer

File system acquisition

Answer

Logical acquisition

Answer

Manual acquisition

Question 8

During a forensic analysis of an NTFS volume, an investigator finds a file that appears to be hidden. Which NTFS feature allows data to be stored in a file without affecting the file's visible size in the directory listing?

Accepted Answer

Alternate Data Streams (ADS). Alternate Data Streams (ADS) allow additional data to be attached to a file on an NTFS volume without altering the file's main data stream or its visible size in directory listings. This is possible because NTFS organizes file data into multiple streams; the default $DATA stream holds the visible content, while additional named streams can store hidden data. Tools like `dir` or Windows Explorer only report the size of the unnamed $DATA stream, making ADS an effective method for concealing data.

Answer

Volume Shadow Copy

Answer

USN Journal

Answer

Master File Table ($MFT)

Question 9

You are a forensic analyst investigating a suspected malware infection on a Windows 10 workstation. The user reports that the system has been slow and that unexpected pop-ups appear. You have acquired a memory dump and a disk image. During analysis, you find a suspicious process named 'svch0st.exe' running with PID 4567. The process has loaded several DLLs, including 'wininet.dll' and 'ws2_32.dll'. You also find that the process has an active TCP connection to an external IP address 203.0.113.5 on port 4444. In the disk image, you find an executable file at C:\Users\Public\svch0st.exe with a creation date that matches the start of symptoms. The file's hash is not in any known malware database. You decide to perform dynamic analysis by running the file in a sandbox. However, the sandbox environment has no network connectivity. The executable runs but does not exhibit any malicious behavior. What should you do next to determine if the file is malicious?

Accepted Answer

Re-run the sample in a sandbox with simulated network connectivity or a controlled network to observe C2 communication. The sandbox lacked network connectivity, which prevented the malware from reaching its command-and-control (C2) server. Many malware samples, especially those using HTTP or raw TCP for C2, will remain dormant or exhibit no malicious behavior when they cannot connect to the external IP. By providing simulated or controlled network connectivity, you can trigger the malicious payload and observe the actual C2 communication, confirming the file's intent.

Answer

Conduct a thorough static analysis using a disassembler and debugger to understand the code

Answer

Delete the suspicious file and run a full antivirus scan on the system

Answer

Perform a forensic imaging of the system again and compare with the original image

Question 10

During an investigation, an analyst recovers a file from unallocated space that contains fragments of a deleted document. The file size is 512 bytes, but the cluster size of the volume is 4096 bytes. What is the term for the unused bytes between the end of the file and the end of the last cluster?

Accepted Answer

File slack. File slack refers to the unused bytes between the end of a file and the end of the last cluster allocated to that file. In this scenario, the file is 512 bytes but resides in a 4096-byte cluster, leaving 3584 bytes of slack space. This area can contain remnants of previously deleted data or metadata, making it a critical forensic artifact.

Answer

Volume slack

Answer

Drive slack

Answer

RAM slack

Question 11

An incident responder analyzes a compromised system and finds evidence of timestomping: the Modified timestamp of a malicious DLL is earlier than the Creation timestamp. Additionally, the DLL is encrypted with an XOR key. Which anti-forensic techniques are being employed?

Accepted Answer

Timestomping and obfuscation. Timestomping is confirmed because the Modified timestamp (which tracks file content changes) is earlier than the Creation timestamp, which is logically impossible under normal file system operations—this indicates an attacker deliberately set the Modified timestamp backward to evade timeline analysis. The XOR encryption of the DLL is a form of obfuscation, a technique used to hide the true content of the file from static analysis tools and signature-based detection. Together, these two actions represent the anti-forensic techniques of timestomping and obfuscation.

Answer

Packer and anti-debugging

Answer

Rootkit installation and process hiding

Answer

Log wiping and data hiding

Question 12

An email forensic analyst receives a suspicious email and wants to trace its origin. Which email header field provides the most reliable information about the IP address of the sending SMTP server?

Accepted Answer

Received. The 'Received' header is the most reliable source for tracing the origin of an email because each SMTP server that handles the message adds a new 'Received' header at the top, recording the IP address of the sending server (from the HELO/EHLO handshake) and the receiving server. The bottommost 'Received' header typically contains the IP address of the original sending SMTP server, as it is added by the first receiving MTA. This field is standardized in RFC 5321 and is the primary forensic artifact for email source identification.

Answer

Return-Path

Answer

DKIM-Signature

Answer

X-Originating-IP

Question 13

During a forensic investigation, the analyst needs to verify the integrity of a forensic image. The analyst originally computed MD5 and SHA-1 hashes of the source drive. Which action BEST ensures the image has not been altered?

Accepted Answer

Recompute MD5 and SHA-1 hashes of the image and compare with the original. Recomputing the MD5 and SHA-1 hashes of the forensic image and comparing them to the original values is the definitive method to verify integrity. Hash functions produce a fixed-size digest that changes completely if even a single bit of the image is altered, providing cryptographic assurance that the image is an exact bit-for-bit copy of the source drive. This process directly validates data integrity, which is a core requirement in forensic acquisition.

Answer

Check that the image was created using a write blocker

Answer

Compare the file size of the image with the original drive's capacity

Answer

Open the image in FTK Imager and browse a few files

Question 14

You are imaging a suspect's hard drive using a write blocker and dd command. After imaging, you verify the hash of the original drive and the image file. The original drive hash is SHA1: A1B2C3D4E5..., and the image hash is SHA1: F6G7H8I9J0... What is the most likely cause of the mismatch?

Accepted Answer

The write blocker malfunctioned and allowed writes to the original drive. The hash mismatch indicates that the data on the original drive and the image file are not identical. A write blocker malfunction that allowed writes to the original drive during the imaging process would alter the source data after the initial hash was computed, causing the final hash of the original drive to differ from the hash of the image file taken at a different point in time. This is the most direct cause of a hash mismatch because the write blocker's primary purpose is to prevent any modification to the evidence.

Answer

The dd command used a different block size

Answer

The dd command compressed the output

Answer

The image file was corrupted during transfer

Question 15

During a forensic investigation of a hard disk, the investigator finds that the partition table is missing. The disk was previously partitioned using GPT. Which area of the disk should be examined to recover the GPT partition table?

Accepted Answer

LBA 1 (sector 1). In GPT (GUID Partition Table) disks, the primary partition table is stored in LBA 1 (sector 1), immediately following the protective MBR at LBA 0. When the partition table is missing, examining LBA 1 allows recovery of the GPT header, which contains pointers to the partition entry array. This is the correct location because GPT uses LBA 1 for its header, not the last sector or the MBR.

Answer

Last sector of the disk

Answer

Volume boot record

Answer

Master Boot Record (LBA 0)

Question 16

A forensic analyst receives a mobile device that has been factory reset. Which of the following types of data is MOST likely to be recoverable using advanced forensic techniques?

Accepted Answer

Google account tokens and cached credentials. A factory reset typically does not overwrite the flash memory where Google account tokens and cached credentials are stored. Advanced forensic techniques, such as chip-off or JTAG, can recover these remnants from the NAND flash memory, as the reset only marks the storage blocks as available for reuse without physically erasing the data.

Answer

Deleted text messages and call logs, but not app data

Answer

All user data, as factory reset only deletes file pointers

Answer

No data is recoverable after a factory reset on modern devices

Question 17

During a mobile forensics investigation, an examiner needs to acquire data from an iPhone running iOS 14. Which of the following acquisition methods provides the MOST complete data extraction?

Accepted Answer

Physical acquisition via JTAG or chip-off. Physical acquisition via JTAG or chip-off provides the most complete data extraction because it captures a bit-for-bit copy of the raw NAND flash memory, including deleted files, unallocated space, and system partitions that are otherwise inaccessible. On iOS 14, Apple's security features (e.g., full-disk encryption, SEP) limit logical and file system methods, but physical techniques bypass the operating system to retrieve the entire storage image, albeit with decryption challenges.

Answer

File system acquisition via jailbreak

Answer

Manual acquisition by browsing the device

Answer

Logical acquisition via iTunes backup

Question 18

In network forensics, an analyst captures traffic and sees a large number of ICMP echo requests from 10.0.0.1 to 10.0.0.2 with varying payload sizes. What is the most likely scenario?

Accepted Answer

A DoS attack using ICMP floods. The scenario describes a single source sending a large number of ICMP echo requests to a single destination with varying payload sizes. This is characteristic of an ICMP flood attack, a type of DoS attack where the attacker overwhelms the target with echo requests, consuming bandwidth and processing resources. The varying payload sizes may be an attempt to evade simple packet filters or to maximize resource consumption. In contrast, a ping sweep would involve sending requests to multiple destinations to discover live hosts, not a sustained high-volume stream to one host. Therefore, this is most likely a DoS attack, not reconnaissance.

Answer

Network reconnaissance (ping sweep)

Answer

A man-in-the-middle attack

Answer

A DNS amplification attack

Question 19

An analyst discovers a hidden partition on a hard drive that does not appear in the standard MBR partition table. The drive uses GPT partitioning. Which area of the disk should be examined to find evidence of a hidden partition?

Accepted Answer

The GPT header and partition entry array located after the protective MBR. In GPT partitioning, the protective MBR in sector 0 only contains a single partition entry of type 0xEE to prevent legacy tools from misinterpreting the disk. The actual partition information, including any hidden partitions, is stored in the GPT header (typically in sector 1) and the partition entry array that follows. Therefore, examining the GPT header and partition entry array is necessary to detect partitions not visible in the MBR.

Answer

The Master Boot Record (MBR) in sector 0

Answer

The Volume Boot Record (VBR) of the C: drive

Answer

The Host Protected Area (HPA) at the end of the disk

Question 20

During a forensic examination of a Windows system, an analyst finds a file that appears to be zero bytes in size when viewed in Windows Explorer, but the file's properties show a size on disk of 4 KB. What is the most likely explanation?

Accepted Answer

The file is stored in an alternate data stream (ADS). An alternate data stream (ADS) allows additional data to be stored with a file in NTFS. Windows Explorer typically displays only the size of the main file stream, not the ADS. Therefore, a file with a zero-byte main stream but an ADS containing data will show a logical size of 0 bytes, while the 'size on disk' reflects the allocated clusters for the ADS data (e.g., 4 KB). This is a common technique used to hide data.

Answer

The file contains only slack space

Answer

The file is compressed using NTFS compression

Answer

The file is a sparse file