CHFI Practice Test 21 — 15 Questions

Question 1

A forensic investigator needs to collect evidence from a Google Cloud Platform (GCP) environment. Which of the following GCP services provides audit logs for administrative activities and data access?

Accepted Answer

Cloud Audit Logs. Cloud Audit Logs is the correct answer because it is the dedicated GCP service that captures and stores audit trails for administrative activities (Admin Activity audit logs) and data access (Data Access audit logs) within Google Cloud Platform. These logs record who did what, where, and when, which is essential for forensic investigations in cloud environments.

Answer

Cloud Storage logs

Answer

Cloud Monitoring

Answer

Cloud IAM

Question 2

A forensic investigator is analyzing a RAID 0 array consisting of two disks. She uses FTK Imager to acquire the logical drive. However, the data appears interleaved. What additional step is necessary to properly assemble the image?

Accepted Answer

Reconstruct the RAID by determining stripe size and order, then combine the images. RAID 0 uses striping to distribute data across multiple disks, so a logical acquisition of the array will appear interleaved without the stripe parameters. To properly assemble the image, the investigator must determine the stripe size and the order of the disks, then combine the raw images accordingly. This reconstruction ensures the data is read in the correct sequence, allowing file system analysis tools to interpret the logical volume correctly.

Answer

Use EnCase to acquire each disk separately and mount as a RAID volume

Answer

Simply reorder the disk images alphabetically

Answer

Use PhotoRec to carve files from raw images

Question 3

During a forensic investigation, an examiner wants to recover deleted files from a FAT32 file system. Which structure is most critical for file recovery?

Accepted Answer

File Allocation Table (FAT). In FAT32, the File Allocation Table (FAT) is the primary structure that tracks cluster allocation chains for files. When a file is deleted, the directory entry is marked as available, but the FAT entries (cluster chains) often remain intact until overwritten, making the FAT the most critical structure for recovering deleted files by reconstructing their cluster sequences.

Answer

Master File Table (MFT)

Answer

Journal

Answer

Inode table

Question 4

An attacker has compromised a Linux server and edited the /etc/passwd file to change a user's UID to 0. What is the likely goal of this modification?

Accepted Answer

To escalate privileges to root. In Linux, the UID 0 is reserved for the root user, who has unrestricted access to the system. By changing a user's UID to 0, the attacker grants that user the same privileges as root, effectively escalating their access to the highest level. This is a classic privilege escalation technique because the kernel identifies root by UID, not by the username.

Answer

To lock the user account

Answer

To enable password-less login

Answer

To hide the user account from the system

Question 5

During a forensic analysis of a compromised Linux system, you notice that the /proc filesystem contains a suspicious entry /proc/12345/exe pointing to /tmp/.hidden/malware. What conclusion can you draw?

Accepted Answer

A process with PID 12345 is running the malware. The /proc filesystem is a virtual filesystem that provides process information. The entry /proc/12345/exe is a symbolic link pointing to the executable file that started the process with PID 12345. Since this link exists and points to /tmp/.hidden/malware, it confirms that a process with PID 12345 is currently running that malware binary.

Answer

The system was rebooted recently

Answer

The malware is a kernel module

Answer

The malware was executed via a cron job

Question 6

During a forensic investigation, an analyst examines a hard disk and notices that the partition table uses a 64-bit scheme with a maximum of 128 partitions. Which partition table type is in use?

Accepted Answer

GPT. GPT (GUID Partition Table) uses a 64-bit scheme for logical block addressing and supports up to 128 partitions by default in its standard header layout. This matches the description of a 64-bit partition table with a maximum of 128 partitions, making D the correct answer.

Answer

MBR

Answer

LDM

Answer

APM

Question 7

During a cloud forensics investigation, the investigator discovers that the cloud provider uses shared storage for multiple tenants. Which challenge is MOST likely to arise when acquiring a forensic image?

Accepted Answer

Data commingling with other tenants. In cloud environments with shared storage, data from multiple tenants resides on the same physical or logical volume. When acquiring a forensic image, the investigator cannot isolate a single tenant's data without also capturing other tenants' data, leading to data commingling. This violates chain-of-custody and privacy principles, making it the primary challenge.

Answer

Physical acquisition of the storage device is required

Answer

No API access to the storage system

Answer

Inability to decrypt data at rest

Question 8

A cloud forensics investigator is analyzing an incident in AWS. The suspect is alleged to have deleted an S3 bucket. Which AWS service log would contain the DeleteBucket API call details, including the source IP and user identity?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made to the AWS environment, including management-plane operations like DeleteBucket. Each CloudTrail event contains the source IP address, user identity (IAM user or role ARN), and the exact API action (DeleteBucket), making it the definitive log for investigating S3 bucket deletion incidents.

Answer

VPC Flow Logs

Answer

Amazon S3 access logs

Answer

AWS Config

Question 9

An analyst is investigating a Linux server that suffered a data breach. The attacker deleted several log files. The analyst runs `debugfs /dev/sda1` and issues the command `lsdel`. What is the purpose of this command in the context of file recovery?

Accepted Answer

List inodes of deleted files that still have allocated blocks. The `lsdel` command in `debugfs` lists inodes of deleted files that still have allocated data blocks. This is critical in forensic analysis because even after a file is deleted, its inode and data blocks may remain intact until overwritten, allowing recovery of the file's contents.

Answer

Recover deleted files from the journal

Answer

List all deleted directory entries in the journal

Answer

Display the current superblock information

Question 10

A forensic analyst is examining an SSD that may have had deleted files. The analyst is concerned about the TRIM command. What effect does TRIM have on forensic recovery of deleted files?

Accepted Answer

TRIM invalidates deleted data blocks, making them unreadable and unrecoverable. The TRIM command allows the operating system to inform the SSD which data blocks are no longer in use. The SSD then internally marks those blocks as invalid and may immediately erase them or add them to its free pool for garbage collection. This process physically removes the data, making it unreadable and unrecoverable through standard forensic tools, which is why option C is correct.

Answer

TRIM increases the chance of recovering deleted files

Answer

TRIM causes wear leveling that spreads data across blocks, aiding recovery

Answer

TRIM has no effect on forensic analysis

Question 11

During an e-discovery process, a legal hold is issued. What is the PRIMARY purpose of a legal hold?

Accepted Answer

To prevent the destruction or alteration of potentially relevant evidence. The primary purpose of a legal hold is to preserve all forms of potentially relevant evidence by suspending normal data retention and deletion policies. This ensures that data, including emails, documents, and logs, is not altered or destroyed during the e-discovery process, which is critical for maintaining the integrity of evidence for litigation.

Answer

To authorize forensic examiners to image all company devices

Answer

To encrypt all data to prevent unauthorized access during litigation

Answer

To notify the opposing party of the intent to use electronic evidence

Question 12

During a forensic examination of a Windows 10 system, you find a file with an ADS named `:hidden.txt` attached to `legal.docx`. Using FTK Imager, you extract the ADS and discover it contains a list of passwords. Which tool or technique could also be used to identify this hidden data?

Accepted Answer

Analyzing the $MFT using Autopsy. The $MFT (Master File Table) in NTFS stores metadata for every file and directory, including entries for Alternate Data Streams (ADS). By analyzing the $MFT with a tool like Autopsy, you can directly view the ADS names and their associated data, such as the `:hidden.txt` stream attached to `legal.docx`. This is a reliable forensic method because the $MFT is a critical file system structure that records all streams, even if the file system explorer hides them.

Answer

Running `strings` on the raw partition

Answer

Using `lsof` on a live system

Answer

Performing file carving with PhotoRec

Question 13

A forensic examiner needs to analyze the contents of a Windows prefetch file (.pf) to determine the last execution time of an application. Which tool would BEST accomplish this task?

Accepted Answer

PECmd. PECmd (Prefetch Explorer Command-line) is a dedicated forensic tool from Eric Zimmerman's suite designed specifically to parse Windows prefetch files (.pf). It extracts detailed metadata including the last execution time, run count, and referenced files, making it the best choice for this task. Built-in Windows tools do not provide a 'prefetch.exe' utility, and other options like ShellBags Explorer or JumpLister target different artifacts (registry shell bags and jump lists, respectively).

Answer

prefetch.exe (built‑in Windows tool)

Answer

ShellBags Explorer

Answer

JumpLister

Question 14

An investigator images an SSD that has TRIM enabled. Which of the following challenges will MOST likely affect the recovery of deleted files from this SSD?

Accepted Answer

TRIM causes the SSD to zero out freed blocks, preventing recovery. When TRIM is enabled on an SSD, the operating system notifies the drive which blocks are no longer in use. The SSD's firmware then immediately zeroes out or internally marks those blocks as free, physically erasing the data. This prevents forensic tools from recovering deleted files because the underlying data is no longer present on the NAND flash cells.

Answer

The SSD uses a different partition table scheme

Answer

The SSD firmware encrypts all data, requiring a decryption key

Answer

Wear leveling spreads data across blocks, complicating recovery

Question 15

In email forensics, which artifact is stored in Outlook's Personal Folders (.pst) files and can be analyzed using tools like Aid4Mail or EmailTracker?

Accepted Answer

Emails, attachments, calendars, contacts, and other mailbox items. Outlook Personal Folders (.pst) files are not limited to storing just email content; they are a comprehensive container for multiple mailbox items. In addition to emails and attachments, .pst files store calendars, contacts, tasks, notes, journal entries, and other mailbox artifacts. Tools like Aid4Mail and EmailTracker can parse the entire .pst structure to extract and analyze all these item types, making option D correct.

Answer

Only the email body text

Answer

Emails and attachments only

Answer

Email headers only