CHFI Practice Exam 51 — 20 Questions

Question 1

A forensic analyst creates a forensic image of a hard drive using the dd command: dd if=/dev/sda of=/evidence/image.dd bs=4096 conv=noerror,sync. What is the purpose of the 'conv=noerror,sync' option?

Accepted Answer

It continues on read errors and pads the output with zeros to maintain the same size. The `conv=noerror,sync` option in the `dd` command instructs the tool to continue processing when a read error is encountered (`noerror`) and to pad the output block with zeros (`sync`) to maintain the same total size as the original drive. This ensures that the forensic image remains a bit-for-bit copy in terms of size, even if physical sectors are unreadable, preserving the integrity of the acquisition process for analysis.

Answer

It verifies the hash of the image after creation

Answer

It synchronizes the output with the input to ensure data integrity

Answer

It enables direct memory access for faster imaging

Question 2

A forensic analyst needs to collect evidence from a running Windows system without altering the system state. Which tool should they use to acquire volatile memory?

Accepted Answer

DumpIt. DumpIt is a lightweight memory acquisition tool designed specifically for capturing the contents of volatile memory (RAM) on a running Windows system. It minimizes interaction with the system to avoid altering the memory state, making it ideal for forensic collection of live evidence.

Answer

Wireshark

Answer

dd

Answer

Tableau write blocker

Question 3

An investigator seizes a computer that was involved in a crime. The suspect claims that the evidence was planted. Which forensic principle best helps to refute this claim by demonstrating that the evidence could only have been left by the suspect?

Accepted Answer

Locard's exchange principle. Locard's exchange principle states that every contact leaves a trace. In digital forensics, this means the suspect's interaction with the computer—such as typing, accessing files, or connecting peripherals—will leave unique digital artifacts (e.g., registry keys, prefetch files, USB device serial numbers, or browser history). By demonstrating that these artifacts could only have been created by the suspect's specific actions or device, the investigator refutes the claim of planting.

Answer

Hearsay rule

Answer

Best evidence rule

Answer

Chain of custody

Question 4

An analyst is investigating a possible data exfiltration via email. The analyst notices that the email headers contain a DKIM-Signature field that is invalid. Which of the following does a failed DKIM check indicate?

Accepted Answer

The email's content has been modified since it was signed. A failed DKIM check indicates that the email's content has been modified since it was signed by the sending domain's private key. DKIM uses an asymmetric cryptographic signature (typically RSA or ECDSA) to ensure the integrity of specific header fields and the body hash. When the signature verification fails, it means the hash computed from the received message does not match the decrypted hash from the signature, proving tampering or corruption.

Answer

The email was sent through a proxy server

Answer

The email client does not support DKIM

Answer

The email was sent from a different domain than the one in the From field

Question 5

A forensic analyst is examining a Docker container image for malware. Which TWO techniques can help analyze the image layers?

Accepted Answer

Use 'docker history' to view the build history of the image. Option A is correct because 'docker history' displays the image's build history, showing each layer's creation command (from the Dockerfile instructions), sizes, and IDs, which lets a forensic analyst trace what was executed or added during the build and spot suspicious layers. Option D is correct because 'docker save' exports the full image (all layers plus metadata) as a tar archive, which can be extracted to inspect each layer's filesystem contents directly, including deleted or hidden files, without running the container. Option B is not suitable because 'docker images' only lists image names, tags, sizes, and IDs on the host; it provides no layer-level detail. Option C is not the best fit because 'docker inspect' returns image metadata (config, environment, entrypoint, layer digests) but not the actual layer contents or build commands needed for deep layer analysis. Option E is incorrect because 'docker export' flattens a running container's filesystem into a single tar, losing the layer history and structure, and it targets containers rather than images.

Answer

Use 'docker images' to list all images

Answer

Use 'docker inspect' to view the image metadata

Answer

Use 'docker export' on a running container

Question 6

During a Linux forensic investigation, you find that the /var/log/auth.log file contains log entries showing multiple 'Failed password for root' messages from a single IP address, followed by a 'Accepted password for root' entry. What is the MOST likely conclusion?

Accepted Answer

An attacker successfully brute-forced the root password. The sequence of multiple 'Failed password for root' entries followed by an 'Accepted password for root' entry from the same IP address is the classic signature of a successful brute-force attack against the root account. SSH authentication logs record each attempt, and a successful login after repeated failures indicates that the attacker guessed or cracked the password, not that a privilege escalation or lockout occurred.

Answer

The root user accidentally mistyped the password multiple times

Answer

The system was compromised via a privilege escalation exploit

Answer

The root account has been locked out due to multiple failures

Question 7

A forensic analyst is investigating a Windows system for evidence of malware persistence. Which TWO registry locations are commonly used by malware to automatically execute on system startup?

Accepted Answer

HKLM\SYSTEM\CurrentControlSet\Services. Option D, HKLM\SYSTEM\CurrentControlSet\Services, is correct because this registry hive stores service configurations, including the Start value that determines whether a service (or malicious driver/service) launches automatically at boot, making it a classic autostart persistence location. Option E, HKCU\Software\Microsoft\Windows\CurrentVersion\Run, is correct because the per-user Run key causes listed programs to execute automatically when that user logs on, a very common malware persistence mechanism. Option A, HKLM\SAM, is not an autostart location; it stores local account and security database information. Option B, C:\Windows\Prefetch, is a filesystem artifact used for execution evidence and performance, not a registry startup key. Option C, HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellBags, records folder view settings and is useful for user activity forensics, not automatic execution.

Answer

HKLM\SAM

Answer

C:\Windows\Prefetch

Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellBags

Question 8

Which TWO of the following are tools that can be used for timeline analysis in digital forensics?

Accepted Answer

log2timeline. log2timeline (C) is correct because it is the original Perl-based tool designed to parse many artifact sources and generate a bodyfile of timestamped events, which is the foundational step of building a forensic timeline. Plaso (E) is correct because it is the successor to log2timeline, and its psort.py utility correlates and sorts the parsed events into a super-timeline for chronological analysis. Wireshark (A) is a network protocol analyzer for capturing and inspecting packet traffic, not a timeline generator. Nmap (B) is a network discovery and port-scanning tool used for host and service enumeration. FTK Imager (D) is an imaging and preview tool for acquiring and browsing forensic images, not a timeline analysis tool.

Answer

Wireshark

Answer

Nmap

Answer

FTK Imager

Question 9

During a forensic investigation of a compromised Linux server, an analyst checks /var/log/auth.log and finds multiple entries like "Failed password for root from 10.0.0.5 port 22 ssh2". Which tool is BEST suited to analyze the timeline of these events?

Accepted Answer

log2timeline. C is correct because log2timeline (part of the Plaso framework) is specifically designed to parse multiple log sources, including /var/log/auth.log, and create a super timeline that correlates events by timestamp. This allows the analyst to reconstruct the exact sequence of failed SSH login attempts from 10.0.0.5, which is essential for timeline analysis in forensic investigations.

Answer

Nmap

Answer

Wireshark

Answer

Autopsy

Question 10

During a forensic investigation, an analyst uses a hardware write blocker to connect a suspect hard drive to a forensic workstation. Which of the following is the PRIMARY reason for using a write blocker?

Accepted Answer

To prevent any modification to the suspect drive during acquisition. The primary reason for using a hardware write blocker is to ensure that the suspect drive is connected in a read-only manner, preventing any write operations from the forensic workstation from reaching the drive. This preserves the integrity of the evidence by guaranteeing that no data is altered, added, or deleted during the acquisition process, which is a fundamental requirement for admissibility in legal proceedings.

Answer

To allow the suspect drive to be mounted as read-write for analysis

Answer

To decrypt the drive automatically without the key

Answer

To speed up the imaging process by caching writes

Question 11

An investigator is analyzing email headers and notices the following: The 'Received' headers show a path through multiple servers, the 'DKIM-Signature' domain matches the sender domain, and 'X-Originating-IP' is present. Which TWO pieces of information are MOST useful to trace the original sender's IP address? (Choose two.)

Accepted Answer

The X-Originating-IP header value. The X-Originating-IP header (D) is the most direct artifact for tracing the sender, because it is typically inserted by the originating webmail or client and records the actual public IP address from which the message was submitted. The bottommost Received header (E) is also critical, since Received headers are prepended as the message traverses each hop, so the last (bottommost) entry reflects the earliest server that accepted the message and its connecting IP, which is closest to the true origin. Together, D and E let an investigator correlate the claimed client IP with the first-hop server's observed source address. The Message-ID (A) is only a unique identifier generated by the sending system and contains no routable IP information. The From header (B) is trivially spoofable and only shows a claimed address, not the transmission source. The DKIM-Signature d= domain (C) identifies the signing domain for authentication but does not reveal the sender's IP address.

Answer

The 'Message-ID' header

Answer

The 'From' header email address

Answer

The DKIM-Signature's 'd=' domain

Question 12

Which tool is commonly used for timeline analysis in digital forensics, allowing examiners to parse and correlate timestamps from various artifacts?

Accepted Answer

log2timeline. log2timeline (now part of the Plaso framework) is the de facto tool for timeline analysis in digital forensics. It parses a wide range of artifacts (e.g., $MFT, $UsnJrnl, Prefetch, Registry hives, event logs) and correlates their timestamps into a unified, super-timeline, enabling examiners to reconstruct system activity chronologically.

Answer

Sleuth Kit

Answer

Nmap

Answer

Wireshark

Question 13

An investigator must acquire a 2 TB USB 3.0 external hard drive as evidence in a fraud case. The drive contains a single NTFS volume with 500 GB of allocated data. The investigator needs to create a forensic image that captures all allocated and unallocated space, and the acquisition must be completed as quickly as possible while maintaining evidential integrity. Which acquisition method should the investigator use?

Accepted Answer

Create a physical image using a hardware write blocker and FTK Imager in E01 format. A physical image captures every sector, including unallocated space, which is essential for recovering deleted evidence in a fraud case. A hardware write blocker ensures the source drive is not altered, preserving evidential integrity. E01 compression reduces storage and transfer time compared to raw formats, addressing the speed requirement. Logical or sparse acquisitions would omit critical areas, making them unsuitable.

Answer

Perform a sparse acquisition that only copies allocated clusters

Answer

Create a logical image of the NTFS volume using EnCase Logical Evidence File (LEF)

Answer

Use the dd command with a software write blocker to create a raw image

Question 14

A malware analyst is examining a suspicious Windows executable that appears to be packed. During static analysis, the analyst notices that the PE file has a small number of imports, a high entropy in the .text section, and a section named UPX0. The analyst suspects the sample is packed with UPX. Which TWO of the following techniques would BEST allow the analyst to unpack the sample and continue analysis? (Choose two.)

Accepted Answer

Run the sample in a sandbox and dump the process memory after it unpacks itself.. UPX-packed executables can be unpacked either by using the UPX utility with the decompress option or by allowing the sample to unpack in memory and then dumping the process. The UPX utility directly reverses the compression if the file is unmodified. Memory dumping captures the unpacked code after the stub runs, which is effective even if the packer was customized. Other methods like strings analysis or section renaming do not achieve unpacking.

Answer

Use a debugger to set a breakpoint at the entry point and manually reconstruct the import address table.

Answer

Perform a strings analysis on the packed binary to extract the original source code.

Answer

Use a PE editing tool to change the section name from UPX0 to .text and then run the sample.

Question 15

A forensic analyst is investigating a compromised Microsoft Exchange Server 2019. The attacker gained access to a mailbox and exfiltrated emails. The analyst needs to determine the exact time and IP address from which the attacker accessed the mailbox via Outlook Web App (OWA). Which Exchange log should the analyst examine to find this information?

Accepted Answer

IIS logs on the Exchange server. IIS logs on the Exchange server capture HTTP requests to OWA, including the client IP address, timestamp, and username. This directly provides the time and IP address of the attacker's mailbox access. Other logs either lack IP address information or do not focus on OWA access. Therefore, IIS logs are the correct source.

Answer

Message tracking logs

Answer

Exchange audit logs

Answer

Windows Security event logs

Question 16

A forensic investigator is examining a compromised database server running Microsoft SQL Server 2019. The attacker gained access and executed several destructive queries. The investigator needs to determine the exact time and text of the malicious queries. The database is configured with the full recovery model, and transaction log backups are available. Which of the following should the investigator use to recover the query text?

Accepted Answer

Use a third-party log reader tool that parses the transaction log and extracts the query text from log records, such as ApexSQL Log or Quest Toad.. The transaction log in full recovery model records all transactions, but the native sys.fn_dblog function does not directly provide query text. Specialized third-party log reader tools can interpret log records and reconstruct the original queries, including the exact text and timing. This is the most reliable method for forensic recovery of query text from SQL Server transaction logs.

Answer

Restore the database from the last full backup, then use SQL Server Profiler to capture live queries as they are re-executed.

Answer

Use the sys.fn_dblog function to read the active transaction log and filter for LOP_INSERT_ROWS and LOP_DELETE_ROWS operations.

Answer

Use the sys.dm_exec_query_stats dynamic management view to retrieve the query text and execution statistics.

Question 17

A CHFI analyst is preparing a forensic workstation to image a suspect's USB flash drive. The analyst needs to ensure that the write-blocker is functioning correctly before connecting the drive. Which of the following is the most appropriate method to verify that the write-blocker is preventing write operations?

Accepted Answer

Connect the write-blocker to the forensic workstation, then use a known clean USB drive and attempt to write a file to it; if the write fails, the write-blocker is working.. The correct method is to test the write-blocker with a known clean drive by attempting a write operation. If the write is blocked, the write-blocker is functioning. This ensures the suspect's drive remains unaltered. Other methods either rely on indicators, which are insufficient, or risk contaminating evidence. Proper validation is a key step in the forensic process.

Answer

Connect the suspect's USB drive directly to the forensic workstation and attempt to write a test file; if the write succeeds, the write-blocker is not needed.

Answer

Use a software write-blocker on the forensic workstation instead of a hardware write-blocker, as software blockers are more reliable and do not require validation.

Answer

Check the write-blocker's LED indicators; if the power light is on and the read/write switch is set to read-only, the write-blocker is functioning correctly.

Question 18

An examiner acquires a full file system image from an Android device running Android 11. While parsing the image, they need to identify which application was used to send a specific SMS message that was deleted shortly after being sent. The device uses Google Messages as the default SMS app. Which artefact location is MOST likely to contain remnants of the deleted SMS content?

Accepted Answer

The mmssms.db SQLite database in /data/data/com.android.providers.telephony/databases/. SMS messages on Android are stored by the telephony provider in mmssms.db, regardless of which messaging app is used as the default. When a message is deleted, the SQLite record may remain in freelist pages or write-ahead log files until a vacuum operation occurs. The examiner should target this database and attempt carving or journal analysis to recover the deleted content. Other databases serve different purposes and would not contain the SMS body.

Answer

The WhatsApp msgstore.db in /data/data/com.whatsapp/databases/

Answer

The contacts2.db database in /data/data/com.android.providers.contacts/databases/

Answer

The com.google.android.gms database in /data/data/com.google.android.gms/databases/

Question 19

A forensic investigator is examining a Windows 10 workstation that was seized after a suspected data exfiltration. The user claims they only used legitimate cloud storage. The investigator wants to determine which USB mass storage devices were previously connected to the system by examining the Windows registry. Which registry location should the investigator examine to find the device instance IDs and associated volume serial numbers of previously connected USB storage devices?

Accepted Answer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR. The USBSTOR registry key under the SYSTEM hive is specifically designed to track USB mass storage devices. It records device instance IDs, which include the vendor ID, product ID, and serial number, allowing investigators to identify unique devices. This key persists even after the device is removed, making it a reliable source for determining previous USB storage connections.

Answer

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs

Answer

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2

Answer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\USBHUB\Enum

Question 20

A forensic lab in a shared office building must protect evidence against unauthorized physical access, environmental damage, and electromagnetic interference. The lab manager is documenting the physical controls for an accreditation audit. Which control best addresses the risk of an intruder removing a seized hard drive from the evidence room?

Accepted Answer

A locked evidence locker with a keypad entry log and tamper-evident seals on each evidence bag. The scenario asks for a control against unauthorized physical removal of evidence. Only a locked evidence locker with logged keypad access and tamper-evident seals both restricts entry and provides detection if a bag is opened. The other choices protect power continuity, block wireless signals, or prevent electrostatic damage, none of which stop an intruder from taking a drive.

Answer

A UPS connected to the forensic workstation to prevent power loss during imaging

Answer

An antistatic wrist strap worn by the examiner while handling the drive

Answer

A Faraday bag used to store mobile phones during transport