CHFI Practice Test 37 — 15 Questions

Question 1

Which principle states that every contact leaves a trace?

Accepted Answer

Locard's exchange principle. Locard's exchange principle is the foundational forensic concept stating that whenever two objects come into contact, there is a transfer of material between them. In computer forensics, this means that digital activity—such as accessing a file, sending a packet, or connecting to a network—inevitably leaves traces in logs, memory, registry entries, or file metadata. This principle underpins the entire discipline of digital evidence recovery.

Answer

Chain of custody

Answer

Best evidence rule

Answer

Hearsay rule

Question 2

During a mobile forensic examination of an iPhone, the examiner wants to acquire the most data possible, including deleted files and unallocated space. Which acquisition type should be used?

Accepted Answer

Physical acquisition. Physical acquisition creates a bit-for-bit copy of the entire flash storage, including unallocated space and deleted file remnants. This is the only method that captures the raw NAND memory, allowing recovery of data from unallocated blocks and slack space that logical and file system acquisitions skip.

Answer

File system acquisition

Answer

Logical acquisition

Answer

Manual acquisition

Question 3

An Android device is found with factory reset performed. The forensic examiner wants to recover as much data as possible. Which of the following artefacts is MOST likely to survive a factory reset and provide useful evidence?

Accepted Answer

Data stored on the external SD card. Factory reset wipes the /data partition, which includes /data/data/ (app data), AccountManager tokens, and system configuration files like wpa_supplicant.conf. However, external SD cards are typically not formatted during a factory reset because they are user-removable storage. Therefore, data stored on the external SD card (e.g., photos, videos, app backups) often survives intact and can provide valuable forensic evidence.

Answer

Deleted SQLite records from /data/data/

Answer

Google account authentication tokens stored in AccountManager

Answer

Wi-Fi passwords from wpa_supplicant.conf

Question 4

What is the primary goal of the chain of custody in a digital forensic investigation?

Accepted Answer

To maintain the integrity and admissibility of evidence. The chain of custody is a documented chronological record that tracks the seizure, custody, control, transfer, analysis, and disposition of digital evidence. Its primary goal is to maintain the integrity and admissibility of evidence by proving that the evidence has not been tampered with or altered from the moment it was collected until it is presented in court. This is critical because any break in the chain can lead to evidence being deemed inadmissible under rules like the Federal Rules of Evidence (FRE) or the Daubert standard.

Answer

To encrypt the evidence during transport

Answer

To speed up the forensic analysis process

Answer

To ensure that the forensic tools used are properly licensed

Question 5

Which TWO of the following are common persistence mechanisms used by malware on Windows systems? (Select two.)

Accepted Answer

Scheduled Tasks. Scheduled Tasks (C) are a common persistence mechanism because malware can register a task via schtasks.exe or the Task Scheduler COM API to execute a payload at logon, on a schedule, or on system events, surviving reboots. Registry Run keys (E), such as HKLM\Software\Microsoft\Windows\CurrentVersion\Run and HKCU equivalents, are classic autostart locations that Windows processes at user logon, so malware placed there launches automatically each session. The other options are forensic artifacts rather than persistence methods: USBSTOR records historical USB mass-storage connections, Prefetch files evidence program execution for performance, and LNK files are shortcut artifacts often used for initial execution or user bait, not for maintaining persistence.

Answer

USBSTOR registry key

Answer

Prefetch files

Answer

LNK files

Question 6

An iOS forensic examiner recovers a Keychain dump from an iPhone. Which of the following types of data is typically NOT stored in the iOS Keychain?

Accepted Answer

SMS message content. The iOS Keychain is designed to store small, sensitive credentials such as passwords, keys, and certificates. SMS message content is stored in the SMS/MMS database (sms.db) under the protected /private/var/mobile/Library/SMS/ directory, not in the Keychain. Keychain items are encrypted per-app or per-service, whereas SMS messages are managed by the Messages app and stored in a SQLite database with its own encryption layer.

Answer

Wi-Fi passwords

Answer

Safari saved passwords

Answer

VPN credentials

Question 7

During an iOS forensic analysis, an examiner recovers the Keychain data from a backup. Which type of information is commonly stored in the iOS Keychain and can be extracted during analysis?

Accepted Answer

Wi-Fi passwords and website login credentials. The iOS Keychain is a secure, encrypted database designed to store sensitive user credentials and secrets. Wi-Fi passwords and website login credentials are explicitly stored in the Keychain to protect them from unauthorized access, making them recoverable during forensic analysis of a backup.

Answer

Text message content and attachments

Answer

Call log timestamps and durations

Answer

Contact photos and thumbnails

Question 8

Which TWO of the following are valid artifacts for determining program execution on a Windows system? (Select TWO.)

Accepted Answer

Jump Lists. Jump Lists (C) are valid artifacts because they are stored per-user in the AutomaticDestinations and CustomDestinations folders under %AppData%\Microsoft\Windows\Recent, and they record recently or frequently accessed files and applications, providing direct evidence of program execution. Prefetch files (D) are also valid because Windows creates a .pf file in C:\Windows\Prefetch for each executed application, containing the executable name, run count, and last-run timestamps, which directly demonstrates program execution. Pagefile.sys (A) is a virtual memory swap file, not an execution artifact, and System Restore points (B) are snapshots of system state used for rollback rather than proof of program execution. Windows Error Reporting logs (E) record crash and error telemetry, so they may indicate a program ran but are not a reliable or standard artifact for determining execution.

Answer

Pagefile.sys

Answer

System Restore points

Answer

Windows Error Reporting logs

Question 9

During a forensic acquisition of a suspect's SSD, the analyst notices that the drive supports TRIM. Which of the following is the most important consideration when acquiring the drive to preserve deleted data?

Accepted Answer

Use a hardware write-blocker and acquire the drive immediately to minimize TRIM interference. SSDs with TRIM support automatically issue commands to erase deallocated blocks, making deleted data unrecoverable. Using a hardware write-blocker and acquiring the drive immediately minimizes the time the drive is powered on, reducing the chance that the operating system or the SSD's garbage collection will issue TRIM commands that permanently wipe deleted data.

Answer

Perform a full format of the SSD before acquisition to clear any TRIM-related issues

Answer

Enable TRIM in the forensic tool to ensure the drive is optimized before imaging

Answer

The SSD should be powered on for several hours to allow TRIM to complete before imaging

Question 10

A forensic analyst needs to acquire RAM from a live Linux system for memory analysis. Which tool is specifically designed for this purpose and can capture memory without rebooting?

Accepted Answer

LiME. LiME (Linux Memory Extractor) is specifically designed to capture volatile memory from live Linux systems without requiring a reboot. It loads a kernel module that safely dumps RAM contents to a file, preserving the memory image for forensic analysis. Unlike dd, LiME handles memory-mapped I/O and avoids corrupting the system state during acquisition.

Answer

FTK Imager

Answer

Volatility

Answer

dd

Question 11

An investigator needs to recover a deleted partition from a disk that originally used an MBR partition table. Which tool can scan the disk for lost partitions and rebuild the partition table?

Accepted Answer

TestDisk. TestDisk is specifically designed for data recovery and can scan a disk for lost partitions by analyzing the underlying MBR (Master Boot Record) structure. It can rebuild the partition table by searching for partition boot sectors and file system signatures, allowing recovery of deleted or corrupted partitions. This makes it the correct tool for the scenario described.

Answer

FTK Imager

Answer

Autopsy

Answer

PhotoRec

Question 12

An email forensic analyst receives a suspicious email and examines the full headers. Which header field is the MOST reliable for determining the true originating IP address of the sender, assuming no spoofing of the header?

Accepted Answer

Received. The 'Received' header is the most reliable for determining the true originating IP address because each mail server that handles the email adds a new 'Received' field at the top of the header. The bottommost 'Received' header (the first one added) typically contains the IP address of the sender's MTA or the client's IP, assuming no spoofing. This field is sequentially added by each hop and is the primary source for tracing the email's path back to its origin.

Answer

Return-Path

Answer

Message-ID

Answer

From

Question 13

A company receives a legal hold notice regarding a lawsuit. What immediate action should the company take to comply?

Accepted Answer

Preserve all potentially relevant electronic documents and data. A legal hold notice triggers a duty to preserve all potentially relevant electronically stored information (ESI). Under the Federal Rules of Civil Procedure (FRCP) Rule 37(e), failure to preserve can lead to spoliation sanctions. The immediate action is to issue a litigation hold notice and suspend routine data deletion policies, ensuring that all relevant emails, documents, and logs are preserved in their current state.

Answer

Delete all emails older than 30 days to free up storage

Answer

Immediately format the hard drives of all employees involved

Answer

Ignore the notice because it is not a court order

Question 14

A forensic investigator is documenting evidence for a case. What is the PRIMARY purpose of maintaining an unbroken chain of custody for digital evidence?

Accepted Answer

To prove that the evidence has not been altered or tampered with.. The primary purpose of maintaining an unbroken chain of custody is to establish the integrity and authenticity of digital evidence by documenting every person who handled it, every transfer, and every access event. This documentation allows the court to verify that the evidence has not been altered, tampered with, or corrupted from the moment of seizure through analysis and presentation. Without a provable chain of custody, the evidence may be deemed inadmissible under rules like Federal Rule of Evidence 901 or similar standards in other jurisdictions.

Answer

To track the storage location of the evidence.

Answer

To speed up the investigation process.

Answer

To assign responsibility for the evidence to a single individual.

Question 15

After collecting digital evidence from a suspect's computer, the forensic examiner creates a forensic image using FTK Imager. The examiner then computes the MD5 hash of the original drive and the image file. Which of the following BEST describes the purpose of this hashing?

Accepted Answer

To verify that the image is an exact bit-for-bit copy of the original.. Hashing with MD5 (or SHA-1/SHA-256) produces a unique fixed-size digest of the data. By comparing the hash of the original drive to the hash of the forensic image, the examiner can confirm that the image is an exact bit-for-bit copy, ensuring the integrity of the evidence and that no data has been altered during acquisition.

Answer

To encrypt the data for secure storage.

Answer

To index the files for faster searching.

Answer

To reduce the storage size of the image.