CHFI Practice Test 35 — 15 Questions

Question 1

During a forensic investigation, you encounter a Windows system with an NTFS volume. The suspect claims they never used the recycle bin, but you find files in the $Recycle.bin folder. Which artifact can help you determine the original file path and deletion time?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The $I file in the $Recycle.bin folder. The $I file in the $Recycle.bin folder stores metadata about the deleted file, including its original file path and the deletion timestamp. When a file is moved to the Recycle Bin, Windows creates an $I file (e.g., $I<random>.dat) containing this information, which can be parsed to recover the original location and deletion time. This makes it the direct artifact for the investigator's needs.

Answer

The USN journal

Answer

The file slack space

Answer

The $MFT entry for the deleted file

Question 2

A forensic examiner recovers a Windows 10 system and finds a prefetch file for powershell.exe with a last run time of 3 days ago, but the system's security logs show no interactive logons from that user. What does this discrepancy suggest?

Accepted Answer

PowerShell was executed as part of a scheduled task or service. A is correct because PowerShell.exe can be executed by non-interactive processes such as scheduled tasks or services, which do not generate interactive logon events (Event ID 4624) in the Security log. The prefetch file records the last run time regardless of the execution context, so a discrepancy between the prefetch timestamp and the absence of interactive logons indicates that PowerShell was launched by a system-level or automated mechanism, not by a user logging on interactively.

Answer

The prefetch file is corrupted

Answer

The user deleted their profile

Answer

The system clock was changed

Question 3

During a forensic investigation of a compromised web server, you find the following entry in the IIS log: 192.168.2.50, -, 10/Jan/2023, 14:32:15, W3SVC1, WEB01, 192.168.2.10, 80, POST, /uploads/shell.aspx, 200, 0, 0, 513, 0, Mozilla/4.0. Which action should the investigator prioritize?

Accepted Answer

Analyze the uploaded shell.aspx file for malicious content. The IIS log entry shows a successful POST (HTTP 200) to /uploads/shell.aspx, which is a classic indicator of a web shell upload. The investigator's priority is to analyze the uploaded file to determine its capabilities, persistence mechanisms, and any data exfiltration or lateral movement it may have enabled. This aligns with forensic best practices: preserve and examine the artifact before taking remediation steps.

Answer

Rebuild the web server from a clean backup

Answer

Delete the shell.aspx file immediately

Answer

Check the web server's firewall logs for the attacker's IP

Question 4

An analyst is preparing to analyze a RAID 5 array of three disks. The analyst wants to reconstruct the logical volume for file system analysis. Which THREE steps are essential in this process?

Accepted Answer

Use a tool like `mdadm` (Linux) or RAID reconstructor (Windows) to assemble the array. The essential first step is to assemble the RAID 5 set from the member disks using a tool such as mdadm on Linux or a RAID reconstructor on Windows, because the logical volume must be presented to the OS before file system analysis can occur (A). Before assembly, the analyst must determine the disk order and stripe (chunk) size, since RAID 5 distributes data across all members in a specific sequence and wrong parameters yield an unreadable volume (C). The analyst must also identify the parity rotation method (e.g., left-symmetric, right-asymmetric), because parity placement determines how each stripe's data and parity blocks are arranged and must match the original configuration (D). Zeroing the first sector (B) is destructive and unnecessary, as it would erase metadata needed for reconstruction, and running chkdsk on individual member disks (E) is invalid because each disk holds only fragments of the file system, not a complete volume.

Answer

Zero out the first sector of each disk to remove remnants of previous arrays

Answer

Run `chkdsk` on each individual disk before reconstruction

Question 5

Which TWO of the following are essential components of a computer forensics lab according to CHFI best practices?

Accepted Answer

Evidence storage area with controlled access. Option B is correct because CHFI best practices require a physically secure evidence storage area with controlled access to preserve the chain of custody and prevent tampering, theft, or contamination of digital evidence. Option E is correct because a forensic workstation loaded with specialized tools (e.g., EnCase, FTK, write blockers, and hashing utilities) is the core hardware/software platform needed to acquire, image, and analyze evidence without altering it. The other options are not essential lab components: a server farm (A) is unnecessary for typical forensic analysis, a public-facing website (C) would actually create security and confidentiality risks, and a coffee machine (D) is merely a convenience item with no forensic function.

Answer

Server farm for data processing

Answer

Public-facing website for case management

Answer

Coffee machine for staff convenience

Question 6

During a forensic examination, an analyst runs the following command: 'dd if=/dev/sda of=/mnt/evidence/image.dd bs=4k conv=noerror,sync'. The source drive has bad sectors. What is the effect of the 'conv=noerror,sync' option?

Accepted Answer

It fills the bad sectors with zeros in the output image, allowing the imaging to complete without errors.. The 'conv=noerror,sync' option in dd instructs the tool to continue reading even when encountering read errors (noerror) and to pad the output with zeros (sync) to maintain the original block size alignment. This ensures the forensic image is a complete bit-for-bit copy of the source drive, with bad sectors replaced by zeros, allowing the imaging process to finish without halting on errors.

Answer

It stops the imaging process when an error is encountered.

Answer

It skips the bad sectors and compresses the output.

Answer

It retries reading the bad sector multiple times before giving up.

Question 7

A malware analyst is performing static analysis on a packed executable. Which THREE techniques are effective for unpacking or analyzing packed malware? (Select THREE.)

Accepted Answer

Performing strings analysis on the packed binary. Performing strings analysis on a packed binary can reveal embedded strings, such as import hints, configuration data, or the original entry point (OEP), which may survive packing. While packing obfuscates many strings, some packers leave remnants that static analysis tools like `strings` can extract, providing initial clues about the malware's functionality without execution.

Answer

Renaming the file to .txt

Answer

Executing the sample in Cuckoo Sandbox

Question 8

A legal hold is issued by an organization's legal department. What is the primary purpose of a legal hold?

Accepted Answer

To preserve all relevant data that may be needed for a legal case. A legal hold is a directive issued by an organization's legal department to suspend the routine deletion or alteration of data that may be relevant to pending or reasonably anticipated litigation. Its primary purpose is to preserve all potentially relevant electronically stored information (ESI) and physical records in their current state, ensuring spoliation does not occur. This obligation arises under the Federal Rules of Civil Procedure (FRCP) Rule 37(e) and similar e-discovery regulations, which require organizations to take reasonable steps to preserve data once litigation is reasonably anticipated.

Answer

To notify employees that litigation is pending

Answer

To authorize law enforcement to seize computers

Answer

To encrypt all company data for security

Question 9

Which TWO of the following are valid methods to hide data on an NTFS file system without using external tools?

Accepted Answer

Embedding data in file slack space. A is correct because file slack space is the unused bytes between the end of a file's logical data and the end of its allocated cluster. On NTFS, when a file does not fill its last cluster, the remaining bytes (RAM slack and drive slack) can be written to without affecting the file's visible content. This is a native hiding method that requires no external tools, as the data is simply written to the slack region using standard file I/O operations.

Answer

Storing data in the NTFS file system journal ($LogFile)

Answer

Using the $Volume attribute in the MFT

Answer

Encrypting data with EFS

Question 10

A forensic investigator recovers a hard drive from a suspect's computer. The drive is detected as 120 GB in BIOS, but forensic tools report only 100 GB of addressable space. Which data hiding technique is MOST likely being used?

Accepted Answer

Host Protected Area (HPA). The Host Protected Area (HPA) is a region on a hard drive that is hidden from the operating system by using the ATA SET MAX ADDRESS command to reduce the reported addressable space. Since the BIOS detects the full 120 GB but forensic tools see only 100 GB, the HPA is the most likely technique, as it creates a hidden area beyond the reported maximum LBA that is not visible to standard forensic acquisition tools unless specifically addressed.

Answer

Device Configuration Overlay (DCO)

Answer

Volume slack

Answer

Alternate Data Streams (ADS)

Question 11

Which TWO tools are commonly used for static analysis of malware binaries?

Accepted Answer

IDA Pro. IDA Pro is a leading interactive disassembler and debugger used for static analysis of malware binaries. It allows analysts to examine executable code without executing it, by disassembling machine code into assembly language and providing cross-references, function graphs, and decompilation capabilities. This makes it essential for reverse engineering malicious software to understand its logic, embedded strings, and control flow.

Answer

Cuckoo Sandbox

Answer

Wireshark

Answer

Process Monitor

Question 12

An examiner is analyzing an Android device using Cellebrite UFED. The device is locked with a PIN, and the examiner has no PIN. Which acquisition type should the examiner attempt FIRST to maximize data recovery without destroying evidence?

Accepted Answer

Logical extraction via ADB backup. When an Android device is locked with a PIN and no PIN is known, a logical extraction via ADB backup is the safest first step. ADB backup (adb backup) can capture app data and system settings without requiring root or unlocking the bootloader, and it does not modify the device state, preserving evidence integrity. This method works if USB debugging was previously enabled, which is common in forensic acquisitions, and it avoids the risk of triggering lockout or data wiping that physical methods might cause.

Answer

Manual extraction by photographing the screen

Answer

File system extraction via ADB root shell

Answer

Physical extraction using a bootloader exploit

Question 13

A network forensic analyst captures packets and sees a TCP SYN packet sent to port 80, followed by a SYN-ACK, then an ACK, and then an HTTP GET request. What can be concluded?

Accepted Answer

The TCP connection was successfully established. The TCP three-way handshake (SYN, SYN-ACK, ACK) completes successfully, establishing a connection. The subsequent HTTP GET request confirms the connection is fully open and usable for application-layer data transfer. This is the standard sequence for a normal TCP connection establishment.

Answer

The session was hijacked after the handshake

Answer

A TCP half-open scan was performed

Answer

The connection was refused by the server

Question 14

Which THREE of the following are indicators of a webshell compromise on a web server?

Accepted Answer

High CPU usage from web server processes. Option A is correct because webshells often execute resource-intensive commands (cryptomining, brute-forcing, scanning, or reverse shells) through the web server's worker processes, so sustained high CPU usage by httpd/nginx/w3wp or their child processes is a common indicator. Option C is correct because attackers typically drop or upload webshell files into web-accessible directories, so unexpected .php, .asp, .aspx, or .jsp files that are not part of the original application are a strong sign of compromise. Option D is correct because a webshell commonly establishes command-and-control or exfiltration channels, producing unexpected outbound connections from the web server to unknown external IP addresses on unusual ports. Option B does not belong because legitimate successful logins with valid credentials are normal activity and are not, by themselves, an indicator of a webshell. Option E does not belong because a decrease in network traffic is not characteristic of webshell activity, which typically generates additional traffic rather than reducing it.

Answer

Regular successful logins to the server with correct credentials

Answer

Decrease in network traffic

Question 15

In Mac forensics, which artifact stores system-wide and per-user application preferences, often used to determine configured settings and recently accessed files?

Accepted Answer

.plist files. In macOS, application and system preferences are stored in property list (.plist) files. These XML or binary files contain key-value pairs that define configured settings, default values, and recently accessed files (e.g., NSRecentDocuments). Forensic examiners parse .plist files to recover user behavior, application usage, and system configuration.

Answer

Unified logging

Answer

Sqlite databases

Answer

FSEvents