CHFI Practice Test 32 — 15 Questions

Question 1

A forensic analyst is investigating a Windows system for evidence of USB device usage. Which registry key is MOST useful for determining the first time a USB device was connected and its serial number?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR. The USBSTOR key under HKLM\SYSTEM\CurrentControlSet\Enum stores a subkey for each USB mass storage device that has ever been connected to the system. Each subkey is named with the device's serial number, and its creation timestamp reflects the first time the device was enumerated (i.e., first connected). This makes it the definitive source for both the serial number and the initial connection time of a USB device.

Answer

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2

Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellBags

Answer

HKLM\SYSTEM\CurrentControlSet\Enum\USB

Question 2

During an email forensics investigation, an analyst examines headers and sees `Received: from mail.evil.com (192.168.1.100) by mail.victim.com` followed by `DKIM-Signature: v=1; a=rsa-sha256; d=evil.com; s=selector; bh=...; h=...; b=...`. The email claims to be from support@paypal.com. Which finding is the strongest indicator of spoofing?

Accepted Answer

The DKIM signature domain is evil.com, not paypal.com. The DKIM signature domain (d=evil.com) does not match the claimed sender domain (paypal.com). DKIM uses a digital signature verified against the public key published in the DNS of the signing domain. Since the signature is from evil.com, the email cannot be authenticated as originating from paypal.com, making this the strongest indicator of spoofing.

Answer

The email was received via SMTP

Answer

The email lacks a SPF record in the header

Answer

The email originated from IP 192.168.1.100

Question 3

A forensic analyst finds a suspicious .plist file in /Library/LaunchDaemons/ on a macOS system. The file contains a key "ProgramArguments" with a path to a script in /tmp. Which persistence mechanism does this indicate?

Accepted Answer

Launch daemon. The .plist file located in /Library/LaunchDaemons/ with a 'ProgramArguments' key pointing to a script in /tmp is the standard configuration for a launch daemon. Launch daemons are system-wide background processes managed by launchd, and they are defined by plist files in /Library/LaunchDaemons/ (for system-wide daemons) or /System/Library/LaunchDaemons/ (for Apple-provided daemons). The presence of 'ProgramArguments' specifies the executable or script to run, making this a classic launch daemon persistence mechanism.

Answer

Cron job

Answer

Login item

Answer

Kernel extension

Question 4

While investigating a compromised web server, you discover a file named 'shell.php' in the web root. The file contains the following code: <?php system($_GET['cmd']); ?>. Which of the following best describes this file?

Accepted Answer

A web shell. The file 'shell.php' contains code that uses the PHP system() function to execute arbitrary operating system commands passed via the 'cmd' GET parameter. This is the classic definition of a web shell, which provides remote command execution on the server. It is not a SQL injection script, a file upload exploit, or a trojan in the traditional sense, as it directly accepts and runs system commands through HTTP requests.

Answer

A SQL injection script

Answer

A file upload vulnerability exploit

Answer

A backdoor trojan

Question 5

An analyst discovers that a Windows system has hidden data in the Host Protected Area (HPA) of the hard drive. Which tool or method can be used to detect and access the HPA?

Accepted Answer

Using the hdparm command in Linux with the -N flag. The Host Protected Area (HPA) is a reserved region on ATA/ATAPI hard drives that is not visible to the operating system's standard disk utilities. The `hdparm` command in Linux with the `-N` flag is specifically designed to detect and modify the HPA by querying the drive's native max address, revealing hidden sectors. Windows Disk Management and other OS-level tools cannot access the HPA because it is hidden at the firmware level via the ATA SET MAX ADDRESS command.

Answer

Using the Windows Disk Management utility

Answer

Using the Volatility framework

Answer

Using the chkdsk command

Question 6

Which TWO of the following are methods used to hide data within the NTFS file system?

Accepted Answer

File slack space. File slack space (B) is correct because NTFS allocates disk space in clusters (typically 4 KB), so a file smaller than its last cluster leaves unused bytes between the logical end-of-file and the end of the allocated cluster; this residual space can be written with hidden data without altering the file's visible content. Alternate Data Streams (ADS) (D) are correct because NTFS supports multiple named data streams per file via the $DATA attribute, allowing extra data to be attached to a file (e.g., 'file.txt:hidden.txt') that standard directory listings and many tools do not display. The USN Journal (A) is a change-logging metadata feature that records file system modifications, not a concealment method. Volume Shadow Copy (C) creates point-in-time snapshots for backup/recovery, and EFS (E) provides encryption for confidentiality, neither of which is a technique for hiding data inside NTFS structures.

Answer

USN Journal

Answer

Volume Shadow Copy

Answer

Encrypting File System (EFS)

Question 7

An investigator is examining a FAT32 filesystem and needs to recover a deleted file. In FAT32, the directory entry for a deleted file has the first byte of the filename set to 0xE5. What does this indicate?

Accepted Answer

The file has been deleted. In FAT32, when a file is deleted, the directory entry's first byte (the filename's first character) is overwritten with the value 0xE5. This is a deliberate marker used by the file system to indicate that the entry is available for reuse, meaning the file has been logically deleted. The data clusters remain intact until overwritten, which is why recovery tools look for entries with this byte to restore deleted files.

Answer

The file is a system file

Answer

The file is hidden

Answer

The file is encrypted

Question 8

A forensic investigator is analyzing a Microsoft SQL Server instance that was compromised. The investigator wants to identify all login attempts that failed due to incorrect passwords. Which system function or view should be queried?

Accepted Answer

xp_readerrorlog with filter for 'Login failed'. The xp_readerrorlog extended stored procedure reads the SQL Server error log, which records all login attempts, including failures. By filtering for 'Login failed', the investigator can retrieve the exact entries where authentication failed due to incorrect passwords. This is the standard method for auditing failed logins in SQL Server.

Answer

sys.dm_exec_sessions

Answer

sys.dm_tran_locks

Answer

sys.dm_exec_requests

Question 9

A forensic analyst is investigating a suspected data exfiltration from a MySQL database. Which log source would be MOST useful to identify the exact SQL queries executed, including SELECT statements that retrieved large volumes of data?

Accepted Answer

MySQL general query log. The MySQL general query log records every SQL statement received from clients, including SELECT queries, making it the most useful source for identifying exact queries executed during a suspected data exfiltration. Unlike other logs, it captures all activity without filtering by error, execution time, or data-change events, so it will show the specific SELECT statements that retrieved large volumes of data.

Answer

MySQL error log

Answer

MySQL binary log

Answer

MySQL slow query log

Question 10

A forensic analyst is examining a hard drive that was seized from a suspect's home. The analyst uses FTK Imager to create a forensic image. After imaging, the analyst computes the MD5 hash of the image and compares it to the hash computed at the scene. The hashes match. What does this confirm?

Accepted Answer

The image is an exact bit-for-bit copy of the original drive. B is correct because a matching MD5 hash between the image and the original drive confirms that the forensic image is an exact bit-for-bit copy. Hashing algorithms like MD5 produce a unique fixed-size hash value based on the binary content; if two hashes match, the data is identical with no alterations. This validates the integrity of the acquisition process, ensuring that the image is a perfect forensic duplicate.

Answer

The file system is intact and readable

Answer

The drive contains malware

Answer

The drive was not encrypted

Question 11

In Android forensics, which of the following acquisition methods provides the most complete and forensically sound image of the device's internal storage?

Accepted Answer

Physical extraction using a JTAG or chip-off technique. Physical extraction using a JTAG or chip-off technique provides the most complete and forensically sound image because it accesses the raw NAND flash memory at the hardware level, bypassing the operating system and any software-based restrictions. This method captures deleted data, unallocated space, and the entire file system structure, including areas not accessible via logical or file system extractions, ensuring a bit-for-bit copy of the internal storage.

Answer

Manual extraction through the user interface

Answer

Logical extraction via ADB

Answer

File system extraction

Question 12

A security analyst reviews Windows Security Event Logs and finds multiple Event ID 4625 entries from a single source IP address targeting various usernames. Which type of attack is MOST likely occurring?

Accepted Answer

Password spraying attack. Event ID 4625 indicates a failed logon attempt. When multiple usernames are targeted from a single source IP, it suggests the attacker is trying a small set of common passwords against many accounts to avoid account lockout thresholds. This is the hallmark of a password spraying attack, which differs from a brute-force attack that focuses on many passwords for one account.

Answer

Brute-force attack on a single account

Answer

Pass-the-hash attack

Answer

Kerberoasting attack

Question 13

A forensic examiner finds a suspicious entry in the Linux file /etc/passwd: 'backdoor:x:0:0:root:/root:/bin/bash'. What is the MOST significant security issue with this entry?

Accepted Answer

The UID is 0, granting root privileges. The UID (user ID) of 0 is the root user identifier in Linux. Any account with UID 0 is granted the same privileges as the root user, regardless of the account name. This entry effectively creates a backdoor account with full administrative control over the system, bypassing normal authentication and accountability measures.

Answer

The entry has no password hash

Answer

The home directory is set to /root

Answer

The shell is /bin/bash

Question 14

During a Mac forensic investigation, you examine the unified log for process execution around the time of an incident. Which command-line tool is used to query the macOS unified log?

Accepted Answer

log. The `log` command is the native macOS tool for querying the unified log system, which consolidates kernel, driver, and application logs into a single, high-performance data store. It supports filtering by process, time range, and subsystem, making it essential for forensic timeline reconstruction on macOS. Unlike traditional syslog, the unified log uses a binary format that only `log` can efficiently parse.

Answer

journalctl

Answer

dmesg

Answer

syslog

Question 15

Which THREE of the following are challenges specific to SSD forensics compared to HDD forensics?

Accepted Answer

Garbage collection that automatically erases stale blocks. Option A is correct because SSD garbage collection proactively erases blocks containing stale or invalid pages in the background, so data that would remain recoverable on an HDD platter can be destroyed without any user action. Option B is correct because the TRIM command tells the SSD controller which LBAs are no longer in use, allowing those flash pages to be erased and making deleted data unrecoverable far faster and more thoroughly than on an HDD. Option C is correct because wear leveling relocates data across NAND blocks to spread erase cycles, so logical-to-physical mapping changes constantly and forensic tools cannot rely on fixed physical locations the way they can with HDD platters. Option D is not correct because platter rotation and magnetic remanence are characteristics of HDDs, not SSD-specific challenges. Option E is not correct because controller-based compression is not a defining SSD forensic challenge in the way garbage collection, TRIM, and wear leveling are, and it is not marked as a correct answer here.

Answer

Platter rotation causing magnetic remanence

Answer

Controller-based compression reducing data size