CHFI Practice Exam 55 — 20 Questions

Question 1

An incident responder analyzes a compromised system and finds evidence of timestomping: the Modified timestamp of a malicious DLL is earlier than the Creation timestamp. Additionally, the DLL is encrypted with an XOR key. Which anti-forensic techniques are being employed?

Accepted Answer

Timestomping and obfuscation. Timestomping is confirmed because the Modified timestamp (which tracks file content changes) is earlier than the Creation timestamp, which is logically impossible under normal file system operations—this indicates an attacker deliberately set the Modified timestamp backward to evade timeline analysis. The XOR encryption of the DLL is a form of obfuscation, a technique used to hide the true content of the file from static analysis tools and signature-based detection. Together, these two actions represent the anti-forensic techniques of timestomping and obfuscation.

Answer

Packer and anti-debugging

Answer

Rootkit installation and process hiding

Answer

Log wiping and data hiding

Question 2

Which TWO of the following are essential steps that a first responder should take when arriving at a digital crime scene? (Select TWO)

Accepted Answer

Capture volatile data from running systems. A is correct because volatile data (e.g., RAM contents, running processes, network connections) is lost when power is removed. A first responder must capture this data using tools like `dd` or `memdump` before shutting down the system, as it may contain encryption keys, active malware, or evidence of ongoing network activity.

Answer

Immediately start the forensic imaging process

Answer

Install forensic software on the suspect's computer

Answer

Interview all witnesses without documentation

Question 3

Which TWO of the following are challenges in SSD forensics compared to traditional HDD forensics? (Choose two.)

Accepted Answer

Wear leveling distributes data across blocks, making it harder to recover specific files. B is correct because wear leveling is a fundamental SSD technology that spreads write operations evenly across all memory blocks to prevent premature wear. This process scatters file fragments across different physical locations, making it significantly harder to recover specific files using traditional forensic methods that rely on contiguous data storage.

Answer

SSDs are not compatible with forensic imaging tools

Answer

SSDs have larger storage capacity than HDDs

Answer

SSDs are more resistant to physical damage

Question 4

Which tool is specifically designed to analyze email headers, track the path of an email, and extract metadata such as originating IP and authentication results?

Accepted Answer

EmailTracker. EmailTracker is specifically designed to parse email headers, trace the email's path through mail servers, and extract metadata such as the originating IP address, authentication results (SPF, DKIM, DMARC), and timestamps. Unlike general-purpose tools, it focuses solely on email header analysis and visualization, making it the correct choice for this task.

Answer

Volatility

Answer

Wireshark

Answer

FTK Imager

Question 5

An investigator is analyzing an Android device and finds a database file in /data/data/com.whatsapp/databases/msgstore.db. Which type of information is MOST likely stored in this database?

Accepted Answer

WhatsApp chat messages. The msgstore.db file in the WhatsApp package directory is the primary SQLite database that stores all WhatsApp chat messages, including text messages, media metadata, and message timestamps. This database is located at /data/data/com.whatsapp/databases/msgstore.db on Android devices and is a key artifact for forensic recovery of WhatsApp conversations.

Answer

System call logs

Answer

GPS location history

Answer

Contact list from the device

Question 6

Which principle states that every contact leaves a trace?

Accepted Answer

Locard's exchange principle. Locard's exchange principle is the foundational forensic concept stating that whenever two objects come into contact, there is a transfer of material between them. In computer forensics, this means that digital activity—such as accessing a file, sending a packet, or connecting to a network—inevitably leaves traces in logs, memory, registry entries, or file metadata. This principle underpins the entire discipline of digital evidence recovery.

Answer

Chain of custody

Answer

Best evidence rule

Answer

Hearsay rule

Question 7

A forensic investigator is analyzing a malware sample that appears to be packed. Using PEiD, the analyst detects an entropy value of 7.8 and the entry point section is named 'UPX0'. Which of the following tools should the analyst use NEXT to unpack the malware for static analysis?

Accepted Answer

UPX -d. The presence of 'UPX0' as the entry point section name and an entropy value of 7.8 (very high, indicating compression or encryption) strongly suggests the malware is packed with UPX (Ultimate Packer for eXecutables). The correct next step is to use UPX with the -d (decompress) switch to unpack the binary, restoring the original executable for static analysis. This is a standard, reversible unpacking method that does not require dynamic analysis or disassembly of the packed stub.

Answer

Ghidra

Answer

Process Monitor

Answer

IDA Pro

Question 8

During a malware analysis, an analyst uses a tool to monitor registry changes, file system modifications, and process activity simultaneously. Which tool is BEST suited for this integrated monitoring?

Accepted Answer

Process Monitor. Process Monitor (ProcMon) is the correct tool because it integrates real-time monitoring of registry changes, file system modifications, and process/thread activity into a single interface. It combines the legacy tools Regmon (registry) and Filemon (file system) with process monitoring, allowing an analyst to correlate events across all three subsystems simultaneously, which is essential for dynamic malware analysis.

Answer

Wireshark

Answer

Regshot

Answer

Process Explorer

Question 9

An Android forensic examiner performs a physical acquisition on a device. Which TWO of the following are typical artefacts that can be recovered from the /data/data/ directory on a non-rooted device if the acquisition method allows full file system access?

Accepted Answer

App-specific SQLite databases. On a non-rooted Android device, the /data/data/ directory contains application-specific data, including SQLite databases and Shared Preferences XML files. These are typical artefacts because apps store structured data (e.g., user credentials, chat logs) in SQLite databases and configuration settings in Shared Preferences XML files. A physical acquisition with full file system access can recover these files even without root, as the acquisition method bypasses normal permission restrictions.

Answer

Bootloader configuration

Answer

Recovery mode logs

Answer

Kernel logs

Question 10

A forensic analyst is examining an iOS device backup and wants to extract call history records. Which SQLite databases and/or files contain relevant call history data? (Select TWO.)

Accepted Answer

AddressBook.db. Option C is correct because the AddressBook.db (or Contacts.sqlitedb on newer iOS versions) stores contact information, and call history records are linked to contacts via the `call_history.db` file. The `call_history.db` database contains the actual call log entries, including timestamps, durations, and associated contact identifiers. Together, these two databases allow an analyst to reconstruct call history with contact names.

Answer

Notes.sqlite

Answer

SMS.db

Answer

Calendar.sqlite

Question 11

A forensic analyst is examining a Windows malware sample using static analysis. Which tool is BEST suited for viewing the PE header structure, including sections, imports, and exports?

Accepted Answer

PEiD. PEiD is specifically designed to analyze PE (Portable Executable) headers, making it ideal for quickly viewing section tables, import/export tables, and detecting packers or compilers. It parses the IMAGE_NT_HEADERS structure directly, providing a concise summary of the PE layout without requiring disassembly or decompilation.

Answer

Strings

Answer

Ghidra

Answer

IDA Pro

Question 12

A security analyst discovers a suspicious file on a Windows system with the hash 'd41d8cd98f00b204e9800998ecf8427e'. Which type of indicator of compromise (IoC) is this hash most commonly associated with?

Accepted Answer

File hash indicator. The hash 'd41d8cd98f00b204e9800998ecf8427e' is the MD5 hash of an empty file (zero bytes). In malware forensics, a file hash is a classic file-based indicator of compromise (IoC) used to uniquely identify known malicious files. Option D is correct because this hash directly identifies a specific file, making it a file hash indicator.

Answer

Network indicator

Answer

Behavioural indicator

Answer

Registry key indicator

Question 13

During a malware analysis, an analyst runs a suspicious executable in a Cuckoo Sandbox and observes that the process creates a mutex named 'Global\XPSS-1.0.0' and writes a registry key under HKCU\Software\Microsoft\Windows\CurrentVersion\Run. What do these actions MOST likely indicate?

Accepted Answer

The malware is establishing persistence and ensuring only one instance of itself runs.. The mutex 'Global\XPSS-1.0.0' is used to prevent multiple instances of the malware from running simultaneously, which is a common anti-analysis and stability technique. Writing a registry key under HKCU\Software\Microsoft\Windows\CurrentVersion\Run is a standard method for achieving persistence, ensuring the malware executes automatically at user logon. Together, these actions directly indicate persistence and single-instance control, not privilege escalation, C2 communication, or hiding.

Answer

The malware is performing privilege escalation by exploiting a known vulnerability.

Answer

The malware is communicating with a command-and-control server to receive further instructions.

Answer

The malware is attempting to hide its presence by using a system mutex name and a legitimate registry location.

Question 14

An investigator extracts the SMS.db file from an iOS backup. Which table within this database would contain the actual message content for sent and received messages?

Accepted Answer

message. The `message` table in iOS's SMS.db database stores the actual text content of each SMS and iMessage in its `text` column. This is the primary table queried to retrieve the body of sent and received messages, as it contains one row per message with fields like `is_from_me`, `date`, and `text`.

Answer

attachment

Answer

handle

Answer

chat

Question 15

Which of the following is the primary purpose of performing static analysis on a suspicious binary?

Accepted Answer

Analysing the binary's code and structure without executing it. Static analysis examines a binary's code and structure without executing it, allowing analysts to identify malicious indicators such as embedded strings, import tables, and cryptographic constants. This approach avoids triggering anti-analysis mechanisms that activate upon execution, making it a foundational step in malware forensics.

Answer

Capturing network traffic generated by the binary

Answer

Observing the binary's runtime behaviour in a sandbox

Answer

Modifying the binary to bypass anti-analysis techniques

Question 16

During an iOS forensic examination, an analyst extracts an iTunes backup and finds a file named 'SMS.db'. Which of the following tools is BEST suited to parse and analyze this SQLite database for SMS and iMessage content?

Accepted Answer

SQLite Browser. SQLite Browser is the best tool for parsing and analyzing the 'SMS.db' file because it is a free, open-source SQLite database viewer that allows direct querying and inspection of the database schema, tables, and records. Since 'SMS.db' is a standard SQLite database containing SMS and iMessage data in iOS backups, SQLite Browser provides the most straightforward and cost-effective method for manual forensic analysis without relying on proprietary extraction tools.

Answer

GrayKey

Answer

Oxygen Forensic Detective

Answer

Cellebrite UFED

Question 17

An Android device is seized as evidence. The screen is locked with a PIN. Which tool or method is MOST appropriate for acquiring a physical image of the device without bypassing the lock screen, assuming the device is rooted?

Accepted Answer

Boot into recovery mode and use ADB to dd the userdata partition. Option A is correct because booting into recovery mode on a rooted Android device allows you to use ADB to execute the `dd` command, which can create a bit-for-bit physical image of the userdata partition without needing to bypass the lock screen. Since the device is rooted, you have the necessary privileges to read the raw block device, and recovery mode ensures the filesystem is not mounted, preventing data corruption during acquisition.

Answer

Use Cellebrite UFED with a lock screen bypass exploit

Answer

Remove the microSD card and image it separately

Answer

Perform an ADB backup to obtain app data only

Question 18

In malware static analysis, a PE file is examined. The section names include '.text', '.rdata', '.data', and '.rsrc'. The entry point is in the .text section. Which tool would be MOST appropriate to identify any packer that might be obfuscating the code?

Accepted Answer

PEiD. PEiD is specifically designed to detect packers, cryptors, and compilers by scanning PE files for known signatures in the entry point and section headers. Since the question asks for identifying a packer that obfuscates code, PEiD's signature-based detection directly targets this need, unlike general-purpose disassemblers or string extractors.

Answer

strings

Answer

Ghidra

Answer

IDA Pro

Question 19

A security analyst is reviewing output from a Cuckoo Sandbox analysis of a suspicious executable. The report shows that the process created a mutex named 'Global\GLOBAL_MUTEX_123' and modified the registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run\. Which behavioral indicator is MOST evident?

Accepted Answer

Persistence mechanism. The modification of the registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run is a classic persistence mechanism. This key is automatically processed by Windows Explorer at user logon, causing any executable listed there to run. Combined with the mutex creation (which prevents multiple instances), the behavioral indicator is clearly an attempt to establish persistence on the host.

Answer

Command and control communication

Answer

Anti-debugging technique

Answer

Privilege escalation

Question 20

Which of the following mobile forensic tools is specifically known for its ability to perform advanced extractions on iOS devices, including bypassing the lock screen on many models?

Accepted Answer

GrayKey. GrayKey is specifically designed for advanced iOS extractions, leveraging a combination of hardware and software exploits to bypass the lock screen on many iPhone models, including recent ones. Unlike general-purpose forensic tools, GrayKey focuses exclusively on iOS and uses techniques like checkm8 bootrom exploit or brute-force attacks via USB to gain access to encrypted device data.

Answer

Cellebrite UFED

Answer

Magnet AXIOM

Answer

Oxygen Forensic Detective