CHFI Practice Test 7 — 10 Questions

Question 1

In an investigation of a Windows system, the analyst uses Volatility's 'netscan' plugin and identifies a suspicious outbound connection to an IP address on port 4444. Which of the following is the most likely associated malicious activity?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Reverse shell connection from a backdoor. Port 4444 is the default port for the Metasploit Meterpreter reverse TCP payload. A Volatility netscan result showing an outbound connection to this port strongly indicates a reverse shell, where the compromised system initiates a connection back to an attacker's listener to bypass firewalls. This is a classic backdoor behavior, not a standard service.

Answer

DNS tunneling exfiltration

Answer

HTTP data exfiltration

Answer

Remote desktop session

Question 2

During a forensic examination of an SSD, the analyst notes that TRIM is enabled. What challenge does TRIM pose for data recovery?

Accepted Answer

TRIM permanently erases deleted data at the block level, hindering recovery. TRIM is an ATA command that allows the operating system to inform the SSD which data blocks are no longer in use. When TRIM is enabled, the SSD's garbage collection process immediately erases these blocks at the physical level, making the data permanently unrecoverable through conventional forensic tools. This directly hinders data recovery because the deleted data is physically zeroed or marked as invalid before any forensic acquisition can occur.

Answer

TRIM reduces the lifespan of the SSD by excessive writes

Answer

TRIM compresses data, altering forensic signatures

Answer

TRIM encrypts data, preventing forensic access

Question 3

In an ext4 file system, after a file is deleted, the inode's di_mode field is set to 0 and the block pointers are cleared. However, the file content may still be recoverable until what happens?

Accepted Answer

The data blocks are overwritten by new files. When a file is deleted in ext4, the inode's di_mode is set to 0 and block pointers are cleared, but the actual data blocks on disk remain unchanged. The file content remains recoverable until those specific data blocks are overwritten by new file data, because only then is the original content physically destroyed. This is why data recovery tools can often restore deleted files if the blocks have not been reused.

Answer

The file system is unmounted

Answer

The superblock is updated

Answer

The journal is committed

Question 4

An analyst is analyzing a disk image and finds a 512-byte sector at LBA 0 that contains a bootloader and a partition table. The partition table has four entries, each 16 bytes. What type of partition table is this?

Accepted Answer

MBR. The Master Boot Record (MBR) partition table is defined by a 512-byte sector at LBA 0 that contains a bootloader (first 446 bytes) and four 16-byte partition entries (total 64 bytes), ending with a 2-byte signature (0x55AA). This matches the description exactly, making B the correct answer.

Answer

Apple Partition Map

Answer

GPT

Answer

BSD disklabel

Question 5

A security analyst examines a compromised Windows server and finds a file named 'readme.txt' that appears legitimate. However, using `dir /r`, they discover an alternate data stream named 'readme.txt:hidden.exe'. What is the most likely purpose of this alternate data stream?

Accepted Answer

It is a malicious executable hidden in the file. Alternate data streams (ADS) in NTFS allow a malicious executable to be hidden within a legitimate file without affecting its visible size or content. The `dir /r` command reveals the ADS 'readme.txt:hidden.exe', indicating that an executable is attached to the file, which is a common technique to evade detection and execute malware.

Answer

It is a backup copy of the file

Answer

It is a symbolic link to another file

Answer

It is a log file generated by the operating system

Question 6

An investigator uses the `volatility -f mem.dump netscan` command on a memory dump from a Windows 10 system. What information is this command primarily intended to reveal?

Accepted Answer

Network connections and listening ports. The `volatility -f mem.dump netscan` command is specifically designed to extract network connection artifacts from a memory dump, including active TCP/UDP connections, listening ports, and associated process identifiers (PIDs). It parses Windows network data structures such as `_TCPT_OBJECT` and `_UDP_HEADER` to reconstruct the network state at the time of acquisition, making it the correct tool for revealing network connections and listening ports.

Answer

List of running processes

Answer

File handles opened by each process

Answer

Registry hives loaded in memory

Question 7

A forensic investigator is analyzing a USB drive formatted with FAT32 and finds that a deleted file's directory entry still exists but the first character of the filename is replaced with 0xE5. What does this indicate?

Accepted Answer

The file has been deleted. In FAT32 file systems, when a file is deleted, the first byte of its directory entry's filename is replaced with the hexadecimal value 0xE5 (which displays as a lowercase sigma 'σ' in some viewers). This is the standard deletion marker for FAT file systems, indicating that the file's directory entry is available for reuse. The presence of 0xE5 in the first character position specifically signifies deletion, not any other attribute or state.

Answer

The file is marked as hidden

Answer

The file is encrypted

Answer

The file is fragmented

Question 8

An investigator is analyzing a FAT32 drive and notices that a deleted file's directory entry still exists, but the first byte of the filename is changed to 0xE5. What does this indicate about the file?

Accepted Answer

The file is marked as deleted but its data clusters may still be intact. In FAT32 file systems, a deleted file's directory entry is marked by replacing the first byte of the filename with 0xE5. This indicates the file is logically deleted, but the data clusters referenced in the directory entry remain intact until overwritten by new data. Option B is correct because the 0xE5 marker is the standard FAT deletion marker, and the clusters are not erased.

Answer

The file is fragmented

Answer

The file has been securely overwritten

Answer

The file is encrypted

Question 9

A forensic analyst is examining a Windows 10 system and needs to view the Master File Table ($MFT) to identify recently deleted files. Which tool is most appropriate for parsing the $MFT directly?

Accepted Answer

EnCase. EnCase is a forensic suite that includes a dedicated parser for the Master File Table ($MFT) on NTFS volumes. It can directly read the raw $MFT file to recover metadata of deleted files, including their names, timestamps, and data runs, even after the directory entry is removed. This makes it the correct choice for examining the $MFT to identify recently deleted files.

Answer

Wireshark

Answer

John the Ripper

Answer

Nmap

Question 10

A forensic analyst is examining a Microsoft Outlook PST file as part of an email investigation. Which tool is specifically designed to parse and analyze PST files and extract email metadata?

Accepted Answer

Aid4Mail. Aid4Mail is a forensic email analysis tool that supports PST, OST, MBOX, and other formats. It is commonly used for email investigations.

Answer

Wireshark

Answer

EmailTracker

Answer

Sleuth Kit