CHFI Practice Test 47 — 15 Questions

Question 1

An analyst is examining a memory dump using Volatility and wants to identify network connections. Which TWO Volatility plugins can be used to list network connections?

Accepted Answer

netscan. The netscan plugin (option A) is correct because it scans memory for network artifacts such as TCP and UDP endpoints, including connections and listening sockets, and works across modern Windows versions by carving pool tags and structures. The connscan plugin (option D) is also correct because it scans physical memory for TCP connection objects (TCPT_OBJECT pool tags) and reports local and remote addresses and ports, making it suitable for older Windows memory images. The dlllist plugin (option B) only lists loaded DLLs per process, pstree (option C) shows parent-child process relationships, and pslist (option E) enumerates active processes; none of these directly list network connections.

Answer

dlllist

Answer

pstree

Answer

pslist

Question 2

Which THREE of the following are challenges specific to forensic analysis of solid-state drives (SSDs) compared to traditional hard disk drives (HDDs)? (Select three.)

Accepted Answer

The TRIM command can permanently erase deleted data. Option A is correct because the ATA TRIM command (and SCSI UNMAP) tells the SSD controller that blocks are no longer in use, allowing the drive to erase them via garbage collection, which can permanently destroy deleted data before an examiner images the drive. Option C is correct because wear leveling and garbage collection relocate logical blocks to different physical NAND pages transparently, so logical-to-physical mapping changes constantly and traditional file-carving based on physical offsets becomes unreliable. Option D is correct because many SSDs implement hardware-based full-disk encryption (e.g., OPAL/TCG or proprietary SED encryption) tied to the controller, and without the credential or a powered-on unlocked state the data is inaccessible even after chip-off. Option B is wrong because SSDs generally have lower, not higher, read latency than HDDs since there is no seek or rotational delay. Option E is wrong because bad-block remapping exists on both HDDs and SSDs and is not a challenge specific to SSD forensics.

Answer

SSDs have higher latency for read operations

Answer

Bad block remapping is more frequent on SSDs

Question 3

Which TWO of the following tools are commonly used for file carving in forensic investigations?

Accepted Answer

PhotoRec. PhotoRec (B) is a free, open-source file carving utility from the TestDisk suite that recovers files by scanning raw disk images or devices for known file signatures (headers/footers), ignoring the filesystem, which is exactly what file carving means. Foremost (C) is another classic carving tool originally developed for the U.S. Air Force OSI, which uses a configurable header/footer signature database (foremost.conf) to extract files from disk images and is widely cited in forensic curricula. Autopsy (A) is a full digital forensics platform (a GUI front-end to The Sleuth Kit) that performs timeline, keyword, and artifact analysis; although it can invoke carving, it is not primarily a carving tool. EnCase (D) is a commercial forensic suite for imaging and analysis rather than a dedicated carver. Wireshark (E) is a network protocol analyzer that captures and inspects packet traffic, unrelated to recovering files from storage media.

Answer

Autopsy

Answer

EnCase

Answer

Wireshark

Question 4

Which THREE of the following are valid memory forensic artifacts that can be extracted using the Volatility framework?

Accepted Answer

pstree. The Volatility framework provides plugins that parse a memory image and reconstruct kernel-level data structures, so pstree (A) is valid because it walks the active process list and renders the parent-child process hierarchy from the EPROCESS structures. pslist (B) is also valid because it enumerates active processes by traversing the doubly linked list of EPROCESS objects in the kernel, a core memory-forensic artifact. netscan (D) is valid because it recovers network connection and socket artifacts (TCP/UDP endpoints, listening ports, owning PIDs) from memory pool structures. By contrast, ls -l (C) is a Linux shell command for listing filesystem directory entries, and dir /r (E) is a Windows CMD command for listing files with alternate data streams; neither is a Volatility plugin nor a memory artifact extraction technique.

Answer

ls -l

Answer

dir /r

Question 5

Which TWO Windows artifacts can be used to identify recently accessed files or folders on a system? (Select the two best answers.)

Accepted Answer

LNK files. LNK files (option D) are Windows shortcut files that store a reference to the original target file or folder, including its path, volume information, and timestamps, and they are created or updated when a user opens a document or folder, making them a direct indicator of recent access. ShellBags (option E) are registry entries (in NTUSER.DAT under HKCU\Software\Microsoft\Windows\Shell) that record folder view settings and paths the user has browsed in Explorer, so they reveal folders that were accessed even if the folder no longer exists. Event ID 4624 (option A) is a Security log entry for successful logon events and does not record file or folder access. The SAM hive (option B) stores local user account and password hash data, not file access history. Prefetch files (option C) record execution of applications to speed up subsequent launches, not the opening of individual files or folders.

Answer

Event ID 4624

Answer

SAM hive

Answer

Prefetch files

Question 6

Which TWO of the following are commonly used tools for file carving (recovering files based on file signatures)? (Select TWO.)

Accepted Answer

Foremost. Foremost (B) is a classic file-carving tool originally developed for the U.S. Air Force OSI that scans raw disk images or unallocated space and reconstructs files by matching known file headers, footers, and internal structures defined in its configuration file (foremost.conf). Scalpel (E) is a high-performance carving tool derived from Foremost that uses a configurable header/footer signature database (scalpel.conf) to extract files from disk images, making it a standard choice for signature-based recovery. Nmap (A) is a network port scanner and host-discovery tool, not a file-carving utility. Wireshark (C) is a network protocol analyzer that captures and inspects packet data, not files on storage media. John the Ripper (D) is a password-cracking tool that tests hashes against wordlists and rules, which is unrelated to recovering files by their signatures.

Answer

Nmap

Answer

Wireshark

Answer

John the Ripper

Question 7

Which TWO of the following are Volatility plugins used for process enumeration? (Select two.)

Accepted Answer

pslist. pslist (A) is a Volatility plugin that walks the active process list from the kernel's EPROCESS linked list (via PsActiveProcessHead) and prints each running process with its PID, PPID, and start time, making it a core process-enumeration plugin. pstree (C) is also a process-enumeration plugin: it uses the same process data but renders it as a parent/child tree based on PPID relationships, which helps reveal process ancestry and hidden or orphaned processes. The other options serve different forensic purposes: netscan (B) enumerates network sockets and connections, mftparser (D) parses the MFT to recover file-system metadata, and hashdump (E) extracts password hashes from the SAM registry hive, so none of them are process-enumeration plugins.

Answer

netscan

Answer

mftparser

Answer

hashdump

Question 8

Which two of the following are tools used for memory forensics acquisition? (Choose TWO.)

Accepted Answer

WinPmem. WinPmem (C) is a memory acquisition tool that captures physical memory from live Windows systems into a raw image file, making it a correct choice for memory forensics acquisition. LiME (E) is a Loadable Kernel Module for Linux that acquires volatile memory to a file or over the network, and it is specifically designed for memory acquisition, so it is also correct. Autopsy (A) is a graphical digital forensics platform used primarily for disk image analysis and file system examination, not memory acquisition. FTK Imager (B) is used for creating forensic disk images and mounting images, not for capturing RAM. Volatility (D) is a memory analysis framework that parses memory images after acquisition, so it is not an acquisition tool.

Answer

Autopsy

Answer

FTK Imager

Answer

Volatility

Question 9

An analyst is examining a Windows 10 system and suspects the use of NTFS alternate data streams (ADS) to hide malicious executables. Which THREE methods can the analyst use to detect hidden ADS on the system?

Accepted Answer

Checking the $MFT for $DATA attributes where the attribute name is not empty. Option A is correct because NTFS alternate data streams are stored as additional $DATA attributes within a file's MFT record, so parsing the $MFT and looking for $DATA attributes whose name field is non-empty directly reveals the existence of named streams. Option B is correct because Sysinternals streams.exe is purpose-built to enumerate NTFS alternate data streams on files, directories, or entire drives, making it a standard forensic and administrative detection tool. Option E is correct because the Windows `dir /r` switch displays alternate data streams associated with files, listing each stream name and its size alongside the normal file listing. Option C is not a reliable detection method because `dir` reports the logical file size while raw sector counts include allocation and metadata differences, so discrepancies do not specifically indicate ADS. Option D is incorrect because `sfc /scannow` only verifies and repairs the integrity of protected Windows system files and does not enumerate or report alternate data streams.

Answer

Comparing file sizes from `dir` output with raw disk sector counts

Answer

Running `sfc /scannow` to verify system file integrity

Question 10

Which two of the following are characteristics of the ext4 file system? (Choose TWO.)

Accepted Answer

Uses a journal to maintain file system consistency. Option C is correct because ext4 is a journaling file system: it writes metadata (and optionally data) changes to a journal before committing them to the main file system, so an interrupted operation can be replayed or rolled back to keep the file system consistent. Option E is correct because ext4 introduced extents, which describe a contiguous range of blocks with a single descriptor instead of one pointer per block, reducing fragmentation overhead and improving performance for large files. Option A is wrong because the Master File Table ($MFT) is an NTFS structure, not an ext4 one. Option B is wrong because a file allocation table (FAT) belongs to FAT12/FAT16/FAT32, whereas ext4 uses inodes and block bitmaps. Option D is wrong because ext4 uses H-tree (hashed B-tree) indexing for directory entries, not a plain B-tree structure.

Answer

Uses a Master File Table ($MFT) to store file metadata

Answer

Uses a file allocation table (FAT) to track clusters

Answer

Stores directory entries in a B-tree structure

Question 11

A forensic analyst is recovering deleted files from an ext3 file system. Which TWO methods can be used to recover deleted inodes?

Accepted Answer

Analyzing the ext3 journal for deleted inode entries. Option C is correct because the ext3 journal (introduced with journaling) retains metadata transactions, including records of inode allocations and deletions, so analyzing the journal with tools like ext3grep or jls can reveal deleted inode entries and their associated block pointers. Option E is correct because deleted inodes often remain in the inode table with their link count set to zero and are not immediately overwritten; scanning the inode table (e.g., with debugfs's lsdel or by walking inode structures) can identify these orphan inodes and recover their data. Option A is incorrect because file carving tools like Foremost operate on raw data streams and file signatures, not on inode structures, so they do not recover deleted inodes. Option B is incorrect because dd merely creates a bit-for-bit raw image of the disk and performs no inode recovery itself. Option D is incorrect because using debugfs to display the superblock only shows file system metadata such as block counts and mount status, not deleted inode entries.

Answer

Using file carving tools like Foremost

Answer

Using dd to create a raw image

Answer

Using debugfs to display the superblock

Question 12

An investigator is analyzing a Windows system and wants to find evidence of USB device usage. Which TWO registry keys should be examined? (Select TWO.)

Accepted Answer

HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR. Option C, HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR, is correct because this key is where Windows records every USB mass-storage device that has ever been connected, storing device instance IDs, vendor/product identifiers, and serial numbers that directly evidence USB storage usage. Option D, HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2, is correct because it tracks per-user mount points and drive-letter assignments for mounted volumes, including USB drives, showing which user mounted which removable device. Option A, HKLM\SAM\SAM, is incorrect because the SAM hive stores local account and group security data, not USB device artifacts. Option B, HKCU\Software\Microsoft\Windows\CurrentVersion\Run, is incorrect because it lists programs configured to auto-start at logon, which is persistence-related rather than USB-usage evidence. Option E, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList, is incorrect because it maps user SIDs to profile paths, not USB device connections.

Answer

HKLM\SAM\SAM

Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Run

Answer

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

Question 13

A forensic analyst is examining a Windows system and wants to identify recently accessed files and programs. Which TWO artifacts should the analyst prioritize? (Select TWO.)

Accepted Answer

Jump Lists. Jump Lists (A) are correct because they are per-application AutomaticDestinations/CustomDestinations files stored under the user's AppData\Roaming\Microsoft\Windows\Recent\ folder that record recently and frequently opened files and programs, directly matching the goal of identifying recently accessed items. Prefetch files (C) are correct because Windows creates .pf files in C:\Windows\Prefetch that track program execution, including run counts and last-run timestamps, which reveal recently executed programs. Event ID 4624 (B) is a Security log entry for successful logons, showing account authentication rather than file or program access. System Restore points (D) are snapshots used for system rollback and do not directly enumerate recently accessed files or programs. The SAM registry hive (E) stores local user account and credential data, not recent file or program usage.

Answer

Event ID 4624 logs

Answer

System Restore points

Answer

SAM registry hive

Question 14

Which TWO of the following are Windows artifacts that can provide evidence of file execution, including timestamps and paths?

Accepted Answer

Prefetch files (*.pf). Prefetch files (*.pf) are correct because Windows creates them in C:\Windows\Prefetch when applications execute, and each .pf file records the executable name, run count, last-run timestamps, and referenced file/directory paths, directly evidencing execution. LNK files are correct because Windows shortcut files, typically found in Recent Items, Office Recent, or Jump Lists, store the target path, volume information, and MAC timestamps of the referenced file, showing that a file was opened or executed. Event ID 4720 is not correct because it records user account creation in the Security log, not file execution. The SAM registry hive is not correct because it stores local account and group information, including password hashes, not execution evidence. Pagefile.sys is not correct because it is virtual memory swap space that may contain residual data but is not a structured artifact specifically recording file execution timestamps and paths.

Answer

Event ID 4720

Answer

SAM registry hive

Answer

Pagefile.sys

Question 15

An analyst is reviewing a Linux system for signs of a rootkit. Which THREE of the following are common indicators of a rootkit infection? (Select THREE.)

Accepted Answer

Anomalies in the /proc filesystem. Option B is correct because a rootkit often hooks or hides processes, files, and network sockets by tampering with the kernel's virtual /proc filesystem, so discrepancies between /proc entries and tools like ps or ls, or missing PIDs, are a classic anomaly. Option D is correct because rootkits frequently install malicious loadable kernel modules (LKMs) to intercept syscalls and conceal their presence, so unexpected or unsigned modules in lsmod//proc/modules are a strong indicator. Option E is correct because rootkits commonly replace or trojanize core system binaries such as ls, ps, netstat, and top so they omit the attacker's processes and files, which can be detected via package verification (rpm -V, debsums) or checksum comparison. Option A is not a typical rootkit indicator, since incorrect permissions on /etc/passwd usually reflect misconfiguration or a separate privilege/account issue rather than kernel-level concealment. Option C is also not specific to rootkits, as a high volume of failed SSH logins indicates brute-force or credential-stuffing attempts, not the stealth mechanisms a rootkit employs.

Answer

Incorrect file permissions on /etc/passwd

Answer

Large number of failed SSH login attempts