CHFI OS and Network Forensics — 10 Questions

Question 1

A security analyst investigates a Windows system and finds an event with ID 4625 in the Security log. What does this event indicate?

Accepted Answer

A failed logon attempt. Event ID 4625 in the Windows Security log specifically indicates a failed logon attempt. This event is generated by the Local Security Authority Subsystem Service (LSASS) whenever an authentication attempt fails, regardless of the logon type (interactive, network, service, etc.). The event details include the account name, source IP address, and failure reason code (e.g., 0xC000006D for bad username/password).

Answer

A successful user logon

Answer

A service was installed

Answer

A new user account was created

Question 2

During a forensic analysis of a compromised Linux server, you notice that the file /var/log/auth.log has been cleared. However, you find that the attacker's commands are still partially recoverable. Which artifact most likely contains the attacker's command history?

Accepted Answer

~/.bash_history. The ~/.bash_history file stores the command history for individual user accounts, including commands executed by an attacker who gained shell access. Even if /var/log/auth.log is cleared, this file retains the attacker's command history unless explicitly deleted or truncated. This makes it a key artifact for recovering attacker activity.

Answer

/var/log/syslog

Answer

/proc/1/cmdline

Answer

/etc/shadow

Question 3

A forensic analyst recovers a USB device from a suspect's computer. Which Windows registry key should be examined to determine the first time the USB device was connected?

Accepted Answer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR. The USBSTOR key under Enum in the SYSTEM hive stores detailed history of USB mass storage devices, including the first connection timestamp via the 'Properties' subkey (e.g., {83da6326-97a6-4088-9453-a1923f573b29} for first install date). This is the definitive location for determining the initial insertion time of a USB device in Windows forensics.

Answer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB

Answer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceClasses\{53f56307-b6bf-11d0-94f2-00a0c91efb8b}

Answer

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2

Question 4

An analyst suspects that an attacker used a web shell to execute commands on a Windows web server. Which Windows event ID should the analyst look for to detect service installation that may have been used for persistence?

Accepted Answer

7045. Event ID 7045 is logged by the Windows Service Control Manager when a new service is installed on the system. An attacker who gains a web shell often installs a malicious service to maintain persistence, and this event captures the service name, binary path, and service type, making it the primary forensic artifact to detect such activity.

Answer

4624

Answer

4648

Answer

4720

Question 5

A forensic examiner is analyzing a Mac system and wants to review system logs that record various activities, including application launches and kernel events. Which logging system on macOS should be examined?

Accepted Answer

Unified logging (log command). Unified logging (log command) is the correct answer because macOS has consolidated all system and user-level logs into a single, high-performance unified logging system since macOS 10.12 (Sierra). This system captures kernel events, application launches, and other activities in a structured, binary format that can be queried using the 'log' command-line tool or the Console app. It is the primary and most comprehensive source for forensic analysis of system activity on modern macOS systems.

Answer

.plist files

Answer

FSEvents

Answer

Console.app logs

Question 6

In Windows forensics, which artifact is used to track recently accessed files and folders via the 'Recent Items' feature?

Accepted Answer

LNK files. D is correct because LNK files (shortcut files) are the primary artifacts created by the Windows 'Recent Items' feature. When a user accesses a file or folder via the GUI (e.g., double-clicking), Windows automatically generates a corresponding .lnk file in the user's `%APPDATA%\Microsoft\Windows\Recent` directory, recording the target path, volume serial number, and timestamps. This makes LNK files the direct forensic evidence of recently accessed items through the Recent Items list.

Answer

Jump lists

Answer

ShellBags

Answer

Prefetch files

Question 7

A network analyst is reviewing a packet capture and sees a large number of TCP SYN packets sent to various ports on a single host from multiple source IPs. This pattern is most indicative of which type of attack?

Accepted Answer

SYN flood. A SYN flood attack exploits the TCP three-way handshake by sending a high volume of SYN packets with spoofed source IPs to a target host. The target allocates resources for each half-open connection, exhausting its backlog queue and preventing legitimate connections. The pattern of many SYN packets from multiple IPs to various ports matches this attack's signature.

Answer

ARP spoofing

Answer

DNS amplification

Answer

Ping of death

Question 8

During a Linux forensic investigation, you find that the file /etc/cron.d/evil contains the entry: '* * * * * root /bin/bash /root/backdoor.sh'. What persistence mechanism is being used?

Accepted Answer

Cron job. The entry in /etc/cron.d/evil follows the standard crontab format (minute, hour, day, month, weekday, user, command) and is placed in a system cron directory, making it a cron job. Cron jobs are a common Linux persistence mechanism that execute commands at scheduled intervals, and this one runs /root/backdoor.sh every minute as root.

Answer

Systemd service

Answer

Init script

Answer

At job

Question 9

Which of the following Windows registry keys is commonly used by malware to achieve persistence by executing a program at user logon?

Accepted Answer

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run. The HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run registry key is specifically designed to launch programs automatically when the current user logs on. Malware commonly writes a value pointing to its executable under this key to achieve user-level persistence without requiring administrative privileges, as it runs in the context of the logged-on user.

Answer

HKEY_LOCAL_MACHINE\SAM\SAM

Answer

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Answer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

Question 10

In network forensics, which tool is commonly used to analyze and visualize NetFlow data to identify network traffic patterns?

Accepted Answer

SolarWinds NetFlow Traffic Analyzer. SolarWinds NetFlow Traffic Analyzer (NTA) is specifically designed to collect, analyze, and visualize NetFlow data (and other flow protocols like sFlow, IPFIX, and J-Flow) to identify network traffic patterns, bandwidth usage, and top talkers. Unlike packet-level tools, NTA works on flow records exported by routers and switches, making it ideal for high-level traffic pattern analysis in network forensics.

Answer

Wireshark

Answer

Splunk

Answer

Nmap