CHFI Practice Test 7 — 10 Questions

Question 1

A forensic analyst is reviewing the syslog from a compromised Linux server. Based on the exhibit, what does the 'orphan inode deleted' message indicate?

Accepted Answer

A file was deleted while still open, and the filesystem has cleaned up the orphan inode.. The 'orphan inode deleted' message in syslog indicates that a file was deleted while it was still open by a process. The kernel's inode cleanup mechanism (part of the VFS layer) detected the orphaned inode—an inode with no directory entry but still referenced by an open file descriptor—and removed it after the last file descriptor was closed. This is standard behavior in Linux filesystems (e.g., ext4) and is not indicative of hidden files, rootkits, or critical system file alerts.

Answer

A hidden file was permanently removed from the filesystem.

Answer

A rootkit has attempted to hide files by marking them as orphan inodes.

Answer

A critical system file has been deleted, and the filesystem is warning the administrator.

Question 2

During an iOS forensic examination of an iCloud backup, an analyst finds that the SQLite database files for the Health app are encrypted. Which component is MOST likely responsible for encrypting this data, and what is required to decrypt it?

Accepted Answer

The data is protected by iOS Data Protection using a key derived from the device passcode; decryption requires the passcode or a forensic bypass tool.. IOS Health app data is protected by iOS Data Protection, which uses a class key derived from the user's device passcode. This key encrypts the SQLite database files in iCloud backups, and decryption requires either the passcode or a forensic bypass tool that can extract the key from the device's Secure Enclave.

Answer

The data is encrypted with the device's hardware UID; decryption is impossible without Apple's assistance.

Answer

The data is encrypted using Apple's FileVault; decryption requires the user's iCloud password.

Answer

The data is encrypted using SQLCipher; decryption requires a 256-bit key stored in the Keychain.

Question 3

An investigator needs to acquire data from a suspect's hard drive without altering any data. Which tool is MOST appropriate to ensure write-blocking at the hardware level?

Accepted Answer

Tableau Forensic Bridge (hardware write-blocker). A hardware write-blocker like the Tableau Forensic Bridge sits between the suspect drive and the forensic workstation at the physical layer, intercepting and blocking any write commands (e.g., ATA WRITE DMA, SCSI WRITE) before they reach the drive. This ensures that no data—including metadata, timestamps, or file system artifacts—is altered during acquisition, which is critical for maintaining evidentiary integrity. Software-based blockers can be bypassed by the OS or a malicious driver, making hardware-level blocking the gold standard in forensic acquisition.

Answer

FTK Imager (software write-blocker)

Answer

dd command with 'iflag=noatime'

Answer

EnCase software acquisition module

Question 4

An analyst receives an alert indicating a suspicious process (PID 3342) is making outbound connections on port 443 to an unknown IP. The system is a Windows 10 workstation. Which first responder action is MOST appropriate?

Accepted Answer

Capture a full memory dump using a tool like FTK Imager (Memory Capture) or DumpIt.. Capturing a full memory dump (option A) is the most appropriate first responder action because it preserves the volatile state of the suspicious process (PID 3342) and its associated artifacts (e.g., network connections, loaded DLLs, encryption keys) before any further system changes occur. This allows forensic analysis to identify the malware's behavior, such as command-and-control (C2) communication over port 443 (HTTPS), without altering evidence. Tools like FTK Imager (Memory Capture) or DumpIt acquire a raw .mem file that can be analyzed with Volatility or Rekall to extract process details, network sockets, and injected code.

Answer

Immediately disconnect the system from the network to contain the threat.

Answer

Check the Windows Event Logs for related entries.

Answer

Reboot the system to clear any malicious processes from memory.

Question 5

During a forensic investigation, an analyst needs to preserve the integrity of evidence on a hard drive. Which of the following is the best practice for acquiring an image of the drive?

Accepted Answer

Use a hardware write blocker and create a bit-stream image.. Using a hardware write blocker ensures that no write commands from the forensic workstation reach the suspect drive, preserving its integrity at the physical level. Creating a bit-stream image (sector-by-sector copy) captures all data, including slack space and unallocated clusters, which is essential for thorough forensic analysis. This combination is the gold standard in digital forensics, as mandated by best practices like those from NIST and the ACPO principles.

Answer

Use the 'dd' command to create a raw image without a write blocker.

Answer

Connect the drive to a forensic workstation and use the operating system's copy command.

Answer

Format the drive before imaging to ensure no hidden data is missed.

Question 6

Which Windows artifact is specifically designed to track the most recently used (MRU) files for specific applications and can be found in the NTUSER.DAT registry hive?

Accepted Answer

MRU lists in the registry. The NTUSER.DAT registry hive contains per-user MRU (Most Recently Used) lists that track files recently accessed by specific applications, such as the 'RecentDocs' key for Office applications or 'ComDlg32' for common dialog boxes. These registry keys are explicitly designed to store MRU data, making them the direct artifact for this purpose.

Answer

Prefetch files

Answer

Jump Lists

Answer

LNK files

Question 7

During a mobile forensic investigation of an iPhone, an examiner needs to recover deleted SMS messages. Which acquisition method provides the highest likelihood of retrieving deleted data from the device's flash memory?

Accepted Answer

Physical acquisition via JTAG or chip-off. Physical acquisition via JTAG or chip-off provides the highest likelihood of recovering deleted SMS messages because it accesses the raw NAND flash memory at the hardware level, bypassing the iOS file system and logical abstractions. Deleted data on flash storage remains in unallocated blocks until overwritten, and physical imaging captures these remnants, including deleted SQLite records from the SMS database. In contrast, logical and file system methods only retrieve active files, missing the unallocated space where deleted messages reside.

Answer

Manual acquisition by taking screenshots

Answer

File system acquisition via iOS file system extraction

Answer

Logical acquisition via iTunes backup

Question 8

During incident response, a first responder discovers a compromised system with signs of an active command-and-control (C2) connection. What is the MOST important immediate action to preserve evidence and prevent further damage?

Accepted Answer

Disconnect the network cable to isolate the system from the network.. Disconnecting the network cable immediately stops the active C2 communication, preventing further data exfiltration and command injection while preserving the current state of memory and disk. This action maintains the integrity of volatile evidence (e.g., network connections, running processes) and avoids the data loss that would occur with a shutdown or the evidence contamination that would result from running a scan.

Answer

Create a full disk image before taking any other action.

Answer

Immediately shut down the system to prevent further data exfiltration.

Answer

Run a full antivirus scan to remove the malware.

Question 9

Which TWO of the following are essential components of a proper chain of custody documentation? (Select TWO)

Accepted Answer

Date and time of evidence collection. The date and time of evidence collection is a fundamental element of chain of custody documentation, establishing a precise chronological record of when the evidence was acquired. This timestamp is critical for proving the integrity and continuity of the evidence from the moment of seizure, and it must be recorded with accuracy (often to the second) and in a consistent time zone (e.g., UTC) to avoid disputes. Without this, the chain of custody cannot demonstrate that the evidence was not tampered with between collection and analysis.

Answer

The IP address of the forensic workstation

Answer

Backup location of the evidence

Answer

The forensic tool used to analyze the evidence

Question 10

You are a forensic investigator responding to a suspected data breach at a financial institution. The incident response team has isolated a Windows 10 workstation used by a former employee. The system is still powered on, and the login screen is displayed. Your task is to acquire forensic evidence in a defensible manner. The following actions are available:

A. Immediately pull the power cord to perform a cold acquisition of the hard drive.
B. Capture volatile data (RAM, network connections, running processes) using a trusted tool on a USB drive, then shut down normally and remove the hard drive for imaging.
C. Boot the system from a forensic live CD and create a forensic image of the hard drive while the system is running.
D. Use the built-in Windows backup to create a system image to an external drive.

Which action is the most appropriate first step in this scenario?

Accepted Answer

Capture volatile data using a trusted tool on a USB drive, then shut down normally and remove the hard drive for imaging. The system is still powered on with the login screen displayed, meaning volatile data (RAM, network connections, running processes) is present and will be lost if the system is powered off. Capturing this data first using a trusted forensic tool (e.g., FTK Imager or DumpIt) from a write-blocked USB drive preserves critical evidence such as encryption keys, active network connections, and malware in memory. Only after volatile data is secured should the system be shut down normally and the hard drive removed for forensic imaging, ensuring a defensible chain of custody.

Answer

Use the built-in Windows backup to create a system image to an external drive

Answer

Boot the system from a forensic live CD and create a forensic image of the hard drive while the system is running

Answer

Immediately pull the power cord to perform a cold acquisition of the hard drive