CHFI Practice Test 43 — 15 Questions

Question 1

A forensic examiner needs to acquire the RAM from a Windows 10 system without altering the contents. Which tool is MOST appropriate for this task?

Accepted Answer

WinPmem. WinPmem is the most appropriate tool for acquiring RAM from a Windows 10 system because it is specifically designed for memory acquisition on Windows platforms, using the WinPmem driver to access physical memory without modifying the contents. It supports both 32-bit and 64-bit systems and can output raw memory images or other formats, ensuring forensic soundness by minimizing interaction with the target system.

Answer

FTK Imager

Answer

LiME

Answer

dd

Question 2

A SOC analyst is analyzing a packet capture from a network where an internal host communicated with a known malicious IP. The analyst uses Wireshark and applies a display filter to isolate all HTTP traffic. Which filter expression should he use?

Accepted Answer

http. The correct filter is 'http' because in Wireshark, simply typing 'http' as a display filter captures all HTTP traffic, including both requests and responses. This is the most straightforward way to isolate all HTTP packets without limiting to a specific direction or port.

Answer

http.request

Answer

ip.proto == 6

Answer

tcp.port == 80

Question 3

In the context of cloud forensics, what is the primary challenge associated with volatile evidence in Infrastructure as a Service (IaaS) environments?

Accepted Answer

Evidence can be lost when the cloud instance is stopped or terminated. Volatile evidence such as memory and running processes disappears when an instance is stopped or terminated, making timely acquisition critical.

Answer

Evidence may be stored across multiple jurisdictions

Answer

Encryption of data at rest prevents access to evidence

Answer

Cloud providers may not allow forensic investigators to access the physical hardware

Question 4

During an iOS forensic examination, an analyst extracts an iTunes backup and finds a file named 'SMS.db'. Which of the following tools is BEST suited to parse and analyze this SQLite database for SMS and iMessage content?

Accepted Answer

SQLite Browser. SQLite Browser is the best tool for parsing and analyzing the 'SMS.db' file because it is a free, open-source SQLite database viewer that allows direct querying and inspection of the database schema, tables, and records. Since 'SMS.db' is a standard SQLite database containing SMS and iMessage data in iOS backups, SQLite Browser provides the most straightforward and cost-effective method for manual forensic analysis without relying on proprietary extraction tools.

Answer

GrayKey

Answer

Oxygen Forensic Detective

Answer

Cellebrite UFED

Question 5

An investigator recovers a suspicious file from a compromised system. Using PEiD, the file is detected as 'UPX 0.89.6 - 1.02 / 1.05 - 1.24'. What is the MOST appropriate next step in the analysis?

Accepted Answer

Unpack the file using the UPX tool or manual unpacking to obtain the original executable.. The PEiD detection of 'UPX 0.89.6 - 1.02 / 1.05 - 1.24' confirms the file is packed with UPX (Ultimate Packer for eXecutables). Packing obfuscates the original code and often evades static analysis. The most appropriate next step is to unpack the file using the UPX tool (with the -d switch) or manual unpacking to recover the original executable for deeper static and dynamic analysis.

Answer

Delete the file as it is likely a false positive from a legitimate UPX-packed application.

Answer

Submit the packed file to VirusTotal to obtain a hash-based detection report.

Answer

Run the file in a sandbox without unpacking to observe dynamic behavior.

Question 6

According to Locard's exchange principle, which of the following is TRUE in a digital forensic context?

Accepted Answer

A suspect will always leave traces of their activity on a computer system.. In a digital forensic context, Locard's exchange principle holds that whenever a suspect interacts with a computer system, they will inevitably leave traces of that activity. This can include artifacts such as registry entries, log files, prefetch files, browser history, or metadata, even if the user attempts to delete or obfuscate their actions. The principle underpins the entire field of digital forensics, asserting that digital interaction always produces residual data.

Answer

Only physical evidence, not digital evidence, is subject to exchange.

Answer

Digital evidence is always volatile and cannot be preserved.

Answer

The absence of evidence proves the suspect is innocent.

Question 7

During a forensic investigation, an analyst creates a bit-for-bit copy of a suspect's hard drive using the 'dd' command with the following parameters: dd if=/dev/sda of=/evidence/image.dd bs=4k conv=noerror,sync. What is the purpose of 'conv=noerror,sync'?

Accepted Answer

To ignore read errors and pad with zeros. 'conv=noerror,sync' tells dd to continue reading even when encountering read errors (noerror) and to pad the output with zeros (sync) to maintain the same total size as the original drive. This ensures a complete forensic image is created despite bad sectors, preserving the integrity of the acquisition for analysis.

Answer

To hash the output image

Answer

To ensure the command runs with superuser privileges

Answer

To compress the output image

Question 8

During a forensic investigation, the analyst runs netstat -ano on a compromised workstation. Based on the exhibit, which connection is MOST suspicious and should be investigated further?

Accepted Answer

The established HTTPS connection to 203.0.113.5:443 (PID 5678).. The established HTTPS connection to 203.0.113.5:443 (PID 5678) is most suspicious because it is an external IP address (not in the private RFC 1918 range) with an established TCP connection, indicating active data transfer. In a forensic context, an outbound HTTPS connection to an unknown external IP is a common indicator of command-and-control (C2) communication or data exfiltration, especially when the PID can be traced to an unknown or malicious process.

Answer

The DNS query to 192.168.1.1:53 in TIME_WAIT state.

Answer

The UDP listener on port 5353 (mDNS) with PID 910.

Answer

The listening RDP service on port 3389 (PID 1234).

Question 9

In a UK-based investigation, which legal framework governs the search and seizure of digital evidence?

Accepted Answer

PACE (Police and Criminal Evidence Act). The Police and Criminal Evidence Act 1984 (PACE) provides the legal framework for police powers, including search and seizure of digital evidence in the UK.

Answer

Electronic Communications Privacy Act

Answer

Fourth Amendment

Answer

GDPR

Question 10

During a forensic analysis of an SSD, the analyst encounters challenges due to TRIM and wear-leveling. Which TWO statements accurately describe the impact of these features on data recovery?

Accepted Answer

TRIM immediately and permanently erases deleted file data at the block level. A is correct because TRIM commands (ATA Data Set Management command) instruct the SSD controller to immediately erase invalidated logical block addresses (LBAs) at the block level, making the original data unrecoverable via standard forensic tools. This is not a simple deletion of file system metadata but a physical erasure of the underlying NAND flash cells, which prevents recovery of the file content even with advanced carving techniques.

Answer

Both TRIM and wear-leveling are transparent to the operating system and have no impact on forensic analysis

Answer

Wear-leveling ensures that deleted files are overwritten with zeros to prevent forensic recovery

Answer

TRIM is only effective on HDDs, not SSDs

Question 11

Which mobile forensic tool is commonly used to perform a physical extraction of an iOS device, including bypassing the lock screen on certain models?

Accepted Answer

GrayKey. GrayKey is a specialized hardware tool designed by Grayshift that performs physical extraction of iOS devices, including bypassing the lock screen on certain models (e.g., iPhone 5 through iPhone X) by exploiting bootrom vulnerabilities or using brute-force techniques. It is widely used in law enforcement for forensic acquisition of iOS devices where logical extraction is insufficient.

Answer

Magnet AXIOM

Answer

Oxygen Forensic Detective

Answer

FTK Imager

Question 12

A security analyst is using Wireshark during a malware analysis session. The analyst observes a series of DNS queries to a domain 'malware-c2.example.com' every 60 seconds. This behavior is indicative of which malware characteristic?

Accepted Answer

Command and control (C2) communication. The periodic DNS queries to 'malware-c2.example.com' every 60 seconds are a classic heartbeat or beaconing mechanism used by malware to maintain persistent communication with its command and control (C2) server. This regular check-in allows the attacker to send commands or receive stolen data without requiring the malware to initiate a direct connection, which could be blocked by firewalls. The fixed interval and specific domain indicate a programmed C2 channel rather than a one-time data transfer or tunneling technique.

Answer

Data exfiltration

Answer

DNS tunneling

Answer

Propagation via network scanning

Question 13

Under the US Fourth Amendment, when is a warrant generally NOT required for a computer search and seizure?

Accepted Answer

When the suspect has given consent. Under the Fourth Amendment, a warrant is generally required for searches and seizures, but one well-established exception is voluntary consent. When a suspect freely and knowingly agrees to a search of their computer or digital device, law enforcement may proceed without a warrant, provided the consent is not coerced and the scope of the search is not exceeded. This principle applies regardless of whether the data is stored locally or remotely, as long as the consenting party has actual or apparent authority over the device or data.

Answer

When the evidence is stored in the cloud

Answer

When the computer is owned by a corporation

Answer

When the investigation involves a civil case

Question 14

In a UK-based investigation, the police seize a computer without a warrant. The suspect's lawyer argues that the evidence is inadmissible because it violates which law?

Accepted Answer

Police and Criminal Evidence Act (PACE). The Police and Criminal Evidence Act (PACE) 1984 governs the powers of police in England and Wales to search, seize, and retain evidence. Without a warrant, the seizure of a computer likely violates PACE's requirements for lawful entry and seizure, making the evidence inadmissible under UK law.

Answer

Fourth Amendment to the US Constitution

Answer

General Data Protection Regulation (GDPR)

Answer

Computer Misuse Act

Question 15

During an iOS forensics investigation, an examiner extracts an iTunes backup and finds the SQLite database files. Which TWO of the following databases are LEAST likely to contain forensically relevant artefacts for a communication analysis?

Accepted Answer

data_ark.db. B is correct because data_ark.db is not a standard iOS SQLite database; it does not exist in typical iOS backups or file systems. The name suggests a fabricated or non-standard artefact, making it least likely to contain forensically relevant communication data. In contrast, databases like SMS.db and call_history.db are well-documented repositories for SMS messages and call logs, respectively.

Answer

SMS.db

Answer

AddressBook.db

Answer

call_history.db