CHFI Practice Test 50 — 15 Questions

Question 1

A forensic examiner is analyzing an Android device that has been factory reset. Which artefact is MOST likely to persist after a factory reset, providing potential evidence of prior usage?

Accepted Answer

Google account artefacts. Google account artefacts, such as the Google Services Framework (GSF) ID and the device's Google Account (GAIA) ID, may persist after a factory reset because they are often stored on a dedicated persistent partition (e.g., /persist or /misc) that is not erased by a standard reset. Forensic tools can recover these identifiers from that partition, providing evidence of prior usage. This is unlike user-generated data such as SMS, Wi-Fi passwords, or app logs, which reside in the /data partition and are typically wiped.

Answer

App installation logs

Answer

Deleted SMS messages

Answer

Wi-Fi passwords

Question 2

A security analyst suspects a mobile device is infected with malware that exfiltrates data via DNS queries. Which tool or technique would be MOST effective for detecting this behavior during dynamic analysis?

Accepted Answer

Wireshark to capture and analyze network packets for anomalous DNS queries. D is correct because DNS exfiltration involves encoding stolen data into DNS query fields (e.g., subdomains or TXT records) and sending them to a malicious server. Wireshark captures and analyzes raw network packets, allowing the analyst to inspect DNS query payloads for anomalous patterns such as unusually long hostnames, high query volume, or queries to suspicious domains, which are hallmarks of DNS tunneling.

Answer

PEiD to detect packers in the mobile app binary

Answer

Regshot to compare registry snapshots before and after execution

Answer

Process Monitor to observe registry and file system changes

Question 3

A forensic investigator needs to analyze the keychain data from an iOS device backup. Which tool is specifically designed to decrypt and display iOS keychain contents?

Accepted Answer

Elcomsoft Phone Breaker. Elcomsoft Phone Breaker is specifically designed to decrypt and display iOS keychain contents from backups, including passwords, tokens, and cryptographic keys. It leverages techniques such as brute-force, dictionary attacks, and GPU acceleration to recover the backup password, then extracts and decrypts the keychain data using its own implementation of the keychain decryption process, deriving the necessary encryption keys from the recovered backup password.

Answer

Cellebrite UFED

Answer

Oxygen Forensic Detective

Answer

Magnet AXIOM

Question 4

A forensic analyst is examining a SQLite database from an iOS device backup. The database contains a table named 'message' with columns 'ROWID', 'text', 'handle_id', and 'date'. This database is MOST likely part of which iOS system database?

Accepted Answer

SMS.db. The 'message' table with columns 'ROWID', 'text', 'handle_id', and 'date' is the core schema of the SMS.db database on iOS devices. This database stores iMessage and SMS/MMS messages, where 'handle_id' links to the 'handle' table for contact identifiers and 'date' stores the timestamp in Apple's absolute time (seconds since 2001-01-01). The presence of these specific columns confirms it is the SMS/Message database.

Answer

call_history.db

Answer

Calendar.db

Answer

AddressBook.db

Question 5

During a malware investigation, an analyst identifies a suspicious file that appears to be a Windows executable. Using PEiD, the analyst detects the file is packed with UPX. After unpacking, the analyst runs the file in a sandbox and observes it modifies the following registry key: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\MalService. What behavioural indicator is primarily demonstrated?

Accepted Answer

Persistence mechanism. The modification of the registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run\MalService is a classic persistence mechanism. By adding an entry to the Run key, the malware ensures that it executes automatically every time the user logs into the system, maintaining its presence across reboots.

Answer

Command and control communication

Answer

Anti-forensic technique (timestomping)

Answer

Privilege escalation attempt

Question 6

During an iOS forensics investigation, an examiner wants to extract call history records from an iPhone backup. Which SQLite database file should be examined?

Accepted Answer

call_history.db. In iOS forensics, call history records are stored in the SQLite database file named 'call_history.db' (or 'CallHistory.storedata' in newer iOS versions). This database contains tables such as 'call' and 'ZCALLRECORD' that log incoming, outgoing, and missed calls along with timestamps and durations. Examining this file directly from an iTunes backup or device extraction provides the examiner with the complete call log.

Answer

SMS.db

Answer

AddressBook.db

Answer

Calendar.sqlitedb

Question 7

During dynamic analysis of a malware sample, an analyst uses Process Monitor to monitor file system activity. The malware creates a file named 'C:\Users\Admin\AppData\Roaming\svchost.exe'. What does this likely indicate?

Accepted Answer

The malware is attempting to achieve persistence by placing a copy in a user directory. The creation of a file named 'svchost.exe' in the user's AppData\Roaming directory is a classic persistence technique. By placing a copy of itself with the name of a legitimate Windows system process (svchost.exe) in a user-writable location, the malware aims to execute automatically at startup (e.g., via a registry Run key or scheduled task) while evading suspicion. This is not a legitimate Windows update, as system files reside in C:\Windows\System32, not in a user profile directory.

Answer

The malware is a legitimate Windows update

Answer

The malware is extracting an archive

Answer

The malware is cleaning up temporary files

Question 8

During a forensic investigation, an analyst acquires a hard drive using a hardware write blocker. Which of the following is the PRIMARY reason for using a hardware write blocker?

Accepted Answer

To ensure that the operating system does not mount the drive as writable.. The primary reason for using a hardware write blocker is to physically intercept the SATA/IDE bus between the suspect drive and the forensic workstation, ensuring that only read commands (e.g., ATA READ DMA) are passed through while blocking any write commands (e.g., ATA WRITE DMA). This prevents the operating system from mounting the drive as writable, which would otherwise cause automatic writes (e.g., timestamp updates, journaling, or prefetch creation) that alter evidence and break the chain of custody.

Answer

To increase the transfer speed of the imaging process.

Answer

To bypass the drive's password protection.

Answer

To compress the data during imaging.

Question 9

A forensic analyst needs to create a forensic image of a suspect's hard drive using FTK Imager. Which of the following image formats is MOST appropriate for maintaining evidence integrity and allowing compression?

Accepted Answer

EnCase image format (.E01). FTK Imager natively supports the EnCase image format (.E01), which is the most appropriate choice because it maintains evidence integrity through embedded CRC32 and MD5/SHA-1 hash verification while also supporting optional compression. Unlike raw/DD images, .E01 files can be segmented and compressed without losing forensic integrity, making them ideal for both storage efficiency and court-admissible evidence.

Answer

ISO image format (.iso)

Answer

Advanced Forensic Format (AFF)

Answer

Raw/DD image (.dd)

Question 10

A security analyst arrives at a crime scene where a computer is turned on and the screen shows a document. What is the FIRST action the analyst should take according to forensic best practices?

Accepted Answer

Photograph the screen and surroundings, then proceed to document the scene.. The first priority at a live crime scene is to preserve the state of the system and its environment through documentation. Photographing the screen and surroundings captures volatile data (e.g., open documents, running processes, network connections) before any interaction alters the system. This aligns with the order of volatility and the principle of minimizing changes to the evidence.

Answer

Create a forensic image of the hard drive using a write blocker.

Answer

Open the Task Manager to check for suspicious processes.

Answer

Immediately unplug the power cord to preserve volatile data.

Question 11

Which US Constitutional amendment primarily governs the legality of searching and seizing digital devices?

Accepted Answer

Fourth Amendment. The Fourth Amendment protects against unreasonable searches and seizures, requiring law enforcement to obtain a warrant based on probable cause before searching or seizing digital devices. This directly governs the legality of accessing data on computers, smartphones, and storage media in forensic investigations.

Answer

Fifth Amendment

Answer

Fourteenth Amendment

Answer

First Amendment

Question 12

A first responder arrives at a scene where a computer is turned on and a user is logged in. What is the FIRST action the responder should take to preserve volatile evidence?

Accepted Answer

Collect volatile data such as RAM contents and running processes. Volatile data (e.g., RAM contents, running processes, network connections) is lost when power is removed. The first responder must collect this data before any shutdown or hardware removal, following the order of volatility (RFC 3227). This preserves critical evidence that cannot be recovered later.

Answer

Photograph the screen and then shut down the system normally

Answer

Immediately unplug the power cord to prevent data alteration

Answer

Remove the hard drive immediately for forensic imaging

Question 13

During a forensic investigation, the analyst needs to create a forensic image of a hard drive that also hashes the data during acquisition. Which command-line tool would be MOST appropriate for this task?

Accepted Answer

dcfldd. dcfldd is a modified version of dd that includes built-in hashing (e.g., MD5, SHA-1, SHA-256) during the imaging process, allowing the analyst to verify data integrity in real time without a separate hashing step. This makes it the most appropriate tool for creating a forensic image that also hashes the data during acquisition.

Answer

dd

Answer

fdisk

Answer

memdump

Question 14

A forensic examiner needs to verify the integrity of a forensic image after acquisition. Which of the following methods is the MOST reliable for ensuring the image has not been altered?

Accepted Answer

Calculating and comparing hash values (e.g., MD5 or SHA-1) of the original and the image.. Cryptographic hash functions like MD5 or SHA-1 produce a fixed-size digest that is uniquely tied to the data content. By comparing the hash of the original drive (or its bit-for-bit copy) with the hash of the forensic image, any single bit change in the image will result in a completely different hash value, providing mathematically strong integrity verification. This is the standard method recommended in forensic best practices (e.g., NIST SP 800-86) and is far more reliable than any metadata or size comparison.

Answer

Opening the image in a hex editor and visually inspecting the first few bytes.

Answer

Using the 'dir' command to list files and compare timestamps.

Answer

Comparing file sizes of the original drive and the image.

Question 15

An investigator creates a forensic image using dcfldd with the following command: dcfldd if=/dev/sdb of=image.dd hash=sha256 hashwindow=10M hashlog=hash.txt. What is the effect of the 'hashwindow=10M' parameter?

Accepted Answer

It divides the output into 10 MB chunks and hashes each chunk, logging the results. The `hashwindow=10M` parameter in dcfldd instructs the tool to compute a SHA-256 hash for every 10 MB segment (window) of the input data as it is being copied, and then log each segment's hash to the specified hashlog file. This allows the investigator to verify the integrity of individual chunks of the forensic image, which is useful for detecting corruption or tampering in specific regions of the image without rehashing the entire file.

Answer

It sets the input buffer size to 10 MB for performance

Answer

It verifies the hash of the input device in 10 MB windows before copying

Answer

It causes the tool to hash the entire image only after completion