CHFI Practice Test 4 — 25 Questions

Question 1

A first responder arrives at a suspected intrusion scene. A desktop computer is powered on and logged in. The user claims they saw suspicious files being copied to a USB drive. Which of the following should the first responder do FIRST?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Capture volatile data such as memory and running processes.. In a live intrusion where a USB transfer is in progress, volatile data (memory, running processes, network connections) is the most ephemeral and will be lost if the system is powered down. Capturing this data first preserves evidence of the malicious activity, such as the process that initiated the copy and any network connections, which is critical for reconstructing the attack. This follows the order of volatility (RFC 3227), which mandates capturing volatile data before non-volatile data.

Answer

Power off the computer immediately to prevent further data loss.

Answer

Photograph the scene and document everything in a notebook.

Answer

Create a forensic image of the hard drive using a write blocker.

Question 2

A forensic examiner uses Oxygen Forensic Detective to acquire data from an Android device. The tool reports that it performed a 'full file system' extraction. Which of the following is a prerequisite for this type of extraction?

Accepted Answer

The device must be rooted. A full file system extraction in Oxygen Forensic Detective requires root access on the Android device because the tool must bypass the Linux kernel's permission model to read protected partitions (e.g., /data, /cache). Without root privileges, the extraction is limited to the logical or file-based scope, as the Android security model restricts user-space processes from accessing raw block devices or system files owned by root.

Answer

The bootloader must be unlocked

Answer

The device must be in recovery mode

Answer

USB debugging must be enabled

Question 3

A forensic examiner has acquired a disk image using FTK Imager and needs to ensure the image is an exact duplicate of the original drive. Which THREE of the following methods can be used to verify integrity? (Select THREE)

Accepted Answer

Compute the SHA-256 hash of the image and compare it to the original drive's hash. SHA-256 is a cryptographic hash function that produces a unique 256-bit digest. By computing the SHA-256 hash of the acquired image and comparing it to the hash computed from the original drive, the examiner can verify bit-for-bit integrity with extremely high collision resistance, ensuring the image is an exact duplicate.

Answer

Verify the cyclical redundancy check (CRC-32) of the image file

Answer

Check the file size of the image matches the original drive's capacity

Question 4

In Android forensics, which command is used to extract a full physical image of a device's flash memory over USB using the Android Debug Bridge (ADB)?

Accepted Answer

adb shell dd if=/dev/block/mmcblk0 of=/sdcard/physical.img. The `adb shell dd if=/dev/block/mmcblk0 of=/sdcard/physical.img` command uses the `dd` utility to perform a bit-for-bit copy of the raw block device representing the internal flash memory (mmcblk0) to a file on the device's SD card, which can then be pulled via ADB. This method captures a full physical image, including deleted data and unallocated space, which is essential for deep forensic analysis.

Answer

adb pull /data data.img

Answer

adb backup -f backup.ab

Answer

adb install physical.img

Question 5

You are responding to a suspected malware infection on a Windows 10 system. The system is still running. Which of the following should you collect FIRST?

Accepted Answer

Acquire a memory dump using a tool like WinPmem.. When a system is still running and suspected of malware infection, the first priority is to capture volatile data, which includes the contents of RAM. WinPmem is a tool designed to acquire a memory dump from a live Windows system, preserving critical evidence such as running processes, network connections, and injected code that would be lost on shutdown. This follows the order of volatility (RFC 3227), which mandates collecting memory before any non-volatile data like logs, registry, or disk images.

Answer

Collect the Windows Event Logs.

Answer

Export the contents of the Windows Registry.

Answer

Create a forensic image of the hard drive.

Question 6

During a forensic examination of a solid-state drive (SSD), the analyst notices that the TRIM command was enabled. What challenge does this pose for data recovery?

Accepted Answer

It erases data blocks immediately after deletion, preventing recovery. The TRIM command (ATA Data Set Management command) instructs the SSD controller to immediately erase the physical NAND blocks corresponding to deleted logical block addresses (LBAs). This proactive garbage collection operation resets the cells to an erased state, making it impossible for forensic tools to recover the original data from those blocks, as the data is physically overwritten with null values or marked as invalid.

Answer

It causes fragmentation, making file recovery more complex

Answer

It causes the drive to encrypt data automatically

Answer

It physically destroys the NAND cells, making the drive unusable

Question 7

During a forensic examination, an analyst uses the command 'dcfldd if=/dev/sda of=image.dd hash=sha256 hashlog=hash.txt'. What is the primary purpose of including 'hash=sha256' in this command?

Accepted Answer

To compute a SHA-256 hash of the input drive and log it to a file for integrity verification. The `hash=sha256` parameter in `dcfldd` instructs the tool to compute a SHA-256 hash of the input device (`/dev/sda`) during the acquisition process. This hash is then logged to the file specified by `hashlog=hash.txt`, providing a verifiable integrity check that the forensic image matches the original source. This is a standard forensic practice to ensure the image has not been altered or corrupted.

Answer

To split the image into multiple files named with SHA-256 checksums

Answer

To encrypt the output image file using SHA-256

Answer

To compress the image using SHA-256 compression algorithm

Question 8

What is the PRIMARY purpose of a chain of custody document in a forensic investigation?

Accepted Answer

To provide a chronological record of who handled the evidence, when, and why.. The chain of custody document is the foundational record that ensures evidence integrity and admissibility in court. Its primary purpose is to create a chronological, unbroken log of every person who handled the evidence, the exact time and date of each transfer, and the reason for the transfer. This directly supports the legal requirement to prove that the evidence has not been tampered with or altered from the moment of seizure to its presentation in court.

Answer

To document the tools used during the investigation.

Answer

To list all the files found on the suspect's computer.

Answer

To authorize the search and seizure of digital evidence.

Question 9

In an email header, which field typically contains the IP address of the original sending client?

Accepted Answer

Received. The 'Received' field in an email header is added by each mail transfer agent (MTA) that processes the message, and the first 'Received' header (at the bottom of the header block) typically contains the IP address of the original sending client (the SMTP client that initiated the connection). This field records the 'from' IP and the 'by' host, making it the definitive source for tracing the origin of the email.

Answer

Return-Path

Answer

Message-ID

Answer

DKIM-Signature

Question 10

Which tool is commonly used in timeline analysis for digital forensics to parse various artifacts and create a super timeline?

Accepted Answer

log2timeline / Plaso. log2timeline (now part of the Plaso framework) is specifically designed to parse a wide variety of digital forensic artifacts—such as Windows Event Logs, Prefetch files, registry hives, and browser history—and aggregate them into a single, unified super timeline. This super timeline allows investigators to correlate events across different data sources and identify sequences of activity with precise timestamps, which is essential for timeline analysis in OS and network forensics.

Answer

Volatility

Answer

Wireshark

Answer

Sleuth Kit

Question 11

What is the primary purpose of maintaining a chain of custody during a forensic investigation?

Accepted Answer

To document the handling of evidence from collection to presentation in court. The primary purpose of maintaining a chain of custody is to create a documented, unbroken record of every person who handled the evidence, from the moment it is collected until it is presented in court. This documentation is critical to establish the authenticity and integrity of the evidence, ensuring it has not been tampered with or altered, which is a foundational requirement for admissibility under legal standards like the Federal Rules of Evidence (FRE) 901. Without a proper chain of custody, the evidence can be challenged as inadmissible due to lack of trustworthiness.

Answer

To reduce the size of evidence for easier storage

Answer

To analyze the evidence for hidden data

Answer

To encrypt the evidence to prevent unauthorized access

Question 12

During a forensic investigation of a compromised web server, an analyst examines the Apache access log and finds the following entry: '192.168.1.10 - - [12/Oct/2024:13:45:22 +0000] "GET /index.php?id=1 UNION SELECT username, password FROM users-- HTTP/1.1" 200 1234 "-" "Mozilla/5.0"'. What type of attack is MOST likely indicated?

Accepted Answer

SQL injection (SQLi). The log entry shows a UNION-based SQL injection attempt, where the attacker appends 'UNION SELECT username, password FROM users--' to the 'id' parameter in the GET request. This manipulates the original SQL query to return sensitive data from the 'users' table, which is the hallmark of SQL injection (SQLi). The HTTP 200 response indicates the query executed successfully, confirming the attack vector.

Answer

Cross-site scripting (XSS)

Answer

Path traversal

Answer

Remote file inclusion (RFI)

Question 13

During an internal investigation, an employee is suspected of leaking sensitive data. The security team finds that the employee's computer has been turned off. Which of the following evidence types would be LOST due to the system being powered off?

Accepted Answer

Contents of RAM and network connections. When a system is powered off, the contents of volatile memory (RAM) are immediately lost because RAM requires constant electrical power to retain data. Similarly, active network connections are terminated and their state is lost, as they are maintained in kernel memory structures that are not persisted to disk. Therefore, any evidence residing only in RAM (e.g., encryption keys, running processes, unencrypted data) or transient network session details (e.g., active TCP/UDP connections, IP addresses) is permanently lost upon shutdown.

Answer

System logs stored in the Event Viewer

Answer

Files stored on the hard drive

Answer

Registry hives

Question 14

A malware analyst is examining a suspicious Windows executable. Running 'strings' reveals references to 'C:\Windows\System32\drivers\etc\hosts' and IP addresses 185.130.5.21 and 192.168.1.1. Dynamic analysis in a sandbox shows the binary modifies the hosts file and creates a mutex named 'Global\Mtx_Update'. Which behavioral indicator is MOST clearly associated with persistence?

Accepted Answer

Modifying the hosts file with an entry for 192.168.1.1. Modifying the hosts file to redirect a legitimate domain to 192.168.1.1 is a classic persistence mechanism: the malware ensures that every time the system resolves that domain, it points to the attacker-controlled IP, effectively hijacking network traffic persistently across reboots without needing to run at startup. This behavior directly maintains unauthorized control over name resolution, which is a hallmark of persistence.

Answer

Connecting to IP 185.130.5.21 on port 443

Answer

Writing temporary files to %TEMP%

Answer

Creating the mutex 'Global\Mtx_Update'

Question 15

An organization uses Microsoft SQL Server 2019 with full recovery model. A database administrator accidentally executed a DROP TABLE statement. The transaction log was backed up immediately after the incident. Which forensic technique would allow the analyst to restore the dropped table?

Accepted Answer

Perform a tail-log backup, then restore the full backup and all subsequent transaction log backups, stopping before the DROP TABLE.. Under the full recovery model, point-in-time recovery is required to undo the DROP TABLE. By performing a tail-log backup (to capture any transactions after the last log backup), then restoring the full backup and all subsequent transaction log backups with STOPAT or STOPBEFOREMARK to the moment just before the DROP TABLE, the analyst can recover the table without losing other transactions. This is the only method that preserves the dropped table's data while maintaining database consistency.

Answer

Restore the transaction log backup taken after the DROP TABLE and apply it to the database.

Answer

Use the RESTORE LOG statement with the NO_TRUNCATE option to recover the table.

Answer

Restore the most recent full backup and ignore subsequent transaction log backups.

Question 16

An investigator is analyzing a Windows 10 system suspected of malware persistence. Which registry key is commonly used by malware to achieve persistence by running a program at every user logon?

Accepted Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Run. The HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry key is a standard autostart location that Windows checks at every user logon. Malware commonly writes a value here pointing to its executable path, ensuring it runs automatically each time the user logs into their account. This is a well-documented persistence mechanism in Windows forensics.

Answer

HKLM\SAM\SAM

Answer

HKLM\SYSTEM\CurrentControlSet\Services

Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall

Question 17

Refer to the exhibit. An investigator is examining a disk image using TSK. The output from 'fls' shows the directory structure. What is the significance of the entry 'V/V 113-128-1: $OrphanFiles'?

Accepted Answer

It is a virtual directory that contains files with no parent directory, often from deleted files. In The Sleuth Kit (TSK), the 'fls' command lists files and directories within a disk image. The entry 'V/V 113-128-1: $OrphanFiles' is a virtual directory that contains files that have no parent directory in the file system, typically because their directory entries were deleted or corrupted. This is a common artifact when recovering deleted files from NTFS volumes, as TSK collects such orphaned MFT entries into this virtual container.

Answer

It is a sign that a rootkit has hidden files in the image

Answer

It indicates the location of the Master File Table (MFT) mirror

Answer

It is a standard NTFS metadata file that stores file permissions

Question 18

Which of the following is a unique challenge in cloud forensics compared to traditional digital forensics?

Accepted Answer

Multi-tenancy and data isolation. In cloud forensics, multi-tenancy and data isolation present a unique challenge because multiple customers share the same physical infrastructure, and forensic investigators must ensure that data acquisition from one tenant does not inadvertently expose or contaminate another tenant's data. This requires careful coordination with the cloud provider to isolate logical boundaries, often using techniques like snapshot-based acquisition or API-driven evidence collection, which are not typical in traditional single-owner digital forensics.

Answer

Encryption of data at rest

Answer

Lack of network connectivity

Answer

Inability to acquire disk images

Question 19

During a Windows forensic analysis, you find a suspicious LNK file in a user's Recent folder. Which of the following is NOT typically retrievable from an LNK file?

Accepted Answer

Username of the user who created the LNK file. LNK files store metadata about the target file and the system environment, but they do not record the username of the user who created the LNK file. The creation timestamp of the LNK file itself is stored, but the username is not part of the LNK file structure. Instead, the username context is inferred from the user's profile folder path where the LNK resides, not from the file's internal data.

Answer

Target file creation timestamp

Answer

Volume serial number of the target drive

Answer

Target file path

Question 20

A security analyst observes multiple Event ID 4625 logon failures for a single user account within a short time frame, followed by Event ID 4624 logon success. Which attack technique is MOST likely indicated?

Accepted Answer

Brute-force or password spraying attack. Event ID 4625 indicates failed logon attempts, and Event ID 4624 indicates a successful logon. A rapid sequence of failures followed by a success for the same user account is the classic signature of a brute-force or password spraying attack, where an attacker tries multiple passwords until one works. This pattern is specific to authentication attempts against the local SAM or domain controller via NTLM or Kerberos, not to post-authentication attacks.

Answer

Kerberos golden ticket attack

Answer

SQL injection attack on the authentication database

Answer

Pass-the-hash attack