CHFI Practice Exam 52 — 20 Questions

Question 1

A junior examiner is preparing a forensics lab workstation that will be used to image suspect drives. The lab policy states the workstation must never write to a connected suspect drive. Which practice ensures this requirement is met?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Connect the suspect drive through a hardware write-blocker before imaging. Imaging suspect media without altering it requires a hardware write-blocker placed between the workstation and the drive. Software attributes, encryption, and network mapping do not guarantee the drive stays unmodified. The write-blocker enforces read-only at the interface level, which is the accepted lab practice for preserving evidence integrity.

Answer

Enable BitLocker on the suspect drive before connecting it

Answer

Mount the suspect drive with the read-only attribute set in Windows Disk Management

Answer

Image the drive over the network using a mapped drive letter

Question 2

A forensic analyst is investigating a malware incident on a Windows system and suspects that the malware uses process injection to execute malicious code within a legitimate process. The analyst has acquired a memory dump of the system. Which two of the following techniques should the analyst use to detect and analyze process injection? (Choose two.)

Accepted Answer

Use the Volatility command malfind to identify hidden or injected code in process memory.. Detecting process injection from a memory dump requires techniques that directly examine process memory. Comparing on-disk and in-memory executable sections reveals modifications, while the Volatility malfind plugin scans for suspicious memory regions indicative of injected code. These two methods are specifically designed to uncover injection artifacts and are standard in memory forensics.

Answer

Analyze network traffic captures for signs of data exfiltration from the injected process.

Answer

Check the Windows event logs for process creation events with unusual parent-child relationships.

Answer

Run a full antivirus scan on the memory dump file to detect known malware signatures.

Question 3

A first responder arrives at a workstation suspected of being compromised by malware that is still running. The user is logged in and a suspicious process is active. The responder needs to capture volatile data before shutting down. Which command should be used first to capture the contents of RAM to a file?

Accepted Answer

winpmem.exe -o memory.raw. The order of volatility dictates that RAM contents should be captured before any other action. winpmem is a reliable Windows memory acquisition tool that outputs a raw memory file. The other options are either for a different OS, incorrect syntax, or analysis rather than acquisition. Capturing memory first ensures critical volatile evidence such as running processes and network connections is preserved.

Answer

volatility -f memory.raw imageinfo

Answer

ftk imager --capture-memory

Answer

dd if=/dev/mem of=memory.raw

Question 4

A forensic lab receives a sealed evidence bag containing a laptop seized during an investigation. The chain-of-custody form shows the bag was sealed at the scene by an officer. Before beginning analysis, the examiner must document the evidence. Which action best preserves the chain of custody at this point?

Accepted Answer

Photograph the sealed bag and its seal number, then record the date, time, and examiner name before opening. Chain of custody requires documenting the evidence's condition at every transfer. Photographing the sealed bag, recording the seal number, and logging the date, time, and examiner name before opening establishes an unbroken record from seizure to analysis. Skipping, delaying, or re-sealing without documentation creates gaps that weaken admissibility.

Answer

Ask the officer who sealed the bag to re-seal it in the lab before analysis

Answer

Immediately open the bag and begin imaging to save time

Answer

Store the bag in the evidence locker and delay documentation until analysis begins

Question 5

A first responder is handling a compromised Linux server that is still powered on and actively communicating with an unknown external IP. The responder needs to collect volatile evidence while minimizing disruption. Which TWO actions should be performed to preserve the most volatile data in the correct order? (Choose two.)

Accepted Answer

Run 'netstat -antp' to capture current network connections and associated processes.. The most volatile data on a running Linux system includes network connections and running processes. Capturing netstat -antp and ps aux first preserves this time-sensitive evidence. Full disk imaging and permission changes are either non-volatile or destructive and should not be performed before volatile data is secured. Following the order of volatility ensures critical evidence is not lost.

Answer

Immediately pull the power plug to prevent further data exfiltration.

Answer

Run 'chmod -R 000 /var/log' to protect log files from tampering.

Answer

Run 'dd if=/dev/sda of=/mnt/external/disk.img' to image the entire disk.

Question 6

A forensic investigator is examining a MySQL database server that was compromised. The investigator needs to determine which user account was used to perform unauthorized modifications to a critical table. The MySQL server has the general query log enabled. Which of the following should the investigator review to find the user account associated with the modifications?

Accepted Answer

The MySQL general query log. The MySQL general query log captures all SQL statements along with the user account and connection information. This makes it the ideal source for determining which user executed specific modifications. Other logs like the error log, binary log, and slow query log do not provide the user account context needed for this forensic task.

Answer

The MySQL slow query log

Answer

The MySQL error log

Answer

The MySQL binary log

Question 7

A first responder is called to a scene where a Windows laptop is suspected of being used in a crime. The laptop is turned on and logged in. The responder needs to preserve the most volatile evidence first. Which of the following should be captured first?

Accepted Answer

The contents of RAM. The order of volatility dictates that RAM is the most volatile and should be captured first. Registry, pagefile, and event logs are stored on disk and persist after shutdown, making them less volatile. Capturing RAM first ensures that running processes, network connections, and potentially encryption keys are preserved before any other action.

Answer

The event logs

Answer

The Windows Registry

Answer

The pagefile.sys file

Question 8

A forensic examiner is preparing to acquire a forensic image of a running Windows 10 laptop suspected of containing evidence of intellectual property theft. The examiner must capture volatile data that could be lost if the system is shut down. Which TWO of the following actions should the examiner take to preserve volatile evidence before imaging? (Choose two.)

Accepted Answer

Run the command 'netstat -an' to record active network connections.. Volatile data such as RAM contents and active network connections are lost when a system is powered off. Capturing RAM with a specialized tool preserves running processes, encryption keys, and other memory-resident evidence. Recording network connections with 'netstat -an' captures a snapshot of current communications. These steps must be taken before any disk imaging or shutdown to comply with the order of volatility.

Answer

Run 'chkdsk /f' to ensure the file system is consistent before imaging.

Answer

Create a forensic image of the hard drive using FTK Imager before capturing RAM.

Answer

Immediately shut down the laptop to prevent remote wipe or tampering.

Question 9

A forensic examiner is acquiring a running Linux server that is part of a live incident response. The server hosts a critical database and cannot be taken offline. The examiner needs to capture volatile data in a forensically sound manner. Which TWO of the following actions should the examiner perform? (Choose two.)

Accepted Answer

Capture network connections using the 'netstat' command. Capturing running processes with 'ps' and network connections with 'netstat' are standard volatile data collection steps that do not disrupt the server. They provide critical information about active threats and can be performed quickly. Full disk imaging and file system checks are either disruptive or irrelevant to volatile data, and deleting files destroys evidence.

Answer

Delete temporary files to free up space for acquisition

Answer

Use the 'dd' command to create a full disk image of the server's primary drive

Answer

Run 'fsck' on the primary drive to check for file system inconsistencies

Question 10

A forensic investigator is examining a Linux system and suspects that files were deleted to cover tracks. The investigator runs 'debugfs -R "lsdel" /dev/sda1' on an ext4 file system. The output shows several deleted inodes but does not include file names. What is the MOST likely reason for the missing file names?

Accepted Answer

The ext4 file system does not store file names in the inode; they are stored in directory entries, which are removed upon deletion.. In ext4, file names are stored in directory entries that map names to inode numbers. When a file is deleted, the directory entry is removed, but the inode may remain allocated or partially intact until reused. The debugfs lsdel command lists deleted inodes, but it cannot retrieve original file names because that information is not stored in the inode. Therefore, the missing names are expected behavior.

Answer

The file names were encrypted by the attacker, so they do not appear in plain text.

Answer

The file system was mounted read-only, preventing debugfs from reading directory entries.

Answer

The debugfs lsdel command only works on ext3 file systems and not on ext4.

Question 11

A forensic examiner is testifying in a U.S. court about a disk image acquired from a suspect's computer. The defense attorney argues that the image is not admissible because it is a copy, not the original. The examiner explains that the image was created using a write-blocker and verified with SHA-256 hashes. Which legal principle supports the admissibility of the disk image?

Accepted Answer

The Federal Rules of Evidence, specifically Rule 1003 (Admissibility of Duplicates). Federal Rule of Evidence 1003 permits duplicates to be admitted unless there is a genuine dispute about the original's authenticity or fairness concerns. The disk image, created with a write-blocker and verified by SHA-256 hashes, qualifies as a duplicate. Because the defense has not raised a specific authenticity challenge, the image can serve as evidence, provided the examiner can authenticate it and demonstrate the imaging process was reliable.

Answer

The Chain of Custody Doctrine

Answer

The Best Evidence Rule

Answer

The Hearsay Rule

Question 12

A network forensic analyst is investigating a suspected data exfiltration incident. The analyst captures live traffic and wants to identify covert channels that might be used to transfer data out of the network. Which two of the following techniques are MOST likely to indicate a covert channel? (Choose two.)

Accepted Answer

ICMP echo request packets with large payloads that contain non-standard data.. Covert channels often exploit protocols that are commonly allowed through firewalls, such as DNS and ICMP. Long, encoded DNS subdomains suggest DNS tunneling, while ICMP packets with large, non-standard payloads indicate ICMP tunneling. Both techniques can transfer data stealthily. The other options describe normal traffic or reconnaissance activities that do not involve hiding data within protocol fields.

Answer

ARP requests broadcast to the local subnet to resolve IP addresses to MAC addresses.

Answer

TCP SYN packets sent to multiple ports on a single host during a port scan.

Answer

HTTP POST requests to a known legitimate website with normal-sized payloads.

Question 13

A forensic analyst is examining a USB flash drive formatted with the FAT32 file system. The analyst needs to determine the total number of sectors in a cluster and the number of reserved sectors. Which of the following structures in the FAT32 file system contains this information?

Accepted Answer

The boot sector (also known as the Volume Boot Record), which contains the BIOS Parameter Block with fields for sectors per cluster and reserved sector count.. In FAT32, the boot sector contains the BIOS Parameter Block (BPB), which defines the file system's geometry, including sectors per cluster and reserved sector count. These values are essential for interpreting the FAT and locating data. The FAT itself holds cluster chain information, the root directory stores file entries, and the FSInfo sector provides free cluster hints. Only the boot sector provides the authoritative file system parameters needed for forensic analysis.

Answer

The root directory entry, which contains metadata about the file system including cluster size and reserved sector count.

Answer

The FAT (File Allocation Table) itself, which stores cluster chain information and also includes the total sector count in its header.

Answer

The FSInfo sector, which stores the total number of sectors and the number of free clusters, and also includes the cluster size.

Question 14

A forensic examiner is analyzing a Windows system and wants to determine the last time a specific user logged on interactively. Which Windows Event Log artifact should the examiner review?

Accepted Answer

Security event log, Event ID 4624 with Logon Type 2.. Interactive logons are recorded in the Security event log as Event ID 4624 with Logon Type 2. This event includes the timestamp, user account, and other details necessary to determine when the logon occurred. Other event IDs and logs either record different activities or are not related to user logons, making them unsuitable for this purpose.

Answer

Application event log, Event ID 1000 indicating an application error.

Answer

Security event log, Event ID 4634 indicating a logoff.

Answer

System event log, Event ID 6005 indicating the Event Log service started.

Question 15

A forensic investigator is examining a compromised Docker container on a Linux host. The investigator needs to collect volatile evidence from the running container before it is stopped. Which two actions should the investigator perform to capture the container's memory and running processes? (Choose two.)

Accepted Answer

Use 'docker checkpoint' to create a checkpoint of the running container, including its memory state. To capture volatile evidence from a running Docker container, the investigator should list running processes and capture memory state. Running 'ps aux' inside the container provides a snapshot of active processes, while 'docker checkpoint' preserves the container's memory and state. Other options like copying /proc, reading logs, or checking filesystem diffs do not capture memory or process information reliably.

Answer

Run 'docker logs <container_id>' to capture the container's stdout and stderr output

Answer

Use 'docker diff <container_id>' to list changes to the container's filesystem

Answer

Use 'docker cp' to copy the container's /proc directory to the host for analysis

Question 16

A forensic investigator is preparing to acquire a USB flash drive that is suspected to contain evidence of intellectual property theft. The investigator needs to ensure that the acquisition process does not alter any data on the flash drive. Which of the following should the investigator use?

Accepted Answer

A hardware write blocker. A hardware write blocker is the most reliable way to prevent any writes to the USB flash drive during acquisition. It physically intercepts write commands, ensuring the drive remains unaltered. Software write blockers and 'dd' do not offer the same level of guaranteed protection, and a USB hub has no write-blocking capability. Therefore, a hardware write blocker is the correct choice.

Answer

A software write blocker

Answer

The 'dd' command with the 'if' and 'of' parameters

Answer

A USB hub with power management

Question 17

A forensic investigator is analyzing a Linux system that was compromised. The investigator needs to examine the file system for evidence of unauthorized access. The system uses the ext4 file system. Which TWO of the following file system artifacts can provide evidence of file creation, modification, or access times? (Choose two.)

Accepted Answer

File system journal (ext4 journal). Inode timestamps (atime, mtime, ctime) directly record when a file was accessed, modified, or its metadata changed, providing a timeline of activity. The ext4 journal logs metadata transactions and can be analyzed to reconstruct recent file operations, including creation and deletion. Together, these artifacts offer valuable evidence of unauthorized file activity on the compromised system.

Answer

File allocation table (FAT)

Answer

Directory entry (dentry) cache

Answer

Extended attributes (xattrs)

Question 18

A forensic examiner is analyzing a potentially malicious Portable Executable (PE) file recovered from a compromised host. The examiner uses PEStudio to inspect the file and notices that the Import Address Table (IAT) contains only two functions: LoadLibraryA and GetProcAddress. Which of the following does this most likely indicate?

Accepted Answer

The malware uses dynamic API resolution to hide its true capabilities from static analysis tools.. A PE file that imports only LoadLibraryA and GetProcAddress is highly suspicious because it suggests the malware dynamically resolves other API calls at runtime. This technique hides the true functionality from static analysis, as the actual functions used are not visible in the import table. Investigators must use dynamic analysis or memory forensics to reveal the full behavior. This is a common evasion tactic in malware.

Answer

The file is a legitimate system component that relies on dynamic linking for performance optimization.

Answer

The malware is written in a high-level language such as C#, which compiles to a .NET assembly and has a minimal IAT.

Answer

The file is packed with a commercial packer, which automatically reduces the import table to these two functions.

Question 19

A forensic investigator is analyzing an ext4 file system from a Linux server. The investigator needs to locate the superblock, which contains critical file system metadata such as block size, total inode count, and mount count. The primary superblock is damaged, so the investigator must find a backup superblock. Which of the following commands or methods is most appropriate to locate a backup superblock on the ext4 file system?

Accepted Answer

Run `mke2fs -n /dev/sdX` to simulate file system creation and display the locations of backup superblocks without writing to the device.. In ext4, backup superblocks are located at fixed block offsets, typically at block group boundaries. The `mke2fs -n` command simulates file system creation and prints the locations of these backup superblocks without writing to the disk, making it a safe and effective method to identify them. Other commands like `dumpe2fs` require a valid superblock to run, and `fsck.ext4 -b` needs a known backup block number. The `$MFT` is an NTFS structure and irrelevant to ext4.

Answer

Examine the `$MFT` file to find the backup superblock, as ext4 stores superblock backups in the Master File Table.

Answer

Use the `dumpe2fs` command with the `-o superblock` option to list all backup superblock locations.

Answer

Use the `fsck.ext4 -b 32768 /dev/sdX` command to automatically scan for and use the first available backup superblock.

Question 20

During an incident response, a first responder needs to collect volatile data from a compromised Windows 10 system. The system has PowerShell v5.1 available. Which PowerShell cmdlet should be used to capture a list of currently running processes with their associated command lines?

Accepted Answer

Get-CimInstance Win32_Process | Select-Object Name, ProcessId, CommandLine. The Win32_Process CIM class includes the CommandLine property, which reveals the full command line for each process. Using Get-CimInstance with Select-Object for Name, ProcessId, and CommandLine provides a precise and efficient capture. Other options either lack command-line data or use deprecated cmdlets. This approach is reliable and non-intrusive for volatile data collection.

Answer

Get-Process | Where-Object {$_.CommandLine -ne $null}

Answer

Get-WmiObject -Class Win32_Process | Export-Csv processes.csv

Answer

Get-Process | Format-List *