CHFI Practice Exam 4 — 20 Questions

Question 1

A forensic analyst is reviewing the syslog from a compromised Linux server. Based on the exhibit, what does the 'orphan inode deleted' message indicate?

Accepted Answer

A file was deleted while still open, and the filesystem has cleaned up the orphan inode.. The 'orphan inode deleted' message in syslog indicates that a file was deleted while it was still open by a process. The kernel's inode cleanup mechanism (part of the VFS layer) detected the orphaned inode—an inode with no directory entry but still referenced by an open file descriptor—and removed it after the last file descriptor was closed. This is standard behavior in Linux filesystems (e.g., ext4) and is not indicative of hidden files, rootkits, or critical system file alerts.

Answer

A hidden file was permanently removed from the filesystem.

Answer

A rootkit has attempted to hide files by marking them as orphan inodes.

Answer

A critical system file has been deleted, and the filesystem is warning the administrator.

Question 2

During an iOS forensic examination of an iCloud backup, an analyst finds that the SQLite database files for the Health app are encrypted. Which component is MOST likely responsible for encrypting this data, and what is required to decrypt it?

Accepted Answer

The data is protected by iOS Data Protection using a key derived from the device passcode; decryption requires the passcode or a forensic bypass tool.. IOS Health app data is protected by iOS Data Protection, which uses a class key derived from the user's device passcode. This key encrypts the SQLite database files in iCloud backups, and decryption requires either the passcode or a forensic bypass tool that can extract the key from the device's Secure Enclave.

Answer

The data is encrypted with the device's hardware UID; decryption is impossible without Apple's assistance.

Answer

The data is encrypted using Apple's FileVault; decryption requires the user's iCloud password.

Answer

The data is encrypted using SQLCipher; decryption requires a 256-bit key stored in the Keychain.

Question 3

An investigator needs to acquire data from a suspect's hard drive without altering any data. Which tool is MOST appropriate to ensure write-blocking at the hardware level?

Accepted Answer

Tableau Forensic Bridge (hardware write-blocker). A hardware write-blocker like the Tableau Forensic Bridge sits between the suspect drive and the forensic workstation at the physical layer, intercepting and blocking any write commands (e.g., ATA WRITE DMA, SCSI WRITE) before they reach the drive. This ensures that no data—including metadata, timestamps, or file system artifacts—is altered during acquisition, which is critical for maintaining evidentiary integrity. Software-based blockers can be bypassed by the OS or a malicious driver, making hardware-level blocking the gold standard in forensic acquisition.

Answer

FTK Imager (software write-blocker)

Answer

dd command with 'iflag=noatime'

Answer

EnCase software acquisition module

Question 4

An analyst receives an alert indicating a suspicious process (PID 3342) is making outbound connections on port 443 to an unknown IP. The system is a Windows 10 workstation. Which first responder action is MOST appropriate?

Accepted Answer

Capture a full memory dump using a tool like FTK Imager (Memory Capture) or DumpIt.. Capturing a full memory dump (option A) is the most appropriate first responder action because it preserves the volatile state of the suspicious process (PID 3342) and its associated artifacts (e.g., network connections, loaded DLLs, encryption keys) before any further system changes occur. This allows forensic analysis to identify the malware's behavior, such as command-and-control (C2) communication over port 443 (HTTPS), without altering evidence. Tools like FTK Imager (Memory Capture) or DumpIt acquire a raw .mem file that can be analyzed with Volatility or Rekall to extract process details, network sockets, and injected code.

Answer

Immediately disconnect the system from the network to contain the threat.

Answer

Check the Windows Event Logs for related entries.

Answer

Reboot the system to clear any malicious processes from memory.

Question 5

During a forensic investigation, an analyst needs to preserve the integrity of evidence on a hard drive. Which of the following is the best practice for acquiring an image of the drive?

Accepted Answer

Use a hardware write blocker and create a bit-stream image.. Using a hardware write blocker ensures that no write commands from the forensic workstation reach the suspect drive, preserving its integrity at the physical level. Creating a bit-stream image (sector-by-sector copy) captures all data, including slack space and unallocated clusters, which is essential for thorough forensic analysis. This combination is the gold standard in digital forensics, as mandated by best practices like those from NIST and the ACPO principles.

Answer

Use the 'dd' command to create a raw image without a write blocker.

Answer

Connect the drive to a forensic workstation and use the operating system's copy command.

Answer

Format the drive before imaging to ensure no hidden data is missed.

Question 6

Which Windows artifact is specifically designed to track the most recently used (MRU) files for specific applications and can be found in the NTUSER.DAT registry hive?

Accepted Answer

MRU lists in the registry. The NTUSER.DAT registry hive contains per-user MRU (Most Recently Used) lists that track files recently accessed by specific applications, such as the 'RecentDocs' key for Office applications or 'ComDlg32' for common dialog boxes. These registry keys are explicitly designed to store MRU data, making them the direct artifact for this purpose.

Answer

Prefetch files

Answer

Jump Lists

Answer

LNK files

Question 7

During a mobile forensic investigation of an iPhone, an examiner needs to recover deleted SMS messages. Which acquisition method provides the highest likelihood of retrieving deleted data from the device's flash memory?

Accepted Answer

Physical acquisition via JTAG or chip-off. Physical acquisition via JTAG or chip-off provides the highest likelihood of recovering deleted SMS messages because it accesses the raw NAND flash memory at the hardware level, bypassing the iOS file system and logical abstractions. Deleted data on flash storage remains in unallocated blocks until overwritten, and physical imaging captures these remnants, including deleted SQLite records from the SMS database. In contrast, logical and file system methods only retrieve active files, missing the unallocated space where deleted messages reside.

Answer

Manual acquisition by taking screenshots

Answer

File system acquisition via iOS file system extraction

Answer

Logical acquisition via iTunes backup

Question 8

During incident response, a first responder discovers a compromised system with signs of an active command-and-control (C2) connection. What is the MOST important immediate action to preserve evidence and prevent further damage?

Accepted Answer

Disconnect the network cable to isolate the system from the network.. Disconnecting the network cable immediately stops the active C2 communication, preventing further data exfiltration and command injection while preserving the current state of memory and disk. This action maintains the integrity of volatile evidence (e.g., network connections, running processes) and avoids the data loss that would occur with a shutdown or the evidence contamination that would result from running a scan.

Answer

Create a full disk image before taking any other action.

Answer

Immediately shut down the system to prevent further data exfiltration.

Answer

Run a full antivirus scan to remove the malware.

Question 9

Which TWO of the following are essential components of a proper chain of custody documentation? (Select TWO)

Accepted Answer

Date and time of evidence collection. The date and time of evidence collection is a fundamental element of chain of custody documentation, establishing a precise chronological record of when the evidence was acquired. This timestamp is critical for proving the integrity and continuity of the evidence from the moment of seizure, and it must be recorded with accuracy (often to the second) and in a consistent time zone (e.g., UTC) to avoid disputes. Without this, the chain of custody cannot demonstrate that the evidence was not tampered with between collection and analysis.

Answer

The IP address of the forensic workstation

Answer

Backup location of the evidence

Answer

The forensic tool used to analyze the evidence

Question 10

You are a forensic investigator responding to a suspected data breach at a financial institution. The incident response team has isolated a Windows 10 workstation used by a former employee. The system is still powered on, and the login screen is displayed. Your task is to acquire forensic evidence in a defensible manner. The following actions are available:

A. Immediately pull the power cord to perform a cold acquisition of the hard drive.
B. Capture volatile data (RAM, network connections, running processes) using a trusted tool on a USB drive, then shut down normally and remove the hard drive for imaging.
C. Boot the system from a forensic live CD and create a forensic image of the hard drive while the system is running.
D. Use the built-in Windows backup to create a system image to an external drive.

Which action is the most appropriate first step in this scenario?

Accepted Answer

Capture volatile data using a trusted tool on a USB drive, then shut down normally and remove the hard drive for imaging. The system is still powered on with the login screen displayed, meaning volatile data (RAM, network connections, running processes) is present and will be lost if the system is powered off. Capturing this data first using a trusted forensic tool (e.g., FTK Imager or DumpIt) from a write-blocked USB drive preserves critical evidence such as encryption keys, active network connections, and malware in memory. Only after volatile data is secured should the system be shut down normally and the hard drive removed for forensic imaging, ensuring a defensible chain of custody.

Answer

Use the built-in Windows backup to create a system image to an external drive

Answer

Boot the system from a forensic live CD and create a forensic image of the hard drive while the system is running

Answer

Immediately pull the power cord to perform a cold acquisition of the hard drive

Question 11

An investigator needs to capture network traffic from a live network segment without altering the traffic flow. Which technique should they use?

Accepted Answer

Configure a SPAN port on the switch. A SPAN (Switched Port Analyzer) port, also known as a mirror port, copies all traffic from a specified source port or VLAN to a destination port where the forensic workstation is connected. This allows the investigator to capture traffic without injecting any frames or altering the forwarding behavior of the switch, thus preserving the integrity of the live network segment.

Answer

Enable NetFlow on the router and capture flows

Answer

Deploy an ARP spoofing tool to redirect traffic

Answer

Set the NIC to promiscuous mode on the forensic workstation

Question 12

An analyst notices that a file on an NTFS volume occupies 4096 bytes on disk but its actual data is only 100 bytes. The extra space contains remnants of a previously deleted file. What is this extra space called?

Accepted Answer

File slack. File slack is the unused space between the end of the actual file data and the end of the last allocated cluster for that file. On an NTFS volume with a 4096-byte cluster size, a 100-byte file leaves 3996 bytes of slack space, which may contain remnants of previously deleted files. This is why option D is correct.

Answer

Volume slack

Answer

Free space

Answer

RAM slack

Question 13

In an iOS forensic examination, an analyst extracts an encrypted iTunes backup. The backup contains a file named 'manifest.plist' which lists the backup version and encryption state. Which tool is specifically designed to brute-force the backup password using GPU acceleration?

Accepted Answer

Hashcat. Hashcat is the correct tool because it is a password recovery utility that leverages GPU acceleration to perform high-speed brute-force attacks on encrypted iTunes backup passwords. It can directly process the password hash extracted from the 'manifest.plist' file, which contains the backup version and encryption state, allowing efficient cracking of the backup password.

Answer

Oxygen Forensic Detective

Answer

Cellebrite UFED

Answer

GrayKey

Question 14

A forensic examiner is analyzing an Android device that has been factory reset. Which of the following artefacts is MOST likely to still be recoverable from the device's flash memory after a factory reset, assuming no overwrite has occurred?

Accepted Answer

User data such as photos and contacts. After a factory reset on an Android device, the operating system typically performs a 'fastboot format' or 'wipe data/factory reset' which only unmounts the userdata partition and marks its blocks as free in the ext4 or F2FS filesystem metadata. The actual user data (photos, contacts, etc.) remains physically stored in the NAND flash memory until those blocks are overwritten by new data. Because no overwrite has occurred in this scenario, the raw data is still recoverable using forensic tools that bypass the filesystem and read the flash memory directly.

Answer

The GUID Partition Table (GPT)

Answer

The device's encryption keys

Answer

The Android OS system files

Question 15

During a database forensic investigation, you need to review Microsoft SQL Server transaction logs to identify unauthorized data modifications. Which of the following SQL Server functions or commands is used to read the transaction log?

Accepted Answer

fn_dblog. The fn_dblog function is the correct choice because it is the undocumented but widely used SQL Server function that reads the transaction log (LDF file) directly, allowing forensic examiners to view every logged operation including data modifications, schema changes, and transaction details. Unlike other DMVs or commands, fn_dblog provides a row-by-row dump of the log records, making it essential for identifying unauthorized changes at the transaction level.

Answer

SELECT * FROM sys.dm_tran_database_transactions

Answer

DBCC LOG

Answer

BACKUP LOG

Question 16

A first responder arrives at a suspected intrusion scene. A desktop computer is powered on and logged in. The user claims they saw suspicious files being copied to a USB drive. Which of the following should the first responder do FIRST?

Accepted Answer

Capture volatile data such as memory and running processes.. In a live intrusion where a USB transfer is in progress, volatile data (memory, running processes, network connections) is the most ephemeral and will be lost if the system is powered down. Capturing this data first preserves evidence of the malicious activity, such as the process that initiated the copy and any network connections, which is critical for reconstructing the attack. This follows the order of volatility (RFC 3227), which mandates capturing volatile data before non-volatile data.

Answer

Power off the computer immediately to prevent further data loss.

Answer

Photograph the scene and document everything in a notebook.

Answer

Create a forensic image of the hard drive using a write blocker.

Question 17

A forensic examiner uses Oxygen Forensic Detective to acquire data from an Android device. The tool reports that it performed a 'full file system' extraction. Which of the following is a prerequisite for this type of extraction?

Accepted Answer

The device must be rooted. A full file system extraction in Oxygen Forensic Detective requires root access on the Android device because the tool must bypass the Linux kernel's permission model to read protected partitions (e.g., /data, /cache). Without root privileges, the extraction is limited to the logical or file-based scope, as the Android security model restricts user-space processes from accessing raw block devices or system files owned by root.

Answer

The bootloader must be unlocked

Answer

The device must be in recovery mode

Answer

USB debugging must be enabled

Question 18

A forensic examiner has acquired a disk image using FTK Imager and needs to ensure the image is an exact duplicate of the original drive. Which THREE of the following methods can be used to verify integrity? (Select THREE)

Accepted Answer

Compute the SHA-256 hash of the image and compare it to the original drive's hash. SHA-256 is a cryptographic hash function that produces a unique 256-bit digest. By computing the SHA-256 hash of the acquired image and comparing it to the hash computed from the original drive, the examiner can verify bit-for-bit integrity with extremely high collision resistance, ensuring the image is an exact duplicate.

Answer

Verify the cyclical redundancy check (CRC-32) of the image file

Answer

Check the file size of the image matches the original drive's capacity

Question 19

In Android forensics, which command is used to extract a full physical image of a device's flash memory over USB using the Android Debug Bridge (ADB)?

Accepted Answer

adb shell dd if=/dev/block/mmcblk0 of=/sdcard/physical.img. The `adb shell dd if=/dev/block/mmcblk0 of=/sdcard/physical.img` command uses the `dd` utility to perform a bit-for-bit copy of the raw block device representing the internal flash memory (mmcblk0) to a file on the device's SD card, which can then be pulled via ADB. This method captures a full physical image, including deleted data and unallocated space, which is essential for deep forensic analysis.

Answer

adb pull /data data.img

Answer

adb backup -f backup.ab

Answer

adb install physical.img

Question 20

You are responding to a suspected malware infection on a Windows 10 system. The system is still running. Which of the following should you collect FIRST?

Accepted Answer

Acquire a memory dump using a tool like WinPmem.. When a system is still running and suspected of malware infection, the first priority is to capture volatile data, which includes the contents of RAM. WinPmem is a tool designed to acquire a memory dump from a live Windows system, preserving critical evidence such as running processes, network connections, and injected code that would be lost on shutdown. This follows the order of volatility (RFC 3227), which mandates collecting memory before any non-volatile data like logs, registry, or disk images.

Answer

Collect the Windows Event Logs.

Answer

Export the contents of the Windows Registry.

Answer

Create a forensic image of the hard drive.