CHFI Practice Test 39 — 15 Questions

Question 1

During a forensic examination of a Windows system infected with ransomware, the analyst finds that the file timestamps (creation, modification, access) for several critical system files have been altered to match legitimate Windows files. Which anti-forensic technique is MOST likely being used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Timestomping. Timestomping is the deliberate alteration of file timestamps (creation, modification, access) to mislead forensic investigators. In this scenario, the ransomware modified critical system file timestamps to match legitimate Windows files, which is the hallmark of timestomping. This technique is commonly used to evade timeline analysis and hide the true sequence of malicious activity.

Answer

Data hiding via ADS

Answer

Steganography

Answer

Log wiping

Question 2

An analyst extracts an iTunes backup from a Windows computer. The backup contains a file manifest.plist with cryptographic hashes. What is the primary purpose of these hashes in the backup process?

Accepted Answer

To verify the integrity of the backup files. The cryptographic hashes in an iTunes backup's manifest.plist file are used to verify the integrity of the backup files. Each hash corresponds to a file in the backup, allowing the system to detect any corruption or tampering by comparing the stored hash against a newly computed hash of the file data.

Answer

To compress the backup data

Answer

To index the backup for faster searching

Answer

To encrypt the backup files

Question 3

During a malware investigation, you find that a process named `svchost.exe` is making outbound connections to an IP address known to be malicious. What tool would be BEST to capture the network traffic for further analysis?

Accepted Answer

Wireshark. Wireshark is the best tool for capturing and analyzing network traffic because it can intercept packets at the network interface level, allowing you to inspect the full payload and headers of outbound connections from `svchost.exe` to the malicious IP. This enables deep analysis of protocols, data exfiltration attempts, and command-and-control communication patterns, which is essential in malware forensics.

Answer

PEiD

Answer

Process Explorer

Answer

Regshot

Question 4

A forensic examiner needs to acquire an image of a suspect's laptop hard drive. The laptop is running, and the examiner wants to capture volatile data first. According to best practices, which order of steps should the examiner follow?

Accepted Answer

Capture volatile data, then shut down normally, remove the drive, and image with a write blocker.. Forensic best practices mandate capturing volatile data (e.g., RAM, network connections, running processes) first, as this data is lost on power loss. After capturing volatile data, the examiner should perform a graceful shutdown to preserve file system integrity, then remove the drive and acquire a forensic image using a write blocker to prevent any modification to the original evidence.

Answer

Unplug the laptop, remove the drive, and boot the drive in a forensic workstation.

Answer

Immediately remove the hard drive, then capture RAM from the drive.

Answer

Create a full disk image over the network while the laptop is running.

Question 5

Which of the following is an example of an anti-forensics technique used to hide malicious activity?

Accepted Answer

Timestomping. Timestomping is an anti-forensics technique that deliberately modifies file timestamps (e.g., MAC times: Modified, Accessed, Created) using tools like `touch` on Linux or `SetFileTime` on Windows. By altering these timestamps, an attacker can hide the true timeline of malicious file creation, modification, or access, thereby evading forensic timeline analysis and making it appear that malicious activity occurred at a different time or was part of legitimate system operations.

Answer

Running a sandbox

Answer

Creating a mutex

Answer

Generating a hash

Question 6

A first responder arrives at a crime scene where a computer is running. According to standard forensic procedure, what should the responder do FIRST?

Accepted Answer

Photograph the scene and secure the area. The first priority at a live crime scene is to preserve the integrity of the scene and all potential evidence. Standard forensic procedure (e.g., from NIST SP 800-86 and ACPO guidelines) mandates that the first responder must photograph the scene to document the state of the computer (including screen contents, cables, and peripherals) and secure the area to prevent unauthorized access or tampering. Only after this documentation and scene stabilization can the responder proceed to handle the live system, such as capturing volatile data or creating a forensic image.

Answer

Connect a write blocker and create a forensic image immediately

Answer

Immediately shut down the computer to prevent data alteration

Answer

Pull the power cord to ensure the system does not shut down normally

Question 7

A forensic examiner uses a hardware write blocker when imaging a suspect's hard drive. What is the primary function of a hardware write blocker?

Accepted Answer

To prevent any data from being written to the suspect drive. A hardware write blocker is a device placed between the suspect drive and the forensic workstation that intercepts and blocks any write commands from the host system. Its primary function is to ensure that no data—such as file system metadata, temporary files, or operating system writes—can be written to the suspect drive, thereby preserving the original evidence in a forensically sound manner. This is critical for maintaining the integrity of the evidence and ensuring it is admissible in court.

Answer

To encrypt the data on the suspect drive

Answer

To connect the suspect drive via USB

Answer

To increase the speed of data acquisition

Question 8

During a forensic investigation, a first responder notices that a computer is running and suspects that volatile data may be present. According to best practices, what should the responder do to preserve the most volatile data first?

Accepted Answer

Capture the contents of RAM using a forensic tool, then shut down. Volatile data, such as the contents of RAM, is lost when power is removed. The first responder must capture this data using a forensic tool (e.g., FTK Imager, WinPmem, or LiME) before performing a shutdown. This follows the Order of Volatility (RFC 3227), which prioritizes capturing registers, cache, and RAM before any persistent storage.

Answer

Perform a graceful shutdown to avoid data corruption

Answer

Remove the hard drive immediately while the system is running

Answer

Immediately unplug the power cord to freeze the system state

Question 9

An analyst performs forensic imaging using the command: dcfldd if=/dev/sda of=image.dd hash=sha256 hashlog=hash.txt bs=4096 conv=noerror,sync. What is the PRIMARY purpose of the 'hash=sha256' and 'hashlog=hash.txt' parameters?

Accepted Answer

To ensure the image is an exact bit-for-bit copy and provide an integrity check.. The `hash=sha256` parameter instructs dcfldd to compute a SHA-256 hash of the input data as it is read, and `hashlog=hash.txt` writes that hash value to a separate file. This allows the analyst to later verify that the forensic image (`image.dd`) is an exact bit-for-bit copy of the source (`/dev/sda`) by recomputing the hash and comparing it to the stored value, ensuring data integrity and admissibility in court.

Answer

To encrypt the image file to prevent unauthorized access.

Answer

To compress the image to save disk space.

Answer

To split the image into smaller chunks for easier transport.

Question 10

During a network forensic investigation, the analyst examines firewall logs and notices a large number of outbound connections from an internal server to various IP addresses on port 443 at regular intervals. The connections are all initiated by a process called 'svchost.exe' running from a non-standard location (C:\Windows\Temp). What is the MOST likely explanation?

Accepted Answer

The server is infected with malware that is beaconing to a command-and-control server. Svchost.exe running from C:\Windows\Temp is a classic sign of malware masquerading as a legitimate Windows process. The regular outbound connections on port 443 (HTTPS) at fixed intervals indicate beaconing behavior, where the infected host periodically contacts a command-and-control (C2) server to receive instructions or exfiltrate data. Legitimate svchost.exe resides in C:\Windows\System32, and any deviation from this path is a strong indicator of compromise.

Answer

The server is running a scheduled backup to an external cloud service

Answer

The server is performing legitimate Windows Update checks

Answer

The server is being used as a proxy for internal users

Question 11

In MySQL forensics, which log file is most commonly used to detect unauthorized data exfiltration or changes to database records?

Accepted Answer

Binary log. The binary log is the correct choice because it records all changes to database data and structure (e.g., INSERT, UPDATE, DELETE, CREATE, ALTER) in a binary format that can be replayed for point-in-time recovery. In MySQL forensics, this log is the primary source for detecting unauthorized data exfiltration or modifications, as it captures the exact SQL statements or row changes that altered the database, along with timestamps and server IDs. Unlike other logs, the binary log is specifically designed to track every write operation, making it indispensable for reconstructing malicious activity.

Answer

Slow query log

Answer

General query log

Answer

Error log

Question 12

During a forensic investigation, you encounter a RAID 5 array consisting of three 1 TB disks. The array is failed, and you need to reconstruct the original data. Which of the following approaches is MOST appropriate for data recovery?

Accepted Answer

Use EnCase to perform a RAID rebuild with known parameters. EnCase Forensic has a built-in RAID reconstruction feature that can automatically rebuild a RAID 5 array from disk images when the RAID parameters (stripe size, parity rotation, disk order) are known or can be detected. This is the most appropriate approach for a failed RAID 5 array, as it handles the parity-based striping and reassembles the logical volume without requiring manual XOR operations or risking data corruption.

Answer

Mount each disk individually and copy files

Answer

Run `mdadm --assemble --scan` on the images

Answer

Use `dd` to image each disk and then XOR the three images together

Question 13

Which cloud service's audit logs would an investigator examine to identify who deleted a virtual machine in an Azure subscription?

Accepted Answer

Azure Activity Log. Azure Activity Log (formerly known as Audit Logs or Operational Logs) is the platform-level log that records all control-plane operations for Azure resources, including virtual machine creation, modification, and deletion. When a VM is deleted, the Activity Log captures the caller (user or service principal), the timestamp, the operation name (e.g., 'Microsoft.Compute/virtualMachines/delete'), and the status. An investigator would query the Activity Log to identify who initiated the deletion, making option B correct.

Answer

GCP Audit Logs

Answer

Azure AD Sign-in Logs

Answer

AWS CloudTrail

Question 14

Which of the following is an example of an indicator of compromise (IoC) that can be used to detect malware on a network?

Accepted Answer

A known malicious IP address. A known malicious IP address is a classic indicator of compromise (IoC) because it directly identifies a command-and-control (C2) server or a source of malicious traffic. Network monitoring tools can match outbound or inbound connections against threat intelligence feeds of known bad IPs, triggering an alert. This is a network-based IoC that requires no host-level analysis, making it ideal for initial detection.

Answer

A mutex name

Answer

A registry key modification

Answer

A file's MD5 hash

Question 15

After a factory reset on an Android device, a forensic examiner attempts to recover user data. Which of the following statements is most accurate regarding the recoverability of data?

Accepted Answer

Some user data may be recoverable from the /data partition if it has not been overwritten. A factory reset on Android typically performs a fast format of the /data partition, which only erases the file system metadata (e.g., ext4 journal and inode tables) but does not overwrite the actual data blocks. Therefore, user data may remain on the flash storage and be recoverable using forensic tools until those blocks are overwritten by new writes. This is why option A is correct: some user data may be recoverable from the /data partition if it has not been overwritten.

Answer

Data in /data/data/ is securely wiped using TRIM commands, making recovery impossible

Answer

All user data is permanently destroyed and cannot be recovered

Answer

Only Google account tokens are recoverable after a factory reset