CHFI Practice Exam 3 — 20 Questions

Question 1

An analyst retrieves a forensic image of a hard drive and discovers that the size reported by the operating system is smaller than the actual physical capacity. The extra space is not accessible through standard partition tools. This hidden area is MOST likely:

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Host Protected Area. The Host Protected Area (HPA) is a region on a hard drive that is hidden from the operating system by using the ATA SET MAX ADDRESS command to reduce the reported capacity. This area is not accessible through standard partition tools because the OS sees only the reduced address space, making it ideal for storing forensic or diagnostic data. The analyst's observation of a smaller reported size than physical capacity directly matches HPA behavior.

Answer

Device Configuration Overlay

Answer

Volume slack

Answer

RAM slack

Question 2

During a forensic investigation of a Google Cloud Platform (GCP) environment, an analyst reviews Audit Logs and sees a log entry with the method 'storage.objects.list' and a principal email 'attacker@gmail.com'. However, the identity is not from the organization's domain. What should the analyst conclude?

Accepted Answer

An external identity was granted IAM permissions on the bucket, possibly through a misconfigured resource.. In GCP, Audit Logs record the actual identity used to authenticate the API call. The presence of 'attacker@gmail.com' as the principal email indicates that an external Google account (not part of the organization's domain) was granted IAM permissions on the bucket, likely through a misconfigured resource policy (e.g., a bucket-level IAM policy that allows allUsers or a specific external user). This is a common cloud security misconfiguration where overly permissive IAM bindings are applied.

Answer

The analyst must immediately shut down the bucket.

Answer

The attacker spoofed the principal email in the log.

Answer

The log entry is a false positive due to a logging error.

Question 3

An analyst is examining a USB drive that appears to have a smaller capacity than expected. The drive is detected as 8 GB but only 7 GB is accessible. Which of the following is the most likely cause?

Accepted Answer

The drive has a Host Protected Area (HPA) hiding 1 GB. The difference between detected capacity (8 GB) and accessible space (7 GB) is most likely due to a Host Protected Area (HPA). HPA uses the ATA SET MAX ADDRESS command to reduce the total capacity reported by the drive, effectively hiding 1 GB from the operating system. A hidden partition does not change the total reported capacity; it only makes a portion of the space inaccessible by not assigning a drive letter. Therefore, only HPA directly reduces the total capacity, making option C the most likely cause.

Answer

The file system uses a cluster size that wastes space

Answer

The drive is formatted with FAT32 which has a 4 GB file size limit

Answer

The drive contains a hidden partition

Question 4

During a forensic examination of a solid-state drive (SSD), you notice that files deleted several months ago cannot be recovered using traditional file carving tools. Which SSD feature is MOST likely preventing recovery?

Accepted Answer

TRIM. The TRIM command (ATA Data Set Management command) allows the operating system to inform the SSD which data blocks are no longer in use. When TRIM is enabled, the SSD's controller immediately erases those blocks internally, making the original file data unrecoverable by file carving tools because the physical NAND cells are zeroed or marked as invalid. For files deleted months ago, TRIM would have already been issued for those LBAs, so traditional carving that relies on residual data in unallocated space fails.

Answer

Over-provisioning

Answer

Garbage Collection

Answer

Wear levelling

Question 5

An Android device is seized as evidence. The screen is locked with a PIN. Which tool or method is MOST appropriate for acquiring a physical image of the device without bypassing the lock screen, assuming the device is rooted?

Accepted Answer

Boot into recovery mode and use ADB to dd the userdata partition. Booting into recovery mode on a rooted Android device allows you to use ADB to execute the `dd` command, which can create a bit-for-bit physical image of the userdata partition without needing to bypass the lock screen. Since the device is rooted, you have the necessary privileges to read the raw block device, and recovery mode ensures the filesystem is not mounted, preventing data corruption during acquisition.

Answer

Use Cellebrite UFED with a lock screen bypass exploit

Answer

Remove the microSD card and image it separately

Answer

Perform an ADB backup to obtain app data only

Question 6

An Android forensic analyst connects a suspect device to their workstation and issues the command "adb backup -apk -shared -all -f backup.ab". Which type of acquisition is being performed?

Accepted Answer

Logical acquisition via ADB backup. The command `adb backup -apk -shared -all -f backup.ab` creates a full Android backup via the Android Debug Bridge (ADB) protocol. This is a logical acquisition because it requests user data and installed APKs through the high-level backup service, not a bit-for-bit copy of the storage. The resulting `.ab` file is an Android Backup archive, which contains files and directories that the device’s backup manager chooses to export, making it a logical extraction.

Answer

Manual acquisition through device UI

Answer

Physical acquisition via JTAG

Answer

File system acquisition via dd

Question 7

You are a forensic investigator responding to a data breach at a financial institution. The compromised server is a Windows Server 2019 running a custom trading application. The server is still powered on and connected to the production network. The incident response team has instructed you to acquire forensic evidence while minimizing downtime. The server has 2 TB of storage with 500 GB used. You have a forensic workstation with a write-blocker and an empty 2 TB external drive. The server's RAM is 64 GB. You need to acquire both volatile data (RAM) and a forensic image of the disk. However, the legal team requires a verified bit-for-bit copy with cryptographic hash verification. Additionally, the server's performance is critical; acquiring RAM via network is not feasible due to bandwidth constraints. Which of the following is the best course of action?

Accepted Answer

Run win32dd locally to capture RAM to the external drive, then use FTK Imager over the network to create a physical disk image with verification.. It prioritizes capturing volatile RAM first using win32dd (a memory acquisition tool) locally to the external drive, which preserves the most volatile evidence before any shutdown or network transfer. After RAM capture, FTK Imager over the network creates a verified physical disk image, satisfying the legal requirement for cryptographic hash verification while minimizing downtime. This approach avoids the risk of losing RAM data (as in shutdown) and avoids bandwidth constraints (as in network RAM acquisition).

Answer

Shut down the server, remove the disk, connect it to a write-blocker, and acquire the disk image using FTK Imager; RAM is lost but disk acquisition is verified.

Answer

Use FTK Imager over the network to acquire RAM first, then use dd to image the disk to the external drive via write-blocker.

Answer

Use dd over netcat to acquire RAM and disk simultaneously, then compute hashes separately.

Question 8

You are a first responder for a medium-sized enterprise. The Help Desk received multiple reports that users cannot access the company's internal web application (app.example.com) hosted on a Windows Server 2019 VM. The server is also running a MySQL database and an FTP service for file transfers. You remote into the server and find that the web server (IIS) is still running, but the application pool is stopped. The event logs show multiple failed logon attempts from an external IP address (198.51.100.23) for the local administrator account around the time the issues started. The FTP service log shows successful anonymous logins from the same IP minutes before the web app failure. The MySQL log shows a query 'DROP TABLE users;' executed at 03:15 AM. The current time is 04:00 AM. What immediate action should you take?

Accepted Answer

Capture a memory dump of the server, then disconnect the network cable, and then image the hard drive.. The server is actively compromised — the attacker gained access via anonymous FTP, executed a destructive SQL query, and performed lateral movement. Capturing a memory dump preserves volatile evidence (e.g., running processes, network connections, and in-memory malware), disconnecting the network cable prevents further data exfiltration or remote control, and imaging the hard drive captures persistent evidence. This follows the CHFI first responder priority: preserve volatile data first, then isolate, then acquire non-volatile evidence.

Answer

Disconnect the server from the network and then restore the database from the last clean backup.

Answer

Immediately shut down the server to prevent further damage and then create a forensic image of the hard drive.

Answer

Run a full antivirus scan, then try to restart the application pool to restore service quickly.

Question 9

An Android phone is seized, and the forensic examiner needs to acquire the device in a forensically sound manner. The phone is running Android 12 and has USB debugging enabled. Which acquisition method provides the most complete data without physically modifying the device?

Accepted Answer

Physical acquisition via ADB with appropriate exploit. Physical acquisition via ADB with an appropriate exploit allows the examiner to obtain a complete bit-for-bit copy of the device's flash memory, including deleted data and unallocated space, without physically modifying the device. Since Android 12 has USB debugging enabled, ADB can be used to push an exploit that bypasses security restrictions to perform a physical dump, which is the most comprehensive method available for this scenario.

Answer

File system acquisition via Cellebrite UFED

Answer

Logical acquisition through ADB backup

Answer

Manual extraction using screen captures

Question 10

During a forensic examination of a Windows system, the investigator finds a file named 'notes.txt' that contains a list of passwords. The file's last modified timestamp is before the incident date, but its last accessed timestamp is during the incident. Which type of evidence is this file considered?

Accepted Answer

Circumstantial evidence. The file 'notes.txt' has a last modified timestamp before the incident but a last accessed timestamp during the incident. This indicates the file was opened or read during the incident, but not modified. Such indirect evidence suggests the attacker may have viewed the passwords, but does not directly prove the act of using them. Therefore, it is circumstantial evidence because it requires inference to connect the file access to the incident.

Answer

Best evidence

Answer

Hearsay evidence

Answer

Direct evidence

Question 11

A forensic analyst is examining an Android device that was factory reset before seizure. Which Google account artefacts are MOST likely still recoverable from the device's storage?

Accepted Answer

Google account authentication tokens and cached account data. Factory reset on Android typically wipes user data partitions (e.g., /data) but does not securely overwrite the entire flash storage. Google account authentication tokens (e.g., OAuth 2.0 tokens) and cached account data (e.g., account names, sync settings) are often stored in system-level databases or encrypted key stores that may persist in unallocated or residual flash blocks, especially if TRIM or secure erase was not executed. These artefacts can be recovered via forensic imaging and carving of the raw NAND or eMMC.

Answer

All installed application APK files

Answer

Full SMS message history

Answer

Encryption keys for user data partition

Question 12

You are a forensic investigator responding to an incident at a financial institution. The organization uses Microsoft SQL Server 2016 for its transaction processing system. The database is configured with full recovery model and transaction log backups are taken every 15 minutes. The incident response team has identified that an attacker gained access to the database server via compromised credentials and executed a series of malicious SQL statements, including data exfiltration and deletion of critical records. The time of the attack is estimated to be between 2:00 PM and 2:05 PM. The last full backup was taken at 12:00 AM (midnight) the same day. Transaction log backups are available for the entire day. The last transaction log backup before the attack was taken at 1:45 PM. The next transaction log backup after the attack was taken at 2:15 PM. The database is still online and being used by the business. Management wants to recover the database to a point just before the attack (2:00 PM) to minimize data loss, while preserving evidence for investigation. Which of the following actions should you take FIRST?

Accepted Answer

Perform a tail-log backup of the database using the NORECOVERY option to capture all transactions since the last log backup.. Performing a tail-log backup with NORECOVERY captures all transactions committed after the last log backup (1:45 PM) up to the current point in time, including the attack period. This preserves the database in a restoring state, preventing further changes while allowing point-in-time recovery to just before 2:00 PM. It is the mandatory first step to minimize data loss and maintain forensic integrity before any restore operations.

Answer

Immediately restore the full backup from midnight and all transaction log backups up to 1:45 PM to a separate server for forensic analysis.

Answer

Shut down the SQL Server service to prevent further changes and then restore the database from backup.

Answer

Restore the database to a point in time using the full backup and all transaction log backups up to 1:45 PM, then apply the 2:15 PM backup to recover lost data.

Question 13

Which of the following email authentication protocols uses a digital signature to verify the sender's domain and that the email has not been tampered with?

Accepted Answer

DKIM. DKIM (DomainKeys Identified Mail) is the correct answer because it uses a digital signature (an encrypted hash) added to the email header, which is verified against a public key published in the sender's DNS TXT record. This cryptographic process confirms that the email originated from the claimed domain and that the message body and key headers have not been altered in transit, ensuring integrity and authenticity.

Answer

DMARC

Answer

SPF

Answer

STARTTLS

Question 14

Which tool is specifically designed for file carving and can recover files based on headers and footers without relying on file system metadata?

Accepted Answer

Foremost. Foremost is a file carving tool that recovers files by scanning raw data for known header and footer signatures, such as JPEG headers (0xFFD8) and footers (0xFFD9), without relying on file system metadata like MFT entries or inodes. This makes it ideal for data recovery from damaged or formatted volumes where the file system structure is unavailable.

Answer

FTK Imager

Answer

Autopsy

Answer

Volatility

Question 15

A forensic investigator is required to testify in court about the findings of a digital investigation. Which of the following roles does the investigator fulfill?

Accepted Answer

Expert witness. A is correct because a forensic investigator who testifies about their analysis and conclusions—such as interpreting file system artifacts, registry data, or network logs—qualifies as an expert witness under Federal Rule of Evidence 702. The investigator’s testimony goes beyond mere fact recitation; it applies specialized knowledge, training, and experience to form opinions about the digital evidence, which is the hallmark of an expert witness.

Answer

Lay witness

Answer

Character witness

Answer

Fact witness

Question 16

During a forensic investigation, an analyst uses a tool to create a bit-for-bit copy of a hard drive while ensuring the original is not modified. Which of the following is a hardware write blocker that can be used for this purpose?

Accepted Answer

Tableau. A hardware write blocker physically prevents any write commands from reaching the original drive at the SATA/IDE bus level, ensuring the drive remains unaltered during acquisition. Tableau is a well-known manufacturer of forensic hardware write blockers that operate transparently to the imaging software, making it the correct choice for a hardware-based solution.

Answer

FTK Imager

Answer

dd

Answer

EnCase

Question 17

During a forensic investigation, an analyst uses the following command: dd if=/dev/sda of=/mnt/evidence/image.dd bs=4096 conv=noerror,sync. What is the effect of the conv=noerror,sync option?

Accepted Answer

It ignores read errors and pads bad blocks with zeros in the output image. The `conv=noerror,sync` option in `dd` instructs the tool to continue processing even when a read error is encountered (`noerror`) and to pad the output block with zeros (`sync`) to maintain the correct block size and offset alignment. This ensures that the forensic image remains a bit-for-bit copy of the source device in terms of size and structure, with corrupted sectors replaced by zeros rather than causing the imaging process to abort or produce a truncated image.

Answer

It verifies the integrity of the image using a hash algorithm

Answer

It creates a compressed image to save disk space

Answer

It enables logging of all I/O errors to a separate file

Question 18

During a malware analysis, an analyst runs a suspicious executable in a Cuckoo Sandbox and observes that the process creates a mutex named 'Global\XPSS-1.0.0' and writes a registry key under HKCU\Software\Microsoft\Windows\CurrentVersion\Run. What do these actions MOST likely indicate?

Accepted Answer

The malware is establishing persistence and ensuring only one instance of itself runs.. The mutex 'Global\XPSS-1.0.0' is used to prevent multiple instances of the malware from running simultaneously, which is a common anti-analysis and stability technique. Writing a registry key under HKCU\Software\Microsoft\Windows\CurrentVersion\Run is a standard method for achieving persistence, ensuring the malware executes automatically at user logon. Together, these actions directly indicate persistence and single-instance control, not privilege escalation, C2 communication, or hiding.

Answer

The malware is performing privilege escalation by exploiting a known vulnerability.

Answer

The malware is communicating with a command-and-control server to receive further instructions.

Answer

The malware is attempting to hide its presence by using a system mutex name and a legitimate registry location.

Question 19

A security analyst is reviewing firewall logs and notices repeated connection attempts from an internal IP to an external server on TCP port 4444. The internal host is a web server. What is the MOST likely explanation?

Accepted Answer

The web server has a reverse shell connection to a command-and-control server. Repeated outbound connections from an internal web server to an external server on TCP port 4444 strongly indicate a reverse shell, which is a common technique used by malware to establish command-and-control (C2) communication. Unlike a standard client-server model, the internal host initiates the connection to bypass firewalls that block inbound traffic, and port 4444 is frequently associated with Metasploit's default reverse shell payload (e.g., meterpreter). This behavior is anomalous for a web server, which typically serves HTTP/HTTPS on ports 80/443 and does not initiate persistent outbound connections to arbitrary external IPs on non-standard ports.

Answer

The web server is serving HTTPS traffic on port 4444

Answer

The web server is performing DNS queries

Answer

The web server is being scanned for open ports

Question 20

An analyst executed the commands shown in the exhibit on a Windows system to prepare a forensic image for analysis. What is the most likely reason for the error message from e2fsck?

Accepted Answer

The analyst failed to properly dismount the source volume before imaging, leading to filesystem inconsistencies.. The error message from e2fsck indicates that the filesystem has inconsistencies, which typically occur when a volume is imaged while it is still mounted and actively being written to. The analyst likely did not dismount the source volume before acquiring the forensic image, resulting in a snapshot that reflects an inconsistent state (e.g., dirty journal, unflushed writes). This is a common chain-of-custody and acquisition procedure error in forensic imaging.

Answer

The forensic image was not acquired with a write-blocker, causing data corruption.

Answer

The image file contains an NTFS filesystem, but e2fsck is designed for ext filesystems.

Answer

The e2fsck command syntax is incorrect; it should be 'e2fsck -f -n' instead.