CHFI Practice Exam 4 — 20 Questions

Question 1

In an investigation of a Windows system, the analyst uses Volatility's 'netscan' plugin and identifies a suspicious outbound connection to an IP address on port 4444. Which of the following is the most likely associated malicious activity?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Reverse shell connection from a backdoor. Port 4444 is the default port for the Metasploit Meterpreter reverse TCP payload. A Volatility netscan result showing an outbound connection to this port strongly indicates a reverse shell, where the compromised system initiates a connection back to an attacker's listener to bypass firewalls. This is a classic backdoor behavior, not a standard service.

Answer

DNS tunneling exfiltration

Answer

HTTP data exfiltration

Answer

Remote desktop session

Question 2

During a forensic examination of an SSD, the analyst notes that TRIM is enabled. What challenge does TRIM pose for data recovery?

Accepted Answer

TRIM permanently erases deleted data at the block level, hindering recovery. TRIM is an ATA command that allows the operating system to inform the SSD which data blocks are no longer in use. When TRIM is enabled, the SSD's garbage collection process immediately erases these blocks at the physical level, making the data permanently unrecoverable through conventional forensic tools. This directly hinders data recovery because the deleted data is physically zeroed or marked as invalid before any forensic acquisition can occur.

Answer

TRIM reduces the lifespan of the SSD by excessive writes

Answer

TRIM compresses data, altering forensic signatures

Answer

TRIM encrypts data, preventing forensic access

Question 3

In an ext4 file system, after a file is deleted, the inode's di_mode field is set to 0 and the block pointers are cleared. However, the file content may still be recoverable until what happens?

Accepted Answer

The data blocks are overwritten by new files. When a file is deleted in ext4, the inode's di_mode is set to 0 and block pointers are cleared, but the actual data blocks on disk remain unchanged. The file content remains recoverable until those specific data blocks are overwritten by new file data, because only then is the original content physically destroyed. This is why data recovery tools can often restore deleted files if the blocks have not been reused.

Answer

The file system is unmounted

Answer

The superblock is updated

Answer

The journal is committed

Question 4

An analyst is analyzing a disk image and finds a 512-byte sector at LBA 0 that contains a bootloader and a partition table. The partition table has four entries, each 16 bytes. What type of partition table is this?

Accepted Answer

MBR. The Master Boot Record (MBR) partition table is defined by a 512-byte sector at LBA 0 that contains a bootloader (first 446 bytes) and four 16-byte partition entries (total 64 bytes), ending with a 2-byte signature (0x55AA). This matches the description exactly, making B the correct answer.

Answer

Apple Partition Map

Answer

GPT

Answer

BSD disklabel

Question 5

A security analyst examines a compromised Windows server and finds a file named 'readme.txt' that appears legitimate. However, using `dir /r`, they discover an alternate data stream named 'readme.txt:hidden.exe'. What is the most likely purpose of this alternate data stream?

Accepted Answer

It is a malicious executable hidden in the file. Alternate data streams (ADS) in NTFS allow a malicious executable to be hidden within a legitimate file without affecting its visible size or content. The `dir /r` command reveals the ADS 'readme.txt:hidden.exe', indicating that an executable is attached to the file, which is a common technique to evade detection and execute malware.

Answer

It is a backup copy of the file

Answer

It is a symbolic link to another file

Answer

It is a log file generated by the operating system

Question 6

An investigator uses the `volatility -f mem.dump netscan` command on a memory dump from a Windows 10 system. What information is this command primarily intended to reveal?

Accepted Answer

Network connections and listening ports. The `volatility -f mem.dump netscan` command is specifically designed to extract network connection artifacts from a memory dump, including active TCP/UDP connections, listening ports, and associated process identifiers (PIDs). It parses Windows network data structures such as `_TCPT_OBJECT` and `_UDP_HEADER` to reconstruct the network state at the time of acquisition, making it the correct tool for revealing network connections and listening ports.

Answer

List of running processes

Answer

File handles opened by each process

Answer

Registry hives loaded in memory

Question 7

A forensic investigator is analyzing a USB drive formatted with FAT32 and finds that a deleted file's directory entry still exists but the first character of the filename is replaced with 0xE5. What does this indicate?

Accepted Answer

The file has been deleted. In FAT32 file systems, when a file is deleted, the first byte of its directory entry's filename is replaced with the hexadecimal value 0xE5 (which displays as a lowercase sigma 'σ' in some viewers). This is the standard deletion marker for FAT file systems, indicating that the file's directory entry is available for reuse. The presence of 0xE5 in the first character position specifically signifies deletion, not any other attribute or state.

Answer

The file is marked as hidden

Answer

The file is encrypted

Answer

The file is fragmented

Question 8

An investigator is analyzing a FAT32 drive and notices that a deleted file's directory entry still exists, but the first byte of the filename is changed to 0xE5. What does this indicate about the file?

Accepted Answer

The file is marked as deleted but its data clusters may still be intact. In FAT32 file systems, a deleted file's directory entry is marked by replacing the first byte of the filename with 0xE5. This indicates the file is logically deleted, but the data clusters referenced in the directory entry remain intact until overwritten by new data. Option B is correct because the 0xE5 marker is the standard FAT deletion marker, and the clusters are not erased.

Answer

The file is fragmented

Answer

The file has been securely overwritten

Answer

The file is encrypted

Question 9

A forensic analyst is examining a Windows 10 system and needs to view the Master File Table ($MFT) to identify recently deleted files. Which tool is most appropriate for parsing the $MFT directly?

Accepted Answer

EnCase. EnCase is a forensic suite that includes a dedicated parser for the Master File Table ($MFT) on NTFS volumes. It can directly read the raw $MFT file to recover metadata of deleted files, including their names, timestamps, and data runs, even after the directory entry is removed. This makes it the correct choice for examining the $MFT to identify recently deleted files.

Answer

Wireshark

Answer

John the Ripper

Answer

Nmap

Question 10

A forensic analyst is examining a Microsoft Outlook PST file as part of an email investigation. Which tool is specifically designed to parse and analyze PST files and extract email metadata?

Accepted Answer

Aid4Mail. Aid4Mail is a forensic email analysis tool that supports PST, OST, MBOX, and other formats. It is commonly used for email investigations.

Answer

Wireshark

Answer

EmailTracker

Answer

Sleuth Kit

Question 11

Which Linux log file is the PRIMARY source for authentication-related events such as user logins, sudo usage, and failed authentication attempts?

Accepted Answer

/var/log/auth.log. /var/log/auth.log is the primary log file on Linux systems (especially Debian/Ubuntu) that records authentication-related events, including user logins (via sshd, login, su), sudo command executions, and failed authentication attempts. This log is generated by the authpriv facility in syslog and is specifically designed to capture security and authentication messages, making it the go-to source for forensic analysis of user access and privilege escalation.

Answer

/var/log/kern.log

Answer

/var/log/syslog

Answer

/var/log/boot.log

Question 12

Which of the following partition table types uses a protective MBR and a GPT header, and is recommended for disks larger than 2 TB?

Accepted Answer

GPT. GPT (GUID Partition Table) is the correct answer because it uses a protective MBR at the first sector (LBA 0) to prevent legacy tools from misidentifying the disk as unformatted, followed by the GPT header at LBA 1. This structure is specifically designed to support disks larger than 2 TB by using 64-bit logical block addresses, overcoming the 2 TB limit of MBR’s 32-bit addressing.

Answer

MBR

Answer

Dynamic disk

Answer

APM (Apple Partition Map)

Question 13

A security analyst receives an image of a hard drive with a GPT partition table. Which of the following is a key difference between GPT and MBR that the analyst should consider?

Accepted Answer

GPT uses a protective MBR to prevent legacy tools from misinterpreting the disk. GPT uses a protective MBR (Master Boot Record) at sector 0 of the disk to maintain backward compatibility with legacy BIOS-based tools that expect an MBR. This protective MBR contains a single partition entry of type 0xEE that covers the entire disk (or up to 2 TiB), preventing older utilities from misinterpreting the GPT disk as unformatted or overwriting GPT structures. This is a key architectural difference from MBR, which has no such protective mechanism.

Answer

GPT stores partition information only in the first sector of the disk

Answer

GPT supports up to 4 primary partitions; MBR supports up to 128

Answer

MBR uses a GUID partition table; GPT uses a simple table at sector 0

Question 14

Which Windows Event ID is generated when a new service is installed on a system?

Accepted Answer

7045. Event ID 7045 is logged in the Windows System event log when a new service is installed on the system. This event is generated by the Service Control Manager (SCM) and records details such as the service name, binary path, service type, and start mode, making it a critical artifact for forensic analysis of unauthorized service installations.

Answer

4624

Answer

4648

Answer

4720

Question 15

A forensic analyst is examining a USB drive formatted with FAT32. A suspect claims they deleted a file several weeks ago. The analyst uses a carving tool but cannot recover the file. What is the MOST likely reason for the failed recovery?

Accepted Answer

The file clusters were overwritten by new data. File carving relies on finding the file's content clusters on disk, typically by scanning for file headers and footers. If the suspect deleted the file weeks ago, the clusters that held the file's data were likely marked as free in the FAT32 file allocation table and subsequently overwritten by new data written to the drive. This is the most common reason for carving failure on a FAT32 volume that has been in active use after deletion.

Answer

The file was encrypted and cannot be carved

Answer

FAT32 does not support file carving

Answer

The file was stored in the MFT, which is only present in NTFS

Question 16

During a forensic analysis of a compromised Linux server, you notice that the file /var/log/auth.log has been cleared. However, you find that the attacker's commands are still partially recoverable. Which artifact most likely contains the attacker's command history?

Accepted Answer

~/.bash_history. The ~/.bash_history file stores the command history for individual user accounts, including commands executed by an attacker who gained shell access. Even if /var/log/auth.log is cleared, this file retains the attacker's command history unless explicitly deleted or truncated. This makes it a key artifact for recovering attacker activity.

Answer

/var/log/syslog

Answer

/proc/1/cmdline

Answer

/etc/shadow

Question 17

A forensic investigator analyzing a RAID 5 array of three disks notices that one disk has failed. Can the investigator still reconstruct the data?

Accepted Answer

Yes, using the parity information from the remaining disks. RAID 5 uses distributed parity across all disks in the array. When one disk fails, the data can be reconstructed by XORing the data and parity from the remaining disks. Since the parity is spread across all disks (not a dedicated parity disk), the investigator can rebuild the missing data as long as the remaining disks are functional.

Answer

No, RAID 5 requires all disks to be present

Answer

Yes, but only if the failed disk is the parity disk

Answer

No, because RAID 5 does not support hot swapping

Question 18

What is the primary difference between MBR and GPT partition tables?

Accepted Answer

GPT uses a cyclic redundancy check (CRC) for integrity; MBR does not. GPT (GUID Partition Table) uses a cyclic redundancy check (CRC32) to verify the integrity of the partition table header and entries, detecting corruption or tampering. MBR (Master Boot Record) lacks any such integrity check, making it vulnerable to undetected corruption. This CRC mechanism is a fundamental design improvement in GPT over MBR.

Answer

MBR is used only on Linux; GPT is used on Windows

Answer

MBR supports larger disks than GPT

Answer

GPT stores the partition table only in the first sector

Question 19

During a forensic investigation, an analyst recovers a hard drive that uses GPT partitioning. The analyst needs to locate the backup GPT header to verify partition table integrity. Where is the backup GPT header typically stored on the disk?

Accepted Answer

The last sector of the disk. The backup GPT header is stored in the last sector of the disk (LBA -1) to provide redundancy. If the primary GPT header in LBA 1 is corrupted, the backup can be used to reconstruct the partition table. This design ensures the GPT structure can be recovered even if the beginning of the disk is damaged.

Answer

The first sector of the last partition

Answer

Sector 0 (the MBR sector)

Answer

Sector 1 (immediately after the protective MBR)

Question 20

A network forensic analyst examines a pcap file in Wireshark and sees an HTTP POST request to '/shell.jsp' with a parameter 'cmd' containing 'dir'. The response contains a directory listing. Which intrusion artifact is indicated?

Accepted Answer

Webshell. The HTTP POST request to '/shell.jsp' with a 'cmd' parameter containing 'dir' and a response showing a directory listing is a classic indicator of a webshell. A webshell is a malicious script (e.g., JSP, ASP, PHP) uploaded to a web server that allows an attacker to execute arbitrary system commands via HTTP requests, effectively providing remote command execution. The presence of a command parameter and the server's response executing that command directly confirms the artifact is a webshell.

Answer

SQL injection

Answer

Directory traversal

Answer

Cross-site scripting (XSS)